GRC - Governance, Risk, and Compliance Business Continuity and Resilience Questions and Answers

Question 1

What is the primary objective of conducting a Business Impact Analysis (BIA) as part of a business continuity management system?

Accepted Answer

To identify and prioritize critical business functions and their dependencies.

Answer

To develop detailed technical recovery procedures for IT systems.

Answer

To select and procure an alternate operating site for disaster recovery.

Answer

To test the effectiveness of the organization's incident response plan.

Question 2

A company's online transaction processing system has a defined Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. A major system failure occurs at 3:00 PM. Which statement accurately describes the business continuity requirement?

Accepted Answer

The system must be restored with data that is no older than 2:45 PM.

Answer

The system must be fully operational again by 3:15 PM.

Answer

The system can tolerate losing up to 2 hours of data before the failure.

Answer

The recovery team has up to 15 minutes to begin the restoration process.

Question 3

In the context of GRC, how does organizational resilience differ from traditional business continuity?

Accepted Answer

Resilience incorporates the ability to adapt and thrive in a changing environment, not just recover from disruptions.

Answer

Business continuity is a strategic initiative led by the board, while resilience is a tactical plan managed by IT.

Answer

Resilience is solely focused on IT disaster recovery, while continuity covers all business functions.

Answer

Business continuity plans are tested annually, whereas resilience strategies are not tested.

Question 4

An organization's GRC committee wants to validate its business continuity plan's effectiveness in a realistic manner without causing an actual business disruption. The team decides to conduct an exercise where key personnel gather in a conference room to talk through their roles and responsibilities during a simulated crisis scenario. What type of test is this?

Accepted Answer

Tabletop Exercise

Answer

Full Interruption Test

Answer

Parallel Test

Answer

System Walk-through

Question 5

From a GRC perspective, which of the following is the primary benefit of integrating Business Continuity Management (BCM) into the overall governance and risk management framework?

Accepted Answer

It ensures that the response to disruptive events is aligned with the organization's risk appetite and strategic objectives.

Answer

It replaces the need for cybersecurity insurance policies.

Answer

It guarantees that the organization will never experience a service disruption.

Answer

It eliminates the need for the internal audit function to review disaster recovery capabilities.

Question 6

A GRC professional is reviewing the organization's Business Continuity Plan (BCP). Which of the following is an essential component that must be included in the plan to ensure it can be executed effectively?

Accepted Answer

Clear activation criteria and procedures for plan invocation.

Answer

Detailed financial budgets for the next three fiscal years.

Answer

Employee performance review records and salary information.

Answer

A list of marketing campaigns for the upcoming quarter.