DRI International Qualifying Examination (CBCP/ABCP) — Questions and Answers

Question 1: Which international standard specifically addresses supply chain continuity and provides requirements for business continuity within the context of supply chain resilience?

ISO 9001
ISO 31000
ISO 28000 (Correct answer)
ISO 27001

Correct answer: ISO 28000

ISO 28000 specifies requirements for a security management system for the supply chain, including business continuity elements relevant to supply chain disruptions.

Question 2: When conducting a BC audit, an auditor uses a 'walk-through' technique. This means the auditor is:

Following a transaction or scenario through the BC process step by step to test it (Correct answer)
Reviewing all written plans without engaging staff
Physically walking through the facility to check infrastructure
Observing a live DR failover test

Correct answer: Following a transaction or scenario through the BC process step by step to test it

A walk-through involves tracing a scenario or process through each step to evaluate whether the procedure works as documented.

Question 3: Which PDCA cycle phase involves executing the plan on a small scale to test its effectiveness?

Plan
Check
Do (Correct answer)
Act

Correct answer: Do

The 'Do' phase of the PDCA cycle involves implementing the plan on a small or pilot scale to gather data.

Question 4: How does business continuity planning relate to risk management?

It is unrelated to risk management.
It ensures business resilience against various risks (Correct answer)
It is focused solely on operational risks.
It only addresses financial risks.

Correct answer: It ensures business resilience against various risks

Business continuity planning (BCP) is an integral part of an organization's overall risk management strategy. It proactively identifies potential threats and vulnerabilities, and then develops strategies and plans to mitigate their impact, ensuring the organization's ability to withstand and recover from various risks, thereby enhancing its resilience.

Question 5: What is the key risk of using asynchronous replication compared to synchronous replication?

Requirement for identical hardware at both sites
Potential data loss between the last sync and the failure event (Correct answer)
Higher network latency on primary transactions
Inability to replicate across geographic distances

Correct answer: Potential data loss between the last sync and the failure event

Asynchronous replication acknowledges writes on the primary before confirming them on the secondary, meaning a failure can result in loss of the data that was in-flight at the time of the outage.

Question 6: A BC manager discovers that a critical vendor's SLA does not align with the organization's RTO. Under ISO 22301, the MOST appropriate first action is:

Terminate the vendor contract immediately
Document the gap in the risk register and assess impact through the BIA (Correct answer)
Implement a manual workaround without further analysis
Notify regulators of the compliance gap

Correct answer: Document the gap in the risk register and assess impact through the BIA

ISO 22301 requires organizations to evaluate and address risks from interested parties (including suppliers); documenting the gap and assessing its impact through the BIA ensures a risk-based, evidence-based response.

Question 7: In DRI terminology, what is a 'drill' most accurately defined as?

A tabletop scenario with executive participation
A multi-agency coordinated exercise
A supervised practice of a single operation or function (Correct answer)
An unannounced activation of the full continuity plan

Correct answer: A supervised practice of a single operation or function

A drill is a coordinated, supervised activity that tests a single specific operation or function, such as a fire evacuation or system failover.

Question 8: The primary purpose of conducting joint training exercises with external agencies is to:

Demonstrate superiority of the organization's internal response capabilities
Identify gaps in coordination, validate plans, and build relationships before an actual incident (Correct answer)
Satisfy regulatory audit requirements
Reduce the number of external agency contacts required

Correct answer: Identify gaps in coordination, validate plans, and build relationships before an actual incident

Joint exercises help identify coordination gaps, validate interoperability of plans, and build working relationships with external agencies before real incidents occur.

Question 9: What is the primary purpose of an Incident Action Plan (IAP) in emergency operations?

Establish long-term recovery milestones
Record contact information for all responders
Communicate objectives and tactics for a specific operational period (Correct answer)
Document post-incident financial losses

Correct answer: Communicate objectives and tactics for a specific operational period

An IAP specifies the incident objectives, strategies, tactics, and assignments for a defined operational period.

Question 10: FISMA requires federal agencies to develop, document, and implement an agency-wide information security program. Which of the following is the FISMA-required frequency for testing contingency plans for HIGH-impact systems?

Quarterly
Annually (Correct answer)
Every three years
Every two years

Correct answer: Annually

NIST SP 800-53 CP-4 (referenced by FISMA) requires annual contingency plan testing and exercises for HIGH-impact federal information systems.

Question 11: How does ISO 22301 define the relationship between recovery time objectives (RTOs) and the Business Continuity Management System?

RTOs determined through BIA are requirements that drive BCMS strategy and resource decisions, and the BCMS must demonstrate through exercise that RTOs are achievable (Correct answer)
ISO 22301 treats RTOs as aspirational targets rather than binding BCMS requirements
RTOs are set by the certification body based on industry benchmarks during the certification audit
ISO 22301 mandates specific RTO thresholds for different types of organizations

Correct answer: RTOs determined through BIA are requirements that drive BCMS strategy and resource decisions, and the BCMS must demonstrate through exercise that RTOs are achievable

In ISO 22301, RTOs are requirements derived from BIA that drive all downstream BCMS strategy and resource decisions—strategies must be designed to meet RTOs, and exercises must demonstrate that RTOs are achievable in practice.

Question 12: What is the key distinction between 'crisis management' and 'crisis communications'?

Crisis management focuses on recovery; crisis communications focuses on prevention
Crisis management involves operational decisions; crisis communications involves information flow to stakeholders (Correct answer)
Crisis communications is a subset of IT disaster recovery
Crisis management is reactive; crisis communications is always proactive

Correct answer: Crisis management involves operational decisions; crisis communications involves information flow to stakeholders

Crisis management encompasses strategic and operational decisions to resolve the incident, while crisis communications focuses on how information is shared with internal and external stakeholders.

Question 13: A company's social media manager begins posting updates during a crisis without authorization from the crisis team. This MOST directly threatens:

Message consistency and organizational credibility (Correct answer)
IT security protocols
Regulatory compliance
Legal discovery processes

Correct answer: Message consistency and organizational credibility

Unauthorized social media posts can contradict official statements, creating inconsistent messaging that undermines organizational credibility during a crisis.

Question 14: When should an organization activate its Crisis Management Team (CMT) versus its local Incident Response Team (IRT)?

The IRT is activated first and immediately transfers authority to the CMT upon activation
The CMT should be activated for every incident; the IRT is only used for IT-related incidents
The IRT manages operational-level response; the CMT is activated when incidents threaten strategic business objectives, executive decision-making, or cross-organizational coordination (Correct answer)
The CMT handles external communications; the IRT handles internal communications

Correct answer: The IRT manages operational-level response; the CMT is activated when incidents threaten strategic business objectives, executive decision-making, or cross-organizational coordination

Local IRTs manage operational incident response within their scope. The CMT is activated for incidents that escalate to strategic significance—threatening major business objectives, requiring executive decisions, necessitating cross-organizational coordination, or creating significant external stakeholder impact.

Question 15: What does ISO 22301 require regarding 'documented information' (documentation)?

Documented information must be controlled—created, updated, distributed, accessed, and retained in a manner ensuring availability, suitability, and protection (Correct answer)
All organizational processes must be fully documented in writing
All documented information must be stored in cloud-based systems with regulatory-compliant security
Organizations must use standardized document templates approved by the certification body

Correct answer: Documented information must be controlled—created, updated, distributed, accessed, and retained in a manner ensuring availability, suitability, and protection

ISO 22301 Clause 7.5 requires documented information to be controlled—created and updated properly, distributed to appropriate parties, accessible when needed, protected from loss and unauthorized changes, and retained and disposed of appropriately.

Question 16: Which action should be taken when a vendor's BC plan does not meet your organization's RTOs?

Reduce your own RTO to match the vendor's capability
Require the vendor to improve their plan or identify an alternate vendor who can meet requirements (Correct answer)
Accept the risk and proceed with the vendor relationship unchanged
Remove the RTO requirement from your BC plan

Correct answer: Require the vendor to improve their plan or identify an alternate vendor who can meet requirements

If a vendor's BC plan cannot support your RTOs, you must either require improvements or identify alternate vendors whose capabilities align with your recovery time requirements.

Question 17: The Sarbanes-Oxley Act (SOX) Section 404 is primarily relevant to business continuity because it requires:

Annual penetration testing of financial systems
Mandatory cyber incident reporting to the SEC within 72 hours
Segregation of duties for all financial transactions above $10,000
Management assessment of internal controls over financial reporting, including controls supporting system availability (Correct answer)

Correct answer: Management assessment of internal controls over financial reporting, including controls supporting system availability

SOX Section 404 requires management to assess and report on internal controls over financial reporting, which includes IT general controls such as system availability, backup, and recovery—core business continuity elements.

Question 18: What is meant by 'Recovery Point Actual (RPA)' versus 'Recovery Point Objective (RPO)'?

RPA is the regulatory requirement; RPO is the internal goal
RPA applies to real-time systems; RPO applies to batch-processing systems
RPO is the target data loss tolerance; RPA is the actual data loss achieved during a specific recovery event (Correct answer)
These terms are interchangeable in modern DR practice

Correct answer: RPO is the target data loss tolerance; RPA is the actual data loss achieved during a specific recovery event

RPO is the target—the maximum data loss the business can tolerate. RPA is the actual data loss that occurred during a specific recovery event. Comparing RPA to RPO measures whether the DR solution actually met its objectives.

Question 19: What is the 'Golden Hour' principle in emergency response?

The 60-minute window for completing all regulatory notifications
The optimal duration for an initial incident response briefing
The critical first hour after an incident when initial response actions disproportionately determine the ultimate outcome (Correct answer)
The first hour after business opening when most emergency calls are received

Correct answer: The critical first hour after an incident when initial response actions disproportionately determine the ultimate outcome

The 'Golden Hour' principle holds that actions taken in the first hour after an incident—notification, initial containment, EOC activation, resource mobilization—disproportionately determine whether the incident escalates or is controlled, making rapid initial response critical.

Question 20: What role does social media play in modern crisis communication?

It is only relevant for consumer-facing organizations
It should only be used after traditional media has been briefed
It serves as both a monitoring tool to detect emerging crises and a rapid communication channel (Correct answer)
It should be avoided entirely during crises to prevent misinformation

Correct answer: It serves as both a monitoring tool to detect emerging crises and a rapid communication channel

Social media is both an early warning system for detecting developing crises and a real-time communication channel for reaching stakeholders. Organizations must monitor and engage on social media as an integral part of crisis communication.

Question 21: A CBCP (Certified Business Continuity Professional) designation requires candidates to demonstrate knowledge across how many DRII Professional Practices?

12
7
10 (Correct answer)
5

Correct answer: 10

The DRII framework comprises 10 Professional Practices that together cover the full lifecycle of a business continuity management program.

Question 22: Why must pandemic plans specifically address 'long-term resource depletion' as a planning consideration?

Pandemics consume more IT resources than other disruptions due to remote work expansion
Insurance coverage for pandemics depletes more rapidly than for other risk types
Pandemic events are more geographically widespread, requiring resources to be distributed across more locations
Unlike time-limited disasters, pandemic duration (months to years) means resources initially available may be exhausted, requiring sustainability strategies beyond typical BC resource stockpiling (Correct answer)

Correct answer: Unlike time-limited disasters, pandemic duration (months to years) means resources initially available may be exhausted, requiring sustainability strategies beyond typical BC resource stockpiling

Pandemic duration fundamentally changes resource planning—resources adequate for a 72-hour crisis may be exhausted within weeks. Pandemic plans must address sustainable resource strategies: supply chain replenishment, budget authorization for extended operations, and workforce sustainability rather than just surge capacity.

Question 23: What distinguishes a 'Business Continuity Plan (BCP)' from a 'Disaster Recovery Plan (DRP)'?

A BCP is used for large organizations; a DRP is used by smaller companies
A BCP is required by regulation; a DRP is voluntary
A BCP covers the recovery of business functions and operations; a DRP focuses specifically on the recovery of IT systems and technology infrastructure (Correct answer)
A BCP is created by business units; a DRP is created by external consultants

Correct answer: A BCP covers the recovery of business functions and operations; a DRP focuses specifically on the recovery of IT systems and technology infrastructure

A BCP addresses the continuation and recovery of business functions, processes, and operations, while a DRP specifically addresses the recovery of IT infrastructure, systems, and data. The DRP is a technical component that supports the broader BCP.

Question 24: What is the purpose of conducting a 'gap analysis' as part of the business continuity risk assessment process?

To identify gaps in employee training records for compliance purposes
To assess the physical security gaps in the organization's facilities
To compare the organization's current continuity capabilities against the requirements identified in the BIA and risk assessment (Correct answer)
To compare current revenue performance against projected financial targets

Correct answer: To compare the organization's current continuity capabilities against the requirements identified in the BIA and risk assessment

A gap analysis in business continuity compares the organization's current recovery capabilities—existing plans, systems, resources—against the requirements identified through the BIA and risk assessment, identifying where additional investment or development is needed.

Question 25: The FFIEC's 'Two-Hour Recovery Time Objective' guidance primarily applies to:

All financial institution IT systems without exception
Clearing and settlement systems critical to the financial sector's core functions (Correct answer)
Consumer-facing banking applications and websites
Internal email and collaboration systems

Correct answer: Clearing and settlement systems critical to the financial sector's core functions

The FFIEC and interagency guidance established a 2-hour RTO for critical clearing and settlement systems to prevent systemic risk to the broader financial sector in the event of a wide-scale disruption.

Question 26: Which type of BCP documentation provides the most detailed, step-by-step instructions for specific recovery tasks?

The overarching Business Continuity Plan policy document
The crisis communication plan
The Business Impact Analysis report
Operational recovery procedures and run books (Correct answer)

Correct answer: Operational recovery procedures and run books

Operational recovery procedures and run books provide the most detailed, task-level step-by-step instructions for executing specific recovery actions—they are designed for practitioners who need precise guidance during recovery.

Question 27: Which exercise type is BEST suited for testing the effectiveness of notification and communication systems?

Workshop
Tabletop exercise
Seminar
Drill (Correct answer)

Correct answer: Drill

A drill focused on notification and communication tests the actual mechanics of alerting systems, call trees, and mass notification tools in practice.

Question 28: What does the term 'recovery time objective' (RTO) refer to?

The time required for data entry.
The maximum allowable downtime before a business function is restored (Correct answer)
The time needed to train employees.
The time needed for marketing campaigns.

Correct answer: The maximum allowable downtime before a business function is restored

The Recovery Time Objective (RTO) specifies the maximum acceptable duration of time within which a business process or system must be restored after a disaster or disruption to avoid unacceptable consequences. It dictates how quickly an organization needs to recover its operations to a functional state.

Question 29: Which of the following best describes the relationship between ISO 22301 and ISO 22313?

Both standards can be used independently for third-party certification
ISO 22313 is a certification standard; ISO 22301 provides implementation guidance
ISO 22313 replaced ISO 22301 in 2019
ISO 22301 specifies BCMS requirements for certification; ISO 22313 provides implementation guidance (Correct answer)

Correct answer: ISO 22301 specifies BCMS requirements for certification; ISO 22313 provides implementation guidance

ISO 22301 is the auditable requirements standard (using 'shall') against which organizations certify, while ISO 22313 is the companion guidance document (using 'should') that explains how to implement the requirements.

Question 30: During a prolonged crisis, rumor control is best achieved by:

Issuing a single denial and moving on
Ignoring rumors to avoid amplifying them
Restricting all media access until the crisis ends
Providing frequent, factual updates through trusted channels (Correct answer)

Correct answer: Providing frequent, factual updates through trusted channels

Frequent, factual updates fill the information vacuum that rumors exploit, reducing their spread and credibility.

Question 31: In the context of emergency management, 'mutual aid agreements' are BEST described as:

Insurance policies covering emergency response costs
Federal grants for local emergency preparedness programs
Contracts between private vendors and government agencies for disaster supplies
Pre-established agreements enabling jurisdictions to request and provide resources to one another (Correct answer)

Correct answer: Pre-established agreements enabling jurisdictions to request and provide resources to one another

Mutual aid agreements are pre-negotiated arrangements that define the terms under which jurisdictions or organizations will share resources during emergencies.

Question 32: Which document is used to formally declare the end of an incident response and transition to normal operations?

The incident log close-out report
A formal incident demobilization plan or stand-down order (Correct answer)
An incident debrief agenda
A regulatory after-action report

Correct answer: A formal incident demobilization plan or stand-down order

A formal incident demobilization plan or stand-down order formally closes the incident response, transitions activities back to normal operations, releases response resources, and establishes accountability for remaining actions.

Question 33: What is the first step in creating a business continuity plan?

Identifying critical business functions (Correct answer)
Establishing recovery points.
Creating a disaster recovery plan.
Training employees.

Correct answer: Identifying critical business functions

The very first step in creating a robust business continuity plan is to conduct a Business Impact Analysis (BIA), which begins by identifying the organization's critical business functions and processes. This foundational step helps prioritize what needs to be protected and recovered first, guiding all subsequent planning efforts.

Question 34: An exercise reveals that the alternate processing site cannot handle peak transaction volumes. This finding should be classified as:

A scenario design flaw invalidating the exercise
A critical gap requiring prioritized corrective action (Correct answer)
An acceptable risk requiring only documentation
An evaluator error to be disregarded

Correct answer: A critical gap requiring prioritized corrective action

Capacity gaps at the recovery site are critical findings because they directly affect the organization's ability to meet its Recovery Time and Recovery Point Objectives.

Question 35: Which exercise category is considered the most realistic and resource-intensive testing method?

Workshop
Orientation seminar
Tabletop exercise
Full-scale exercise (Correct answer)

Correct answer: Full-scale exercise

Full-scale exercises simulate a real incident as closely as possible, mobilizing actual personnel and resources, making them the most realistic but most resource-intensive type.

Question 36: A root cause analysis of a failed recovery test reveals inadequate documentation as the underlying issue. The corrective action most likely to prevent recurrence is:

Increasing the budget for recovery hardware
Conducting more frequent recovery tests
Implementing a documentation review and update process with defined ownership (Correct answer)
Hiring additional recovery team members

Correct answer: Implementing a documentation review and update process with defined ownership

Establishing a documentation review process with clear ownership directly addresses the root cause of inadequate documentation.

Question 37: Which of the following scenarios best illustrates a 'pandemic' as a business continuity threat versus a traditional disaster?

It is predictable with weeks of advance warning
It affects the workforce across all locations simultaneously rather than a single site (Correct answer)
It only impacts technology systems
It destroys physical infrastructure like earthquakes do

Correct answer: It affects the workforce across all locations simultaneously rather than a single site

A pandemic simultaneously reduces available workforce across all geographic locations, making traditional site-based recovery strategies (hot/warm/cold sites) insufficient on their own.

Question 38: In emergency operations, what does 'unified command' mean in the Incident Command System?

A single Incident Commander with absolute authority over all aspects of the response
The integration of all communication systems into a single platform
The consolidation of all incident response functions into one team
A structure where multiple agencies or jurisdictions with authority over an incident share command responsibility through a collaborative decision-making process (Correct answer)

Correct answer: A structure where multiple agencies or jurisdictions with authority over an incident share command responsibility through a collaborative decision-making process

Unified command is an ICS structure for incidents where multiple agencies or jurisdictions have authority—they share command responsibility while maintaining their individual agency authority, enabling coordinated response without one agency subordinating to another.

Question 39: An organization issues contradictory statements through different departments during a crisis. The BEST corrective action is to:

Refer all inquiries to legal counsel only
Increase posting frequency to drown out the confusion
Activate a single, centralized communication command structure immediately (Correct answer)
Issue a retraction for all previous statements

Correct answer: Activate a single, centralized communication command structure immediately

Centralizing all crisis communications through one command structure and a single authorized spokesperson eliminates contradictions and restores message consistency.

Question 40: An 'Area Command' is established when there are:

A single, very large incident requiring additional federal support
No qualified Incident Commanders available for an incident
The incident cost exceeds a pre-determined financial threshold
Multiple incidents in close proximity that are each managed by their own Incident Commander (Correct answer)

Correct answer: Multiple incidents in close proximity that are each managed by their own Incident Commander

Area Command is activated to oversee multiple incidents occurring in the same geographic area that are each managed by separate ICS organizations.

Question 41: What is 'cyber recovery' and how does it differ from traditional disaster recovery?

Cyber recovery focuses only on network hardware, while DR covers all IT systems
Cyber recovery specifically addresses restoring systems and data after a cyberattack, including ensuring backups are not infected before restoring (Correct answer)
Cyber recovery is a marketing term with no technical distinction from DR
Cyber recovery only applies to cloud-hosted systems

Correct answer: Cyber recovery specifically addresses restoring systems and data after a cyberattack, including ensuring backups are not infected before restoring

Cyber recovery addresses the unique challenge of recovering from attacks like ransomware, requiring clean, verified backups and careful sequencing to avoid re-infecting restored systems.

Question 42: Which audit sampling method is most appropriate when an auditor wants to ensure that every item in a population has an equal chance of being selected?

Judgmental sampling
Block sampling
Random sampling (Correct answer)
Stratified sampling

Correct answer: Random sampling

Random sampling gives every item an equal probability of selection, reducing bias and supporting statistical validity.

Question 43: What role does 'situational awareness' play in emergency operations center management?

It monitors the emotional well-being of response personnel during extended operations
It provides the current, accurate, and shared understanding of incident status needed for effective coordination and decision-making (Correct answer)
It ensures all EOC staff are physically present at the operations center
It tracks the financial costs of the response in real time

Correct answer: It provides the current, accurate, and shared understanding of incident status needed for effective coordination and decision-making

Situational awareness—a current, accurate, shared understanding of the incident situation—is the foundation of effective EOC operations, enabling all decision-makers to base their actions on the same reality rather than fragmented, potentially contradictory information.

Question 44: A company activates its Crisis Management Team (CMT) during a severe weather event. The CMT's PRIMARY focus should be:

Strategic decision-making, stakeholder communication, and resource authorization (Correct answer)
Detailed technical response operations
Generating press releases for social media
Hands-on coordination with first responders on scene

Correct answer: Strategic decision-making, stakeholder communication, and resource authorization

The CMT operates at the strategic level, making high-level decisions, authorizing resources, and managing external stakeholder communications.

Question 45: An organization operating in multiple jurisdictions should maintain relationships with external agencies at which levels?

Local, state, federal, and relevant international levels as applicable (Correct answer)
Only the state level where headquarters is located
Only with agencies that have signed formal contracts
Only federal level to ensure uniform guidance

Correct answer: Local, state, federal, and relevant international levels as applicable

Multi-jurisdictional organizations must maintain relationships at local, state, federal, and international levels to ensure coordinated response wherever they operate.

Question 46: Which NIMS component establishes standardized resource management practices such as typing, credentialing, and inventorying?

Command and Coordination
Resource Management (Correct answer)
Communications and Information Management
Incident Command System

Correct answer: Resource Management

NIMS Resource Management establishes standard mechanisms to identify, acquire, allocate, and track resources during incidents.

Question 47: In the Incident Command System (ICS), what is the role of the 'Incident Commander (IC)'?

To manage financial resources and approve all expenditures during the incident
To coordinate technical recovery activities for IT systems
To have overall authority and responsibility for managing the incident response (Correct answer)
To communicate with external media and government agencies

Correct answer: To have overall authority and responsibility for managing the incident response

The Incident Commander holds overall authority and responsibility for managing the incident response, including strategic objectives, resource allocation, and approval of the Incident Action Plan—all response functions ultimately report to the IC.

Question 48: During an incident, what is the purpose of maintaining an 'incident log'?

To record financial expenditures for insurance reimbursement claims
To track employee attendance during the response
To satisfy real-time regulatory reporting requirements
To document all significant actions, decisions, communications, and resource deployments throughout the incident for accountability and after-action analysis (Correct answer)

Correct answer: To document all significant actions, decisions, communications, and resource deployments throughout the incident for accountability and after-action analysis

The incident log provides a timestamped record of all significant actions, decisions, communications, and resource deployments—it is essential for situational awareness during the incident and for post-incident analysis, legal defensibility, and insurance claims.

Question 49: The 3-2-1 backup rule specifies keeping three copies of data on two different media with:

One copy in the cloud only
One copy offsite (Correct answer)
One copy tested monthly
One copy encrypted

Correct answer: One copy offsite

The 3-2-1 rule requires three copies of data, stored on two different media types, with one copy maintained offsite to protect against localized disasters.

Question 50: In ICS, 'branches' are used within the Operations Section primarily to:

Create parallel chains of command for law enforcement vs. fire
Separate financial tracking for different agencies involved
Manage span of control when the number of divisions or groups exceeds recommended limits (Correct answer)
Document resource requests from field personnel

Correct answer: Manage span of control when the number of divisions or groups exceeds recommended limits

Branches are established to maintain manageable span of control when the number of divisions, groups, or functional units exceeds ICS guidelines.

Question 51: Which element of crisis communication addresses the psychological needs of affected individuals?

Legal disclaimers and liability wording
Technical recovery timelines
Empathy statements and acknowledgment of harm (Correct answer)
Financial impact reporting

Correct answer: Empathy statements and acknowledgment of harm

Empathy statements that acknowledge harm and express genuine concern address the emotional and psychological needs of those affected, which is a critical component of effective crisis communication.

Question 52: Which DR strategy is MOST appropriate for a non-critical system with an RTO of 72 hours and a very limited budget?

Hot site
Synchronous replication
Cold site (Correct answer)
Warm site

Correct answer: Cold site

A cold site provides basic infrastructure (power, space, connectivity) with no pre-installed equipment, making it the lowest-cost option suitable for non-critical systems with long RTOs.

Question 53: What is the 'stage 1 audit' in the ISO 22301 certification process and what does it assess?

An initial self-assessment conducted internally before engaging a certification body
A documentation review and readiness assessment conducted before the main certification audit to determine if the organization is ready to proceed to stage 2 (Correct answer)
A preliminary audit conducted by the certification body to set the certification fee
The first of multiple annual surveillance audits conducted after initial certification

Correct answer: A documentation review and readiness assessment conducted before the main certification audit to determine if the organization is ready to proceed to stage 2

The Stage 1 audit is a documentation review and readiness assessment conducted by the certification body to evaluate whether the BCMS is sufficiently developed and implemented to proceed to the Stage 2 on-site certification audit.

Question 54: Which term describes the reputational damage an organization suffers when a crisis reveals that its actual values conflict with its stated values?

Reputational spillover
Hypocrisy attribution (Correct answer)
Crisis clustering
Moral hazard

Correct answer: Hypocrisy attribution

Hypocrisy attribution occurs when stakeholders perceive a gap between an organization's espoused values and its actual behavior revealed during a crisis, amplifying reputational harm.

Question 55: A 'call tree' (phone tree) is used in BCP primarily for:

Scheduling tabletop exercises
Tracking vendor SLA compliance
Rapidly notifying personnel during an emergency activation (Correct answer)
Documenting recovery steps in sequence

Correct answer: Rapidly notifying personnel during an emergency activation

A call tree is a tiered notification structure where each contact reaches a defined set of others, ensuring rapid cascade of emergency communications.

Question 56: What is the overall structure of ISO 22301 and which management system standard framework does it follow?

A seven-part framework developed specifically for business continuity with no alignment to other ISO standards
A three-tier document aligned to the FFIEC Business Continuity Management guidance
A ten-clause document following the ISO High Level Structure (Annex SL), enabling integration with other ISO management system standards (Correct answer)
A five-section document based on the NFPA 1600 framework

Correct answer: A ten-clause document following the ISO High Level Structure (Annex SL), enabling integration with other ISO management system standards

ISO 22301 follows the ISO High Level Structure (Annex SL), a common framework shared by ISO 9001, ISO 27001, ISO 14001, and other management system standards, enabling integrated management system implementation.

Question 57: After a major emergency, a 'After-Action Report (AAR)' primarily serves to:

Notify insurers of claims arising from the incident
Establish financial liability among responding agencies
Compile a historical narrative for public records only
Document successes and areas for improvement to enhance future response capabilities (Correct answer)

Correct answer: Document successes and areas for improvement to enhance future response capabilities

An AAR captures lessons learned — what worked, what didn't, and recommended improvements — to strengthen future emergency preparedness and response.

Question 58: What is a 'warm site' in business continuity terminology?

A virtual cloud environment on standby
An empty facility leased in advance with no equipment
A site with full equipment and staff ready for immediate takeover
A site with infrastructure pre-installed but requiring some setup and data restoration before use (Correct answer)

Correct answer: A site with infrastructure pre-installed but requiring some setup and data restoration before use

A warm site has hardware and connectivity in place but requires data restoration and some configuration, typically enabling recovery within hours rather than immediately.

Question 59: What does the term 'dark site' refer to in crisis communications planning?

A social media monitoring dashboard
A classified government emergency website
An encrypted internal communications channel
A pre-built website activated only during a crisis (Correct answer)

Correct answer: A pre-built website activated only during a crisis

A dark site is a fully prepared but unpublished website that an organization activates immediately when a crisis occurs to provide timely public information.

Question 60: What is a critical aspect of disaster recovery planning?

Focusing on recovery plans for non-essential functions
Identifying potential threats to business continuity
Mapping out business operations only
Implementing continuous monitoring for vulnerabilities (Correct answer)

Correct answer: Implementing continuous monitoring for vulnerabilities

A critical aspect of disaster recovery planning is not just creating a plan, but ensuring its ongoing relevance and effectiveness. Implementing continuous monitoring for vulnerabilities allows an organization to proactively identify new threats, weaknesses in systems, and changes in the environment that could impact recovery capabilities, enabling timely updates and improvements to the DRP.

Question 61: A company's RPO is set at 4 hours. What is the MAXIMUM acceptable interval for automated data backups?

4 hours (Correct answer)
1 hour
8 hours
24 hours

Correct answer: 4 hours

The backup interval must not exceed the RPO; if RPO is 4 hours, backups must run at least every 4 hours to avoid exceeding allowable data loss.

Question 62: A company discovers that its DR backups are stored in the same building as the primary data center. What risk does this create?

The same physical disaster could destroy both production data and backups simultaneously (Correct answer)
Slower restore times
Increased licensing costs
Higher bandwidth consumption

Correct answer: The same physical disaster could destroy both production data and backups simultaneously

Co-locating backups with the primary data center means a fire, flood, or physical disaster at that location could eliminate both production data and all recovery copies.

Question 63: Why is creating a psychologically safe environment important?

It is only important in creative industries
It eliminates the need for accountability
It makes work less challenging
It encourages innovation, honest communication, and learning from mistakes (Correct answer)

Correct answer: It encourages innovation, honest communication, and learning from mistakes

Psychological safety encourages team members to share ideas, admit mistakes, and ask questions without fear of punishment, driving innovation and continuous improvement.

Question 64: The SEC's Regulation Systems Compliance and Integrity (Reg SCI) requires covered entities to:

Maintain daily offsite tape backups of all trading data
Establish, maintain, and enforce written policies for operational resilience of key market systems (Correct answer)
Achieve ISO 22301 certification within 24 months of designation
Submit quarterly BC plan updates to the SEC

Correct answer: Establish, maintain, and enforce written policies for operational resilience of key market systems

Reg SCI requires covered SCI entities (exchanges, clearinghouses, etc.) to establish and enforce written policies and procedures reasonably designed to ensure operational capacity, resilience, and security of systems critical to market operations.

Question 65: A company replicates data to an offsite facility every four hours. What does this replication interval represent?

Recovery Time Objective
Recovery Point Objective (Correct answer)
Service Delivery Objective
Maximum Tolerable Downtime

Correct answer: Recovery Point Objective

The RPO defines how much data loss is acceptable, and a four-hour replication cycle means up to four hours of data could be lost in a disaster.

Question 66: Which of the following is a key indicator that a BC training program is effective?

Senior management has approved the training curriculum
The BC plan document has been read by all employees at least once
Training sessions are completed within the budgeted time and cost
Employees can correctly describe their specific recovery roles without referencing the plan (Correct answer)

Correct answer: Employees can correctly describe their specific recovery roles without referencing the plan

An effective BC training program results in employees internalizing their roles so well that they can act correctly under pressure without needing to consult documentation during an incident.

Question 67: What is a 'tabletop exercise' primarily designed to test in a BC/DR program?

The speed of technical system recovery under real conditions
Decision-making processes and plan logic without activating physical resources (Correct answer)
Vendor response times during an actual disruption
Employee physical fitness for emergency evacuations

Correct answer: Decision-making processes and plan logic without activating physical resources

Tabletop exercises test decision-making processes, communication flows, and plan logic by walking through scenarios in a discussion format without deploying actual resources or systems.

Question 68: Which aspect of GDPR most directly creates a recovery time objective for organizations experiencing a ransomware attack that encrypts personal data?

Right to erasure (Article 17)
Data transfer restrictions (Chapter V)
Data minimization principle (Article 5)
72-hour breach notification requirement (Article 33) (Correct answer)

Correct answer: 72-hour breach notification requirement (Article 33)

The 72-hour notification window under GDPR Article 33 creates an implicit time pressure to assess, contain, and begin notifying the supervisory authority, effectively driving an operational RTO for breach response.

Question 69: Under the Stafford Act, a Presidential Disaster Declaration enables:

Automatic military deployment to affected areas
Suspension of all state and local emergency laws
Federal assistance including grants, loans, and direct support to state and local governments and individuals (Correct answer)
Transfer of all incident command authority to FEMA

Correct answer: Federal assistance including grants, loans, and direct support to state and local governments and individuals

A Presidential Disaster Declaration under the Stafford Act unlocks federal assistance including grants, loans, and direct support to affected state and local governments and individuals.

Question 70: What is the primary goal of business continuity planning?

To ensure the organization can continue operations (Correct answer)
To increase company profits.
To minimize the financial impact of disasters.
To improve the company's marketing strategy.

Correct answer: To ensure the organization can continue operations

Business continuity planning (BCP) focuses on preparing an organization to maintain essential functions during and after a disruptive event. Its primary goal is to ensure the continuous availability of critical business processes, services, and resources, minimizing downtime and impact on stakeholders.

Question 71: What is the significance of 'chain of custody' in incident response?

The sequential approval process for activating the incident response plan
The documented record tracking who had access to evidence, when, and what was done with it, preserving evidentiary integrity for legal proceedings (Correct answer)
The hierarchy of command authority during incident response
The sequence in which business functions are restored during recovery

Correct answer: The documented record tracking who had access to evidence, when, and what was done with it, preserving evidentiary integrity for legal proceedings

Chain of custody is the documented record of who collected, handled, transferred, and analyzed evidence—maintaining evidentiary integrity ensures that evidence is admissible in legal proceedings and that its integrity has not been compromised.

Question 72: What role does documentation play in Disaster Recovery Institute International professional practice?

It is optional for experienced professionals
It is an administrative burden with no practical value
It creates accountability, supports decision-making, and provides legal protection (Correct answer)
It is only needed for billing purposes

Correct answer: It creates accountability, supports decision-making, and provides legal protection

Documentation creates accountability, supports informed decision-making, and provides legal protection for both the professional and the client.

Question 73: A company decides to split operations between two active data centers so each can absorb the other's load if one fails. This strategy is called:

Active-passive clustering
Active-active configuration (Correct answer)
Geographic load balancing
Cold standby

Correct answer: Active-active configuration

An active-active configuration means both sites run production workloads simultaneously and can absorb each other's traffic if one fails, with near-zero downtime.

Question 74: An organization uses a 'lessons learned registry.' What is the primary purpose of this document?

To document employee training completions
To record vendor SLA performance
To capture and track insights from incidents and tests for future improvement (Correct answer)
To archive completed exercises for compliance filing

Correct answer: To capture and track insights from incidents and tests for future improvement

A lessons learned registry systematically captures insights and action items from exercises and incidents to drive continuous improvement.

Question 75: Which crisis communication principle states that the organization should be the first to report bad news about itself?

Inoculation theory
Transparency
Steal thunder (Correct answer)
Agenda-setting

Correct answer: Steal thunder

The 'steal thunder' principle holds that self-disclosing bad news before it leaks externally reduces negative audience reactions and preserves credibility.

Question 76: Which element of a Business Impact Analysis determines which business functions are 'mission critical'?

The age and technical complexity of the systems supporting each function
The assessment of impact over time if the function is unavailable (Correct answer)
The annual budget allocated to each department
The number of full-time employees dedicated to each function

Correct answer: The assessment of impact over time if the function is unavailable

Mission criticality is determined by assessing the magnitude and timing of impacts if a function becomes unavailable—functions whose unavailability quickly produces severe financial, operational, legal, or reputational impacts are classified as mission critical.

Question 77: When documenting recovery strategies, which of the following should be included to address staffing during a sustained disaster?

Employee cross-training and succession plans (Correct answer)
Vendor payment terms
Insurance policy numbers
Hardware replacement costs

Correct answer: Employee cross-training and succession plans

Cross-training and succession plans ensure that critical functions can be performed by backup personnel when primary staff are unavailable during extended disruptions.

Question 78: When a business continuity professional says a plan is 'compliant,' this MOST accurately means the plan:

Was written by a certified business continuity professional
Has never failed during an actual disruption
Has been approved by the board of directors
Addresses all applicable regulatory and standards requirements relevant to the organization (Correct answer)

Correct answer: Addresses all applicable regulatory and standards requirements relevant to the organization

Compliance means the plan addresses all applicable regulatory requirements, legal obligations, and relevant standards—not that it has been board-approved, never failed, or was written by a certified professional.

Question 79: What is 'program audit' in business continuity management and how does it differ from an exercise?

An audit reviews past incidents; an exercise tests future readiness
An audit is conducted by external auditors; an exercise is always internal
An audit focuses on financial controls; an exercise focuses on operational capabilities
An audit objectively evaluates whether the BCM program conforms to policy, standards, and requirements; an exercise tests whether plans work under simulated conditions (Correct answer)

Correct answer: An audit objectively evaluates whether the BCM program conforms to policy, standards, and requirements; an exercise tests whether plans work under simulated conditions

Audits evaluate program conformance to defined standards and requirements through evidence examination; exercises test operational effectiveness under simulated conditions. Both are essential; neither substitutes for the other.

Question 80: How should an organization handle a situation where an exercise reveals a critical gap that cannot be immediately remediated?

Document the gap in the exercise report, assess the risk it represents, develop an interim mitigation, assign a remediation owner, and track to resolution (Correct answer)
Accept the gap as an inherent limitation and remove the affected function from the BC plan scope
Immediately notify all stakeholders that the BC plan has a known critical deficiency
Cancel future exercises until the gap is resolved to avoid identifying additional unfixable gaps

Correct answer: Document the gap in the exercise report, assess the risk it represents, develop an interim mitigation, assign a remediation owner, and track to resolution

Gaps that cannot be immediately fixed require: documented risk assessment, interim mitigations to reduce exposure, specific ownership for remediation, and active tracking until resolved—not program stoppage, scope reduction, or premature stakeholder notification.

Question 81: What is the purpose of a 'decision log' during incident response, separate from the general incident log?

To track all purchase decisions and expenses during the response
To capture who made significant decisions, the information available at the time, the options considered, and the rationale for the chosen course of action (Correct answer)
To document all regulatory decisions required during the incident
To record all decisions made by IT staff during technical recovery activities

Correct answer: To capture who made significant decisions, the information available at the time, the options considered, and the rationale for the chosen course of action

A decision log captures the key decision points, decision-makers, available information, options considered, and rationale for each significant choice—providing a defensible record of decision-making quality and enabling honest after-action analysis.

Question 82: Which element of a recovery strategy plan specifically addresses how operations will be transitioned BACK to the primary site after a disaster?

Emergency notification roster
Damage assessment checklist
Crisis communication protocol
Reconstitution or restoration plan (Correct answer)

Correct answer: Reconstitution or restoration plan

A reconstitution or restoration plan outlines the steps, sequencing, and criteria for returning operations from the alternate site back to the restored primary site.

Question 83: The 'pilot light' cloud DR strategy differs from a warm standby primarily because:

Pilot light requires manual intervention to replicate data
Pilot light is exclusive to database recovery
Pilot light runs no infrastructure at all in the cloud
Pilot light keeps only the minimal core infrastructure running, not a scaled version of the full environment (Correct answer)

Correct answer: Pilot light keeps only the minimal core infrastructure running, not a scaled version of the full environment

A pilot light keeps just the critical core components (such as a database replica) running in the cloud, requiring additional resources to be provisioned at failover, unlike a warm standby which runs a scaled-down but complete environment.

Question 84: In business continuity, 'interdependency analysis' is conducted to:

Map how critical business processes rely on each other and on shared resources (Correct answer)
Evaluate competitor vulnerabilities
Prioritize IT patch management
Determine employee compensation during a crisis

Correct answer: Map how critical business processes rely on each other and on shared resources

Interdependency analysis identifies upstream and downstream relationships between business functions and shared infrastructure, preventing blind spots in recovery sequencing.

Question 85: ISO 22301 Clause 4 'Context of the Organization' requires organizations to do which of the following?

Document all technical recovery procedures for critical systems
Understand internal and external issues, interested parties, and determine the scope of the BCMS (Correct answer)
Establish recovery time objectives for all critical functions
Conduct an annual BIA and risk assessment

Correct answer: Understand internal and external issues, interested parties, and determine the scope of the BCMS

Clause 4 requires organizations to understand their internal and external context (issues affecting their objectives), identify interested parties and their requirements, and define the scope of the Business Continuity Management System.

Question 86: When auditing a BC program, which document best demonstrates that leadership is actively engaged and accountable for the program?

A detailed BCP with appendices
The latest business impact analysis report
A list of all staff trained in BC procedures
Signed executive sponsorship statements and steering committee minutes (Correct answer)

Correct answer: Signed executive sponsorship statements and steering committee minutes

Signed sponsorship statements and steering committee minutes provide direct evidence of leadership engagement and accountability.

Question 87: What is the purpose of a 'recovery time actual' (RTA) measurement?

To measure how long recovery actually took during a test or real event (Correct answer)
To calculate backup storage requirements
To set the target recovery window before a disaster
To estimate the financial loss per hour of downtime

Correct answer: To measure how long recovery actually took during a test or real event

RTA documents the actual time taken to recover systems during a test or real disaster, which is then compared against the RTO to identify gaps.

Question 88: Which of the following BEST describes the 'human factor' challenge in disaster recovery?

People behave unpredictably under stress, which can undermine even well-designed recovery plans (Correct answer)
Human staff cannot perform recovery tasks as quickly as automated systems
The cost of training human staff exceeds the cost of automated recovery systems
Employees typically refuse to follow BC plans during actual incidents

Correct answer: People behave unpredictably under stress, which can undermine even well-designed recovery plans

Human factors in disaster recovery acknowledge that stress, fear, and unfamiliar circumstances cause unpredictable behavior that can undermine even technically sound recovery plans.

Question 89: In database recovery, what is the purpose of transaction logs?

To record all database changes, enabling point-in-time recovery (Correct answer)
To store user authentication credentials
To optimize query performance
To archive old records automatically

Correct answer: To record all database changes, enabling point-in-time recovery

Transaction logs record every change made to a database, allowing recovery teams to replay transactions and restore the database to any specific point in time.

Question 90: Under the DRII framework, which Professional Practice covers the strategies to sustain and recover business operations?

Professional Practice 7 – Crisis Communications
Professional Practice 9 – Exercise, Audit and Maintenance
Professional Practice 5 – Developing and Implementing Business Continuity Strategies (Correct answer)
Professional Practice 3 – Business Impact Analysis

Correct answer: Professional Practice 5 – Developing and Implementing Business Continuity Strategies

DRII Professional Practice 5 focuses on identifying, evaluating, and selecting strategies — such as alternate sites, manual workarounds, or outsourcing — to sustain critical functions.

Question 91: In technology recovery, what is meant by 'system hardening' as part of DR preparation?

Installing physical security locks on servers
Reducing attack surface and vulnerabilities on recovery systems so they are secure when activated (Correct answer)
Upgrading hardware to higher-performance models
Encrypting backup tapes with physical cases

Correct answer: Reducing attack surface and vulnerabilities on recovery systems so they are secure when activated

System hardening applies security configurations to recovery systems to prevent them from being exploited when activated, since DR environments are sometimes less routinely patched.

Question 92: In the context of crisis management, what does the term 'Joint Information Center (JIC)' refer to?

The secure communication channel between the CEO and the board
A facility where response organizations coordinate public information activities (Correct answer)
A software platform for tracking crisis incidents
A committee that reviews communication plans annually

Correct answer: A facility where response organizations coordinate public information activities

A Joint Information Center (JIC) is a physical or virtual facility established during a major incident where multiple responding organizations coordinate their public communications to ensure consistent and unified messaging.

Question 93: When multiple organizations respond to the same incident, coordinating their public communications is the responsibility of the:

Joint Information Center (JIC) (Correct answer)
Senior elected official for the jurisdiction
Federal Emergency Management Agency alone
Each organization's independent PR department

Correct answer: Joint Information Center (JIC)

A Joint Information Center (JIC) provides a centralized location where PIOs from all responding organizations coordinate and release unified, consistent public information.

Question 94: Which international standard specifically addresses information security management and has direct relevance to IT disaster recovery planning?

ISO 45001
ISO 27001 (Correct answer)
ISO 9001
ISO 14001

Correct answer: ISO 27001

ISO 27001 is the international standard for information security management systems (ISMS). It includes requirements for business continuity planning specifically for information security, making it directly relevant to IT disaster recovery.

Question 95: In BCP, what is the purpose of a 'tabletop exercise'?

To physically test evacuation procedures
To validate backup generator capacity
To conduct a full failover of IT systems
To discuss and walk through scenarios in a facilitated meeting without actual execution (Correct answer)

Correct answer: To discuss and walk through scenarios in a facilitated meeting without actual execution

A tabletop exercise is a discussion-based session where team members talk through simulated scenarios to identify gaps in plans without deploying resources.

Question 96: How often should BC/DR training be provided to new employees according to DRI best practices?

Only after they have been employed for one full year
Solely when a real incident occurs and they are called to respond
Every three years as part of standard professional development
During onboarding and before they are assigned to any critical recovery role (Correct answer)

Correct answer: During onboarding and before they are assigned to any critical recovery role

DRI best practices call for BC/DR training to be integrated into employee onboarding so staff understand their responsibilities from the start, before they are needed in a recovery role.

Question 97: What is 'exercise inject' in business continuity exercises?

A regulatory document certifying that an exercise was properly conducted
A piece of information, complication, or development introduced during an exercise to add realism, test decision-making, and prevent overly linear scenarios (Correct answer)
A software tool that automatically introduces simulated failures into IT systems
The process of inserting new scenarios into an existing exercise program

Correct answer: A piece of information, complication, or development introduced during an exercise to add realism, test decision-making, and prevent overly linear scenarios

An exercise inject is a scenario development introduced during an exercise—a new piece of information, a complication, a status update, or an escalation—that challenges participants, adds realism, and tests decision-making beyond the initial scenario premise.

Question 98: How does ISO 22301 handle 'nonconformities' identified during internal audits or exercises?

Nonconformities discovered internally may be deferred until the annual management review
Organizations must react to nonconformities, investigate root causes, implement corrective actions, and verify effectiveness, retaining documented evidence of all actions (Correct answer)
ISO 22301 only requires corrective action for nonconformities discovered by external auditors
Nonconformities are reported to the certification body for external resolution

Correct answer: Organizations must react to nonconformities, investigate root causes, implement corrective actions, and verify effectiveness, retaining documented evidence of all actions

ISO 22301 Clause 10.1 requires organizations to react to nonconformities promptly, investigate root causes, implement corrective actions proportionate to the significance of the nonconformity, verify effectiveness, and retain documented evidence of the entire corrective action process.

Question 99: When coordinating with utilities (power, water, telecommunications) prior to a disaster, an organization should primarily aim to:

Negotiate lower rates for post-disaster restoration
Eliminate dependency on all external utilities
Establish priority restoration status and share critical facility information (Correct answer)
File regulatory complaints preemptively

Correct answer: Establish priority restoration status and share critical facility information

Establishing priority restoration status and sharing critical facility information with utilities ensures the organization receives faster service restoration after a disaster.

Question 100: The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities to have which business continuity element?

Board-level approval of all continuity strategies
A contingency plan that includes data backup, disaster recovery, and emergency operations (Correct answer)
Annual third-party audits of their recovery capabilities
A cybersecurity insurance policy

Correct answer: A contingency plan that includes data backup, disaster recovery, and emergency operations

HIPAA's Security Rule requires covered entities to implement a contingency plan that includes data backup procedures, disaster recovery procedures, emergency mode operation procedures, testing and revision procedures, and applications and data criticality analysis.

DRI International Qualifying Examination (CBCP/ABCP)

The DRI International Qualifying Examination assesses knowledge across 10 professional practice areas of business continuity management, serving as the prerequisite exam for CBCP and ABCP certifications. It covers the full business continuity lifecycle from risk evaluation and business impact analysis through plan development, crisis communications, and ongoing maintenance.

100

Questions

150 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds