Business Continuity Flashcards
7 cards from real CCISO practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Business Continuity flashcards as text
What is the primary purpose of a Business Continuity Policy?
Answer: To establish management commitment and high-level framework for BC activities
A BC Policy communicates executive commitment, defines scope, assigns accountability, and provides the governance framework for all continuity activities.
Which concept refers to the point beyond which a business function cannot recover and the organization would cease to operate viably?
Answer: Maximum Tolerable Downtime (MTD)
MTD (also called Maximum Tolerable Period of Disruption) is the maximum time a business function can be unavailable before the organization suffers irreversible harm.
When prioritizing recovery efforts, a CISO should base decisions primarily on:
Answer: The criticality and interdependencies identified in the BIA
The BIA provides objective data on financial and operational impact, enabling the CISO to prioritize recovery of the most critical and interdependent systems first.
A tabletop exercise differs from a simulation test in that a tabletop exercise:
Answer: Is a discussion-based review without actual execution of recovery procedures
Tabletop exercises are structured discussions where team members walk through a scenario to identify gaps without activating the actual plan or disrupting operations.
Which of the following is a key reason organizations implement geographic diversity in their BC strategy?
Answer: To avoid single points of failure due to regional disasters
Geographic diversity ensures that a regional disaster (earthquake, hurricane, power grid failure) cannot simultaneously affect both the primary and recovery sites.
In the context of supply chain resilience within BCP, which practice best mitigates single-supplier risk?
Answer: Maintaining a list of qualified alternate suppliers for critical components
Pre-qualifying alternate suppliers ensures the organization can quickly pivot to another source if the primary supplier is disrupted, reducing single-point-of-failure risk.
Which role is typically responsible for declaring a disaster and formally activating the Business Continuity Plan?
Answer: The Crisis Management Team or designated executive authority
Formal disaster declaration authority is granted to a Crisis Management Team or a designated senior executive to ensure consistent, authorized activation of the BCP.