CBCI Certification Exam — Questions and Answers

Question 1: Which U.S. Executive Order framework established the basis for critical infrastructure protection and sector-specific BC requirements across 16 sectors?

EO 12333
EO 14028
EO 13636 / PPD-21 (Correct answer)
EO 13691

Correct answer: EO 13636 / PPD-21

EO 13636 and PPD-21 (Presidential Policy Directive 21) together established the framework for critical infrastructure cybersecurity and resilience across 16 designated sectors.

Question 2: Which BCI Good Practice Guidelines term refers to the maximum time a supplier disruption can be tolerated before it significantly impacts your organization?

Critical Supplier Threshold (CST)
Recovery Time Objective (RTO)
Supplier Dependency Index (SDI)
Maximum Tolerable Period of Disruption (MTPD) (Correct answer)

Correct answer: Maximum Tolerable Period of Disruption (MTPD)

MTPD defines the outer limit of how long a disruption—including one caused by a key supplier—can last before causing unacceptable harm.

Question 3: Which U.S. law imposes BC-like continuity obligations on operators of critical energy infrastructure and grants FERC enforcement authority?

Federal Power Act / NERC CIP Standards (Correct answer)
Energy Policy Act 2005
Clean Air Act
National Energy Conservation Policy Act

Correct answer: Federal Power Act / NERC CIP Standards

NERC CIP (Critical Infrastructure Protection) Standards, enforced by FERC under the Federal Power Act, mandate reliability and continuity requirements for bulk electric system operators.

Question 4: A law firm's BC plan is invoked after a fire destroys its main office. The plan directs staff to a hot site, but the hot site has not been tested in 18 months. What is the PRIMARY risk?

The hot site may not be operationally ready or configured correctly (Correct answer)
Insurance may not cover the cost of the hot site
Staff may not know the hot site's address
Clients may learn about the disruption

Correct answer: The hot site may not be operationally ready or configured correctly

Untested hot sites may have outdated software, expired licenses, or infrastructure changes that prevent effective use during an actual event.

Question 5: A BC manager proposes embedding BC awareness into staff onboarding and annual training. Which BCI good practice does this support?

Embedding BC in organizational culture (Correct answer)
Conducting the BIA
Developing the BC strategy
Exercising and testing plans

Correct answer: Embedding BC in organizational culture

Integrating BC awareness into onboarding and regular training is a core method for embedding resilience into organizational culture.

Question 6: During a BC exercise, the team discovers their DR runbooks reference IP addresses that were changed six months ago. This finding reflects a failure in which process?

Supplier due diligence
Change management integration with BC documentation (Correct answer)
Business impact analysis review
Threat and hazard identification

Correct answer: Change management integration with BC documentation

BC documentation must be updated whenever infrastructure changes occur; the absence of this integration is a change management process gap.

Question 7: A multinational corporation operates in 12 countries. Its BC program is managed centrally with a single global plan. A regional crisis in one country reveals the plan does not account for local regulatory notification requirements. What is missing?

A larger central BC team
A global risk register
Localization of BC plans to incorporate country-specific legal and regulatory obligations (Correct answer)
More frequent global exercises

Correct answer: Localization of BC plans to incorporate country-specific legal and regulatory obligations

Global BC programs must be supplemented with locally adapted plans that address jurisdiction-specific regulatory and legal requirements.

Question 8: During a business continuity incident, a client asks for an update but the situation is still evolving with no confirmed facts. What is the best approach?

Delay all communication until full facts are known
Acknowledge the situation, share what is known, and commit to a follow-up timeline (Correct answer)
Refer the client to the media for updates
Provide speculative information to reassure the client

Correct answer: Acknowledge the situation, share what is known, and commit to a follow-up timeline

Acknowledging the situation and committing to a follow-up timeline maintains trust even when full facts are unavailable.

Question 9: The primary purpose of a BC management review conducted by senior leadership is to:

Test the technical recovery systems
Evaluate BCMS performance and make decisions on improvement (Correct answer)
Train staff on updated procedures
Conduct a detailed BIA update

Correct answer: Evaluate BCMS performance and make decisions on improvement

Management reviews assess the overall health of the BCMS and provide executive direction for strategic improvements.

Question 10: Which BCI Good Practice Guidelines (GPG) principle most directly governs how organizations communicate their BC capabilities to clients?

Business impact analysis
Supply chain continuity management
Exercising and testing
Embedding BC in organizational culture (Correct answer)

Correct answer: Embedding BC in organizational culture

Embedding BC in organizational culture includes transparent communication of BC capabilities to stakeholders and clients.

Question 11: What is 'inventory buffering' as a supply chain BC strategy?

Reducing inventory to near-zero using just-in-time production only
Outsourcing warehousing to a third-party logistics provider
Storing excess finished goods to meet seasonal demand spikes
Maintaining strategic safety stock of critical materials to sustain operations during a supplier disruption (Correct answer)

Correct answer: Maintaining strategic safety stock of critical materials to sustain operations during a supplier disruption

Safety stock provides a time buffer that allows the organization to continue operating while alternative sourcing is activated.

Question 12: What should be the first step in organizing a Business Continuity Plan (BCP)?

Designing the communication strategy
Assigning roles and responsibilities
Identifying key stakeholders
Conducting a Business Impact Analysis (Correct answer)

Correct answer: Conducting a Business Impact Analysis

The first step in organizing a Business Continuity Plan (BCP) is to conduct a Business Impact Analysis (BIA). The BIA identifies critical business functions, processes, and resources, and assesses the potential impact of their disruption. This foundational analysis provides the necessary data to prioritize recovery efforts, set realistic recovery objectives, and inform the development of effective recovery strategies.

Question 13: The term 'process capability' in BC quality management refers to:

The number of staff available to execute recovery procedures
The budget allocated to BC technology investments
The ability of a recovery process to consistently achieve its RTO and RPO targets (Correct answer)
The legal authority to invoke the BC plan

Correct answer: The ability of a recovery process to consistently achieve its RTO and RPO targets

Process capability measures whether a recovery process can reliably meet its defined objectives (RTOs/RPOs) under real conditions.

Question 14: The primary difference between a 'risk register' and a 'BIA report' is that a risk register:

Focuses on future threats, while a BIA report only analyzes past incidents
Is maintained by IT security, while a BIA report is owned by operations
Documents identified risks and their characteristics, while a BIA report quantifies disruption impacts on business activities (Correct answer)
Is a public document, while a BIA report is always confidential

Correct answer: Documents identified risks and their characteristics, while a BIA report quantifies disruption impacts on business activities

The risk register catalogs potential risks and their attributes, while the BIA focuses on the consequences of disruption on specific business activities.

Question 15: A BC professional is asked to demonstrate 'evidence of impact' in their CBCI portfolio. What does this primarily require?

Providing a CV with 10+ years of experience
Listing all BC certifications held
Showing measurable outcomes resulting from their BC work (Correct answer)
Submitting employer reference letters only

Correct answer: Showing measurable outcomes resulting from their BC work

Evidence of impact requires demonstrating measurable outcomes and tangible results achieved through the candidate's BC activities.

Question 16: In the context of BCI risk assessment, 'threat likelihood' is best described as:

The number of assets exposed to a specific threat
The probability or frequency with which a threat is expected to materialize (Correct answer)
The severity of consequences if a threat occurs
The time elapsed since the threat was last documented

Correct answer: The probability or frequency with which a threat is expected to materialize

Likelihood measures how probable or frequent a threat event is, independent of the severity of its consequences.

Question 17: How should an BCI professional present complex findings to non-experts?

Provide detailed written reports without explanation
Use full technical terminology only
Translate into accessible language, use visuals, and verify understanding (Correct answer)
Skip complex topics to avoid confusion

Correct answer: Translate into accessible language, use visuals, and verify understanding

Complex information should be translated into accessible language with visual aids, followed by checking for understanding to ensure effective communication.

Question 18: What is a key principle of advanced professional practice in Business Continuity Institute Certification practice?

Avoiding all standardized approaches
Relying solely on personal experience
Applying structured methodologies based on evidence and best practices (Correct answer)
Minimizing documentation requirements

Correct answer: Applying structured methodologies based on evidence and best practices

Advanced Professional Practice in Business Continuity Institute Certification practice requires applying structured, evidence-based methodologies while adapting to specific professional contexts.

Question 19: Which regulation requires U.S. publicly traded companies to disclose material cybersecurity incidents within four business days?

SEC Cybersecurity Disclosure Rules (2023 Form 8-K) (Correct answer)
SEC Rule 10-K Item 1C
NIST CSF 2.0
SOX Section 302

Correct answer: SEC Cybersecurity Disclosure Rules (2023 Form 8-K)

The SEC's 2023 cybersecurity disclosure rules require public companies to file a Form 8-K disclosing material cybersecurity incidents within four business days of determining materiality.

Question 20: A client relationship manager discovers that a subcontractor failure could disrupt service to a key client within 48 hours. Who should be notified first?

The subcontractor's management
Senior leadership and the BC team simultaneously (Correct answer)
The media relations team
The client, before internal teams

Correct answer: Senior leadership and the BC team simultaneously

Senior leadership and the BC team must be engaged first to assess options before external communication is made.

Question 21: Under ISO 22301, what term describes the point in time to which data must be restored following a disruption?

Minimum Business Continuity Objective (MBCO)
Maximum Tolerable Period of Disruption (MTPD)
Recovery Time Objective (RTO)
Recovery Point Objective (RPO) (Correct answer)

Correct answer: Recovery Point Objective (RPO)

RPO (Recovery Point Objective) defines how far back in time data recovery must reach, representing the maximum acceptable amount of data loss measured in time.

Question 22: What is the primary purpose of a post-incident communication debrief with a client?

To renegotiate contract terms
To document losses for insurance purposes
To assign blame for the disruption
To review how communication performed, identify gaps, and strengthen future protocols (Correct answer)

Correct answer: To review how communication performed, identify gaps, and strengthen future protocols

Post-incident debriefs identify communication gaps and drive improvements to protocols for future incidents.

Question 23: What does 'after-action review' (AAR) produce that distinguishes it from a simple incident report?

A financial summary of all costs incurred during the incident response
A public-facing report communicating what the organization did well during the crisis
A legal document assigning blame for the incident to specific individuals or departments
Structured lessons learned with specific corrective actions, owners, and timelines to improve future response (Correct answer)

Correct answer: Structured lessons learned with specific corrective actions, owners, and timelines to improve future response

An AAR goes beyond description to generate actionable improvement items — specific changes with assigned ownership and deadlines — creating a feedback loop for continuous improvement.

Question 24: According to BCI competency frameworks, which skill is classified as a 'core' competency required at ALL levels of BC practice?

Communication (Correct answer)
Crisis negotiation
Strategic planning
Supply chain auditing

Correct answer: Communication

Communication is a core competency required at every level of BC practice because effective information exchange underpins all BC activities.

Question 25: A company's BC plan references a data retention policy requiring 7-year record keeping. A new state law mandates destruction of certain PII after 3 years. How should the conflict be resolved?

Retain all data for 7 years to meet the longer obligation
Seek a regulatory waiver from the federal authority
Retain data for 5 years as a compromise
Destroy PII at 3 years and retain non-PII for 7 years (Correct answer)

Correct answer: Destroy PII at 3 years and retain non-PII for 7 years

Privacy destruction mandates are typically rights-based obligations that override general retention policies for covered data categories, so PII must be destroyed while other records follow the longer schedule.

Question 26: In ISO 22301, which clause specifically addresses the requirement for continual improvement of the BCMS?

Clause 8 – Operation
Clause 10 – Improvement (Correct answer)
Clause 6 – Planning
Clause 9 – Performance Evaluation

Correct answer: Clause 10 – Improvement

Clause 10 of ISO 22301 mandates organizations to continually improve the suitability, adequacy, and effectiveness of the BCMS.

Question 27: In crisis communications, what is the 'dark site' strategy?

Using encrypted channels to communicate with regulators during sensitive incidents
Restricting all public communications during the first 24 hours of a crisis
A pre-built, ready-to-activate website containing crisis communication content (Correct answer)
An internal-only communication portal for crisis team members

Correct answer: A pre-built, ready-to-activate website containing crisis communication content

A dark site is a pre-prepared web presence that can be rapidly activated during a crisis to provide official information, controlling the narrative from the outset.

Question 28: A financial services firm discovers its primary data center is flooded. The RTO for core banking is 4 hours. Which action should the BC team take FIRST?

Notify regulators of the incident
Invoke the IT disaster recovery plan and activate the alternate site (Correct answer)
Conduct a post-incident review
Update the business impact analysis

Correct answer: Invoke the IT disaster recovery plan and activate the alternate site

Activating the alternate site directly addresses the RTO obligation and restores critical operations within the required timeframe.

Question 29: Under the Dodd-Frank Act, which entity has authority to require systemically important financial institutions (SIFIs) to maintain recovery and resolution plans?

CFPB
SEC
OCC alone
FDIC and Federal Reserve jointly (Correct answer)

Correct answer: FDIC and Federal Reserve jointly

The FDIC and Federal Reserve jointly administer the 'living will' requirements for SIFIs under Title I of Dodd-Frank.

Question 30: In a PDCA cycle applied to BC plan testing, which phase involves comparing exercise results against pre-defined success criteria?

Check (Correct answer)
Do
Act
Plan

Correct answer: Check

The Check phase evaluates actual results against objectives set during the Plan phase.

Question 31: During a post-incident review, it is found that the BC team communicated inconsistent messages to stakeholders during the crisis. Which program element would have prevented this?

Faster IT recovery
A larger incident management team
A crisis communications plan with pre-approved messages and a single spokesperson (Correct answer)
More frequent BIA updates

Correct answer: A crisis communications plan with pre-approved messages and a single spokesperson

A crisis communications plan with designated spokespersons and pre-approved messaging ensures consistency and prevents conflicting information.

Question 32: During a major flood, an organization's primary data center is inaccessible. Staff activate the alternate site but find recovery scripts are stored only on the flooded primary site's file server. This illustrates which BC gap?

Failure to replicate recovery tools and scripts to the alternate site (Correct answer)
Inadequate physical security at the alternate site
Missing business impact analysis for the flood scenario
Insufficient staff training on recovery procedures

Correct answer: Failure to replicate recovery tools and scripts to the alternate site

Recovery scripts and tools must be available at or accessible from the alternate site; storing them only at the primary site defeats the purpose of the alternate site.

Question 33: What is 'notification fatigue' and how does it affect crisis response?

Delays in notifying regulators due to legal review processes
The tendency of crisis responders to become exhausted from receiving too many alerts, leading to critical notifications being ignored (Correct answer)
The physical exhaustion experienced by notification systems during mass communication events
The public's declining attention to crisis communications over time

Correct answer: The tendency of crisis responders to become exhausted from receiving too many alerts, leading to critical notifications being ignored

Notification fatigue occurs when excessive alerts desensitize responders, causing them to overlook or delay acting on critical warnings — a key risk in poorly configured alert systems.

Question 34: A BC manager is asked to testify about the organization's recovery capabilities during litigation. Which privilege is MOST likely to protect pre-incident exercise reports from disclosure?

Attorney-client privilege
Trade secret protection
Work product doctrine (Correct answer)
Executive privilege

Correct answer: Work product doctrine

The work product doctrine can protect documents prepared in anticipation of litigation, potentially covering BC exercise reports if produced under attorney direction.

Question 35: What is the primary output document produced by a Business Impact Analysis?

An incident response plan for immediate crisis management
A vendor management agreement with key suppliers
A risk register listing all identified threats
A BIA report detailing critical activities, impacts, and recovery objectives (Correct answer)

Correct answer: A BIA report detailing critical activities, impacts, and recovery objectives

The primary output of a BIA is a report that identifies critical activities, quantifies impacts across multiple categories, and establishes recovery objectives such as RTO and RPO.

Question 36: Which element of a research question makes it most researchable for a BC practitioner?

It avoids quantitative data entirely
It is broad enough to cover all industries
It is specific, measurable, and answerable with available evidence (Correct answer)
It supports the organization's current BC strategy

Correct answer: It is specific, measurable, and answerable with available evidence

A researchable question must be specific and scoped so that it can be answered using evidence that is feasible to collect and analyze.

Question 37: How does organizational resilience support competitive advantage in the US market?

Organizations that recover faster and maintain operations during disruptions retain customers and contracts that competitors lose during crises (Correct answer)
US stock exchanges require organizational resilience ratings as a listing prerequisite
Resilience certifications reduce corporate tax obligations under US federal law
Resilient organizations automatically receive preferential government contracts

Correct answer: Organizations that recover faster and maintain operations during disruptions retain customers and contracts that competitors lose during crises

Faster recovery and operational continuity during disruptions allow resilient organizations to capture market share from less prepared competitors.

Question 38: What does the term 'blockchain' offer as a BC tool when applied to maintaining tamper-evident audit logs?

Faster database query performance under high load
Automated failover between data centers without human intervention
An immutable, distributed ledger that makes unauthorized log alterations detectable (Correct answer)
Real-time encryption of data in transit across WAN links

Correct answer: An immutable, distributed ledger that makes unauthorized log alterations detectable

Blockchain's cryptographic chaining of records means any alteration to a historical entry breaks the chain and is immediately detectable.

Question 39: What is the required relationship between Recovery Time Objective (RTO) and Maximum Tolerable Period of Disruption (MTPD)?

RTO must be greater than MTPD
RTO must be less than or equal to MTPD (Correct answer)
RTO must equal MTPD exactly
There is no required relationship between RTO and MTPD

Correct answer: RTO must be less than or equal to MTPD

RTO must be less than or equal to MTPD, ensuring that recovery is achieved within the maximum tolerable disruption window.

Question 40: Which type of impact is NOT typically assessed in a Business Impact Analysis?

Reputational impact with customers
Employee satisfaction scores (Correct answer)
Financial impact from lost revenue
Regulatory and legal compliance impact

Correct answer: Employee satisfaction scores

BIAs typically assess financial, reputational, regulatory/legal, and operational impacts; employee satisfaction scores are not a standard BIA impact category.

Question 41: How does the BIA contribute to the development of Business Continuity Plans (BCPs)?

It provides the critical activity data and recovery objectives that BCPs are built around (Correct answer)
It creates the communication templates and scripts used in BCPs
It serves only as an appendix to BCPs with no functional planning role
It replaces the need for formal BCPs entirely

Correct answer: It provides the critical activity data and recovery objectives that BCPs are built around

BCPs are built around the critical activity data, priorities, RTOs, RPOs, and resource requirements identified and documented through the BIA process.

Question 42: A BC exercise debrief identifies that the incident management team made good tactical decisions but never updated the strategic crisis communication channel. Which BCMS component was demonstrated as weak?

Supply chain resilience
The BIA process
Recovery time objective setting
Integration between tactical incident management and strategic crisis management (Correct answer)

Correct answer: Integration between tactical incident management and strategic crisis management

Effective BCMS requires tight integration between tactical response (what to do) and strategic management (what to communicate and to whom).

Question 43: How do BCI professionals contribute to advancing their field?

By maintaining current practices without change
By competing vigorously with colleagues
By sharing knowledge, conducting research, and participating in professional discourse (Correct answer)
Individual contributions are not possible or expected

Correct answer: By sharing knowledge, conducting research, and participating in professional discourse

BCI professionals advance their field by sharing outcomes, conducting or participating in research, mentoring, and engaging in professional forums.

Question 44: Which of the following BEST describes a 'lessons learned' session in the context of BC quality improvement?

A structured review to capture what worked, what failed, and what should change (Correct answer)
A legal review to determine liability after an incident
An informal debriefing with no documented outputs
A disciplinary review of staff who failed during an incident

Correct answer: A structured review to capture what worked, what failed, and what should change

Lessons learned sessions are structured, blameless reviews designed to produce documented improvements to plans and procedures.

Question 45: How should Business Continuity Institute Certification professionals handle disagreements with stakeholders?

Address issues professionally through active listening and seeking collaborative resolution (Correct answer)
Avoid all confrontation
Immediately escalate to management
Prioritize being right over being constructive

Correct answer: Address issues professionally through active listening and seeking collaborative resolution

Professional conflict resolution in Business Continuity Institute Certification practice involves active listening, understanding perspectives, and working toward mutually acceptable solutions.

Question 46: What is the primary purpose of a Maximum Tolerable Period of Disruption (MTPD)?

To establish the timeframe for notifying regulators after an incident
To set the target for how quickly IT systems must be restored
To measure the average downtime experienced historically
To define the absolute time limit beyond which business viability is threatened (Correct answer)

Correct answer: To define the absolute time limit beyond which business viability is threatened

MTPD is the outer boundary of acceptable disruption, after which the organization may not be able to survive as a going concern.

Question 47: What is the significance of 'time-critical decision making' in crisis management?

Delegating all time-sensitive decisions to the lowest organizational level
Recognizing that delay in key early decisions can significantly worsen crisis outcomes, requiring pre-authorized decision frameworks (Correct answer)
Using automated AI systems to replace human judgment during fast-moving incidents
All decisions during a crisis must be made within one hour of the incident occurring

Correct answer: Recognizing that delay in key early decisions can significantly worsen crisis outcomes, requiring pre-authorized decision frameworks

Early decisions in a crisis disproportionately affect outcomes, so pre-authorized thresholds and trained decision-making frameworks reduce hesitation when speed matters most.

Question 48: When should a Business Continuity Manager re-evaluate the organization's critical supplier list?

Every five years as part of a long-term strategic review
After significant organizational changes, new product launches, or major supplier incidents (Correct answer)
When a supplier requests a contract renewal
Only at the end of the financial year

Correct answer: After significant organizational changes, new product launches, or major supplier incidents

The supplier landscape changes constantly, so triggers such as organizational changes or supplier incidents must prompt reassessment.

Question 49: After a BC plan walkthrough reveals that two departments have conflicting recovery priorities, the quality improvement action should be:

Ignore the conflict as it will resolve itself during an actual incident
Remove one department's priority from the plan entirely
Allow each department to maintain its own priority independently
Document the conflict and escalate to executive management for resolution before the next plan update (Correct answer)

Correct answer: Document the conflict and escalate to executive management for resolution before the next plan update

Conflicting priorities must be resolved through governance before they undermine coordinated recovery, making executive escalation and documentation the correct step.

Question 50: What is a 'workaround' in the context of business continuity and BIA?

An IT patch applied during scheduled system maintenance
A permanent solution implemented to prevent a recurring problem
A financial instrument used to hedge against business risks
A temporary measure to maintain business functions when normal resources are unavailable (Correct answer)

Correct answer: A temporary measure to maintain business functions when normal resources are unavailable

A workaround is a temporary measure used to maintain critical business functions when normal processes, systems, or resources are unavailable during a disruption.

Question 51: What is the risk of over-communicating speculative information to clients during a BC incident?

Regulatory bodies may impose fines
Clients may lose interest in updates
False expectations can be set, damaging credibility if outcomes differ (Correct answer)
Recovery teams become distracted by client calls

Correct answer: False expectations can be set, damaging credibility if outcomes differ

Speculative information that proves incorrect undermines trust and can create legal and reputational risk.

Question 52: In BCI guidance, what is 'operational resilience' in relation to crisis management?

The technical redundancy built into IT systems to prevent outages
The physical durability of facilities to withstand natural disasters
The financial reserves maintained to fund crisis response activities
The ability of an organization to absorb disruptions and continue delivering critical services to customers and stakeholders (Correct answer)

Correct answer: The ability of an organization to absorb disruptions and continue delivering critical services to customers and stakeholders

Operational resilience focuses on the organization's capacity to maintain critical service delivery through and after disruptions, emphasizing outcomes for customers and the wider system.

Question 53: A pharmaceutical company's BC plan is tested and works well for a single-site outage. However, a pandemic scenario reveals the plan cannot handle simultaneous disruption across all sites. What does this demonstrate?

The company's BC maturity is at the highest level
The pandemic was an unforeseeable event that no plan could address
Scenario scope limitations — the plan was designed for localized, not widespread disruption (Correct answer)
Tabletop exercises are insufficient for pandemic planning

Correct answer: Scenario scope limitations — the plan was designed for localized, not widespread disruption

Plans designed for localized disruptions may not scale to wide-area events, requiring separate scenario-specific strategies.

Question 54: How should BCI professionals stay current with regulatory changes?

Rely on colleagues for all regulatory information
Regulations change too infrequently to monitor
Wait until notified by regulators
Actively monitor updates through professional associations and continuing education (Correct answer)

Correct answer: Actively monitor updates through professional associations and continuing education

BCI professionals must proactively monitor regulatory changes through professional associations, government publications, and continuing education.

Question 55: An organization's BC plan includes a 'dark period' immediately after an incident. What does this mean for client communications?

Clients are redirected to a third-party call center
Social media accounts are suspended
A brief information blackout is imposed while facts are verified before any external communication (Correct answer)
All communications cease permanently

Correct answer: A brief information blackout is imposed while facts are verified before any external communication

A dark period is a brief pause to verify facts internally before issuing accurate external communications.

Question 56: In a Business Impact Analysis, what are 'dependencies'?

External regulatory requirements that must be met during recovery
Financial reserves set aside for disaster recovery funding
Alternative suppliers identified during risk assessment activities
Resources, processes, or relationships that a business function relies on to operate (Correct answer)

Correct answer: Resources, processes, or relationships that a business function relies on to operate

Dependencies are the resources, processes, people, technology, or relationships that a business function requires to perform its activities effectively.

Question 57: How should an BCI professional handle a situation outside their scope of competency?

Decline all unfamiliar work permanently
Attempt it anyway to gain experience
Ignore the situation entirely
Recognize limitations and refer to appropriate specialists (Correct answer)

Correct answer: Recognize limitations and refer to appropriate specialists

Professional responsibility requires recognizing one's limitations and referring to qualified specialists when a situation exceeds competency boundaries.

Question 58: Under the Sarbanes-Oxley Act (SOX), which section specifically requires management to assess and report on internal controls over financial reporting?

Section 802
Section 906
Section 302
Section 404 (Correct answer)

Correct answer: Section 404

SOX Section 404 mandates that management assess and report on the effectiveness of internal controls over financial reporting annually.

Question 59: How should an BCI professional respond to discovering a compliance violation?

Report promptly, investigate root cause, and implement corrective actions (Correct answer)
Blame the regulatory framework for being unclear
Wait for external auditors to identify it
Conceal it if the impact is minor

Correct answer: Report promptly, investigate root cause, and implement corrective actions

Professional responsibility requires prompt reporting, thorough investigation, and corrective action when compliance violations are discovered, regardless of severity.

Question 60: What role does documentation play in Business Continuity Institute Certification client communications?

It creates clear records of discussions, decisions, and agreements (Correct answer)
It is an unnecessary administrative burden
It should replace all verbal communication
It only matters for legal disputes

Correct answer: It creates clear records of discussions, decisions, and agreements

Documentation in client communications creates permanent records that ensure clarity, prevent misunderstandings, and provide references for future interactions.

Question 61: In a parallel test, what distinguishes it from a full interruption test?

Only documentation is reviewed
Recovery systems run simultaneously while production stays online (Correct answer)
Staff rehearse verbally without activating systems
Only IT systems are tested

Correct answer: Recovery systems run simultaneously while production stays online

A parallel test activates recovery systems alongside live production, validating recovery capability without risking the primary environment.

Question 62: Why is it necessary to have backup data and systems in a recovery plan?

To reduce system complexity
To avoid data collection
To ensure continuity of operations in case of system failure (Correct answer)
To improve employee performance

Correct answer: To ensure continuity of operations in case of system failure

Having backup data and systems is absolutely necessary in a recovery plan to safeguard against data loss and system failures caused by various incidents. These backups enable an organization to restore critical information and resume operations quickly, minimizing downtime and ensuring business continuity. Without them, a single failure could lead to catastrophic data loss and prolonged disruption.

Question 63: Which metric best measures the effectiveness of client communication during a BC incident?

Number of press releases issued
Client-reported satisfaction with communication timeliness, clarity, and accuracy post-incident (Correct answer)
Volume of calls received from clients during the incident
Number of email updates sent to clients

Correct answer: Client-reported satisfaction with communication timeliness, clarity, and accuracy post-incident

Post-incident client feedback on timeliness, clarity, and accuracy directly measures communication effectiveness.

Question 64: The BIA process typically begins with identifying:

All risks listed in the corporate risk register
The financial budget allocated for business continuity
Critical business activities and the resources required to perform them (Correct answer)
IT recovery time objectives for all applications

Correct answer: Critical business activities and the resources required to perform them

The BIA starts by identifying which activities are critical to the organization and mapping what resources they require.

Question 65: When developing a BC competency development plan for a team member, which approach best aligns with BCI guidance?

Requiring the member to self-study the GPG independently
Scheduling annual classroom training regardless of individual needs
Assigning only online courses based on gaps identified
Combining formal training, mentoring, and experiential learning aligned to identified gaps (Correct answer)

Correct answer: Combining formal training, mentoring, and experiential learning aligned to identified gaps

BCI guidance promotes a blended development approach combining formal training, mentoring, and experiential activities tailored to individual competency gaps.

Question 66: A client's supply chain disruption now threatens your organization's ability to meet its own SLAs. How should this be communicated to downstream clients?

Wait until the disruption materializes before notifying clients
Issue a general advisory without specifics to avoid alarm
Route all communication through the original client causing the disruption
Immediately notify affected downstream clients with current impact assessment and mitigation steps (Correct answer)

Correct answer: Immediately notify affected downstream clients with current impact assessment and mitigation steps

Early notification with impact assessment and mitigation steps allows downstream clients to activate their own BC plans.

Question 67: Which scenario BEST demonstrates a 'tabletop exercise' format in practice?

A full evacuation drill with emergency services participation
IT performs an actual failover to the disaster recovery environment during business hours
A facilitated discussion where participants talk through their responses to a simulated scenario without activating real resources (Correct answer)
Staff physically relocate to an alternate site and process live transactions

Correct answer: A facilitated discussion where participants talk through their responses to a simulated scenario without activating real resources

A tabletop exercise is a discussion-based method that evaluates plans and decision-making without activating real recovery resources or disrupting operations.

Question 68: In a multi-site organization, which recovery strategy MOST effectively reduces the risk of a single point of failure?

Centralizing all operations at the headquarters location
Outsourcing all recovery functions to a single third-party vendor
Maintaining one large data backup center at an undisclosed location
Cross-training staff and enabling workload transfer across geographically dispersed sites (Correct answer)

Correct answer: Cross-training staff and enabling workload transfer across geographically dispersed sites

Geographic distribution of trained staff and workload capacity eliminates single points of failure and enables mutual support during site-level disruptions.

Question 69: Which U.S. federal regulation primarily governs business continuity requirements for federally insured depository institutions?

HIPAA Security Rule
GLBA Safeguards Rule
FFIEC Business Continuity Planning Booklet (Correct answer)
NIST SP 800-34

Correct answer: FFIEC Business Continuity Planning Booklet

The FFIEC Business Continuity Planning Booklet provides supervisory guidance specifically for federally insured depository institutions' BC programs.

Question 70: The BCI Good Practice Guidelines recommend that BIA data should be validated by:

Only the BCM team to maintain confidentiality
External auditors on an annual basis only
Senior management and process owners, not just IT (Correct answer)
The board of directors exclusively

Correct answer: Senior management and process owners, not just IT

BIA outputs must be validated by process owners and senior management to ensure accuracy and business relevance.

Question 71: A client reports that during the last BC incident, they received conflicting information from two different contacts in your organization. What process improvement addresses this?

Allow each department head to communicate independently to their client counterparts
Hire more BC staff to handle client calls
Issue a public apology and move on
Restrict all client communication to a single designated spokesperson (Correct answer)

Correct answer: Restrict all client communication to a single designated spokesperson

Designating a single spokesperson eliminates conflicting messages and ensures all client communications are consistent and coordinated.

Question 72: A client operating in a regulated industry (e.g., financial services) requires BC incident notifications within 2 hours. This requirement should primarily be captured in which document?

Internal BC plan only
Service Level Agreement and Business Continuity Plan jointly (Correct answer)
The supplier's terms and conditions
The organization's HR policy

Correct answer: Service Level Agreement and Business Continuity Plan jointly

Regulatory notification timelines must be captured in the SLA to create a binding commitment and reflected in the BC plan for operational execution.

Question 73: What is the primary goal of risk assessment in business continuity management?

To assess employee performance
To reduce operational costs
To improve marketing strategies
To identify and evaluate risks to business operations (Correct answer)

Correct answer: To identify and evaluate risks to business operations

The primary goal of risk assessment in business continuity management is to systematically identify, analyze, and evaluate potential threats and vulnerabilities that could disrupt an organization's operations. This process helps understand the nature of risks, their likelihood, and their potential impact, forming the basis for developing effective mitigation and recovery strategies. It's about understanding what could go wrong and how bad it could be.

Question 74: How do BCI professionals integrate compliance into daily practice?

By hiring a separate compliance officer
By memorizing all regulations verbatim
By embedding compliance requirements into standard operating procedures (Correct answer)
Compliance is only checked during annual audits

Correct answer: By embedding compliance requirements into standard operating procedures

Integrating compliance into standard operating procedures makes it part of routine practice rather than a separate, burdensome activity.

Question 75: Which BCI Good Practice Guidelines (GPG) element directly addresses the need to identify and comply with legal and regulatory requirements?

PP6 - Maintenance and Review
PP3 - Embedding BC in the organization
PP1 - Policy and Programme Management (Correct answer)
PP5 - Exercising and Testing

Correct answer: PP1 - Policy and Programme Management

PP1 in the BCI GPG covers policy and programme management, which includes identifying applicable legal, regulatory, and other requirements.

Question 76: Which BCI Professional Practice element is most directly concerned with ensuring that BC legal and regulatory obligations are assigned to specific owners?

Understanding the Organization
BC Plan Development
Embedding BC in the Organization's Culture (Correct answer)
Establishing BC Strategy

Correct answer: Embedding BC in the Organization's Culture

Embedding BC in the organization's culture includes assigning clear ownership of compliance obligations so accountability is maintained across the enterprise.

Question 77: Why is risk assessment important in BCM?

To streamline internal communications
To monitor employee engagement
To identify risks and vulnerabilities to develop mitigation strategies (Correct answer)
To increase business revenue

Correct answer: To identify risks and vulnerabilities to develop mitigation strategies

Risk assessment is a cornerstone of BCM because it systematically identifies potential threats and vulnerabilities that could disrupt business operations. By understanding these risks, organizations can proactively develop and implement strategies to mitigate their likelihood or impact. This proactive approach helps prevent disruptions or lessen their severity, strengthening overall business resilience.

Question 78: A BC analyst uses historical hurricane frequency data from NOAA to project future disruption likelihood. This is an example of:

Anecdotal evidence
Ethnographic research
Delphi method
Quantitative secondary data analysis (Correct answer)

Correct answer: Quantitative secondary data analysis

Using existing datasets collected by another organization (NOAA) for new analysis constitutes quantitative secondary data analysis.

Question 79: During a pandemic scenario, which BCM strategy element is MOST relevant to maintaining workforce availability?

Accelerating IT system patching schedules
Geographic diversification of staff and remote working capabilities (Correct answer)
Increasing inventory of raw materials at the main production facility
Relocating the head office to a lower-risk region permanently

Correct answer: Geographic diversification of staff and remote working capabilities

Pandemic scenarios threaten staff availability across all locations simultaneously, so remote working capabilities and geographically dispersed teams are the most effective continuity strategies.

Question 80: What is the relationship between advanced professional practice and overall Business Continuity Institute Certification professional competency?

It only applies to senior practitioners
They are completely unrelated areas
It is a minor supplementary skill
It is an essential component that strengthens the overall competency framework (Correct answer)

Correct answer: It is an essential component that strengthens the overall competency framework

Advanced Professional Practice is an essential component of the BCI competency framework, strengthening overall professional capability and credibility.

Question 81: A distribution company's recovery strategy relies on its ERP system being available within 2 hours. The ERP vendor confirms they can restore service in 6 hours. What should the BC team do?

Accept the gap as an acceptable risk
Adjust the RTO to match the vendor's 6-hour capability
Replace the ERP vendor immediately
Develop a manual workaround to bridge the gap between the 2-hour RTO and 6-hour vendor recovery (Correct answer)

Correct answer: Develop a manual workaround to bridge the gap between the 2-hour RTO and 6-hour vendor recovery

When a vendor cannot meet the required RTO, a manual workaround procedure bridges the gap until full system restoration.

Question 82: In a Business Impact Analysis, what does the term 'single point of failure' refer to?

The first point at which financial losses begin
The single most likely risk in a risk register
A component whose failure causes the entire system or process to stop functioning (Correct answer)
A backup system that can only handle one type of failure

Correct answer: A component whose failure causes the entire system or process to stop functioning

A single point of failure is any non-redundant element whose failure would halt the entire dependent system or process.

Question 83: What is the correct sequence for activating client communications under BCI's GPG PP6 (Crisis Communication)?

Notify all stakeholders simultaneously without prioritization
Assess incident → notify internal BC team → notify clients per plan → notify regulators as required (Correct answer)
Notify media → notify clients → notify employees → notify regulators
Notify regulators → notify clients → notify employees → notify media

Correct answer: Assess incident → notify internal BC team → notify clients per plan → notify regulators as required

BCI GPG PP6 follows an assess-then-notify sequence, with internal BC activation preceding external client notification.

Question 84: Which BCI Professional Practice (PP) focuses specifically on embedding BC into an organization's culture?

PP1 – Policy and Programme Management
PP6 – Exercising and Testing
PP4 – Developing and Implementing a BCM Response
PP2 – Embedding Business Continuity (Correct answer)

Correct answer: PP2 – Embedding Business Continuity

PP2 – Embedding Business Continuity is dedicated to integrating BC principles into organizational culture, values, and day-to-day operations.

Question 85: The BCI defines 'professionalism' in BC as encompassing which combination of attributes?

Technical knowledge only
Certification and insurance coverage
Seniority and years of experience
Knowledge, skills, attitudes, and ethical behavior applied consistently (Correct answer)

Correct answer: Knowledge, skills, attitudes, and ethical behavior applied consistently

BCI professionalism combines knowledge, skills, appropriate attitudes, and consistent ethical behavior — not just technical ability or tenure.

Question 86: A BC professional joins a new organization and discovers the existing BC programme does not align with the BCI GPG. What is the FIRST recommended step?

Inform regulators of non-compliance
Conduct a gap analysis to compare the existing programme against GPG requirements (Correct answer)
Immediately rebuild the programme from scratch
Resign from the role to protect professional reputation

Correct answer: Conduct a gap analysis to compare the existing programme against GPG requirements

A gap analysis is the recommended first step to systematically identify where the existing programme deviates from GPG standards before recommending changes.

Question 87: What role does the BIA play in determining resource requirements for recovery?

It allocates the budget for all IT infrastructure systems
It identifies the minimum resources needed to resume critical activities within RTOs (Correct answer)
It determines staffing levels needed for normal day-to-day operations
It has no direct role in resource planning activities

Correct answer: It identifies the minimum resources needed to resume critical activities within RTOs

The BIA identifies the minimum resources — including people, technology, facilities, and data — needed to resume critical activities within their recovery time objectives.

Question 88: Why should incident response teams be trained regularly?

To ensure preparedness and effectiveness during crises (Correct answer)
To minimize media attention
To improve team morale
To reduce the cost of response

Correct answer: To ensure preparedness and effectiveness during crises

Regular training for incident response teams is vital to keep their skills sharp and ensure they are familiar with protocols and procedures. It helps them practice their roles, identify potential gaps, and build confidence, leading to a more coordinated and effective response when a real crisis occurs. This preparedness significantly reduces the impact and duration of incidents.

Question 89: What is 'decision fatigue' and why is it relevant to crisis management?

A legal concept where organizations cannot be held liable for poor decisions under crisis conditions
The process of deferring all decisions to external consultants during a crisis
The tendency of organizations to delay decisions due to incomplete information
The exhaustion of crisis responders after making too many decisions, which degrades decision quality over time (Correct answer)

Correct answer: The exhaustion of crisis responders after making too many decisions, which degrades decision quality over time

Decision fatigue occurs when the quality of decisions deteriorates after prolonged decision-making, making rotation of crisis team members and pre-authorized decision frameworks essential.

Question 90: When drafting a BC communication for a non-technical client executive, which approach is most effective?

Provide a detailed root-cause analysis as the first section
Use full technical terminology to demonstrate expertise
Lead with business impact and recovery timeline, avoiding unnecessary jargon (Correct answer)
Use acronyms common in BC practice to save space

Correct answer: Lead with business impact and recovery timeline, avoiding unnecessary jargon

Non-technical executives need business impact and recovery timelines first; technical details can follow as an appendix.

Question 91: A BC manager discovers that the organization's RTO commitments in customer contracts are shorter than the technically achievable RTO. What is the MOST appropriate immediate action?

Renegotiate contracts immediately without informing customers
Disclose the gap to legal counsel and senior management to assess contractual and regulatory risk (Correct answer)
Extend the RTO in the BCP to match contracts without testing
Issue a press release announcing the discrepancy

Correct answer: Disclose the gap to legal counsel and senior management to assess contractual and regulatory risk

An unachievable contractual RTO creates legal and regulatory exposure that must be assessed by counsel and management before any remediation steps are taken.

Question 92: Which clause in a vendor contract limits the vendor's liability for BC failures to a defined monetary cap?

Liquidated damages clause
Force majeure clause
Limitation of liability clause (Correct answer)
Indemnification clause

Correct answer: Limitation of liability clause

A limitation of liability clause caps the maximum financial exposure a vendor bears for failures, including BC-related service outages.

Question 93: What is the primary purpose of a regulatory horizon scanning process within a BC program?

To track enforcement actions against peer organizations
To monitor competitor compliance postures
To identify upcoming regulatory changes that may affect BC obligations before they take effect (Correct answer)
To schedule regulatory examinations

Correct answer: To identify upcoming regulatory changes that may affect BC obligations before they take effect

Horizon scanning proactively identifies forthcoming regulations so the BC program can adapt before compliance deadlines arrive.

Question 94: Which metric defines the maximum age of data that an organization can afford to lose in a disruption?

MTPoD
RPO (Correct answer)
MBCO
RTO

Correct answer: RPO

Recovery Point Objective (RPO) specifies the maximum tolerable data loss measured in time, directly driving backup frequency decisions.

Question 95: Following a severe winter storm, a call center cannot open. The BC plan routes calls to a vendor in another region, but the vendor's contract does not include provisions for surge capacity. What type of risk was overlooked?

Regulatory compliance risk
Supply chain dependency and third-party capacity risk (Correct answer)
Force majeure risk
Reputational risk

Correct answer: Supply chain dependency and third-party capacity risk

Failing to contractually secure surge capacity from the vendor is a third-party dependency risk that undermines the recovery strategy.

Question 96: What is the purpose of 'exercising to failure' in BC testing?

To train new staff in basic recovery procedures
To intentionally push beyond known limits to discover hidden vulnerabilities (Correct answer)
To satisfy regulatory audit requirements
To demonstrate that the plan works perfectly

Correct answer: To intentionally push beyond known limits to discover hidden vulnerabilities

Exercising to failure deliberately stresses the plan beyond normal boundaries to uncover gaps and weaknesses that routine tests would not reveal.

Question 97: The BCI Professional Standards distinguish between 'knowledge' and 'skill'. How are these two elements related in a competency context?

They are identical concepts used interchangeably in the GPG
Knowledge replaces the need for skill in BC roles
Skills are more important than knowledge for CBCI certification
Knowledge is theoretical understanding; skill is the ability to apply that knowledge in practice (Correct answer)

Correct answer: Knowledge is theoretical understanding; skill is the ability to apply that knowledge in practice

In BCI competency terms, knowledge is theoretical understanding while skill is the demonstrated ability to apply that knowledge effectively in real BC situations.

Question 98: An organization's crisis communication platform fails during an incident. Which capability should the BC plan require as a backup communication channel?

Using personal social media accounts of executives
Suspending communications until the primary platform is restored
Pre-agreed out-of-band channels such as satellite phones or dedicated mass-notification services (Correct answer)
Relying solely on corporate email until IT restores the platform

Correct answer: Pre-agreed out-of-band channels such as satellite phones or dedicated mass-notification services

Out-of-band backup channels ensure communication can continue even when primary corporate systems are unavailable during a crisis.

Question 99: How should a BC professional handle a situation where a client requests information that is restricted under a non-disclosure agreement with a third party?

Disclose the information anyway to maintain client trust
Terminate the client relationship to avoid further requests
Explain that certain information is restricted by legal obligations and offer to facilitate a direct agreement between the client and third party if appropriate (Correct answer)
Ignore the request and change the subject

Correct answer: Explain that certain information is restricted by legal obligations and offer to facilitate a direct agreement between the client and third party if appropriate

Explaining legal constraints and offering an alternative path respects confidentiality obligations while supporting the client relationship.

Question 100: Which of the following is the correct sequence for conducting a BIA according to BCI Good Practice Guidelines?

Determine RTOs/RPOs → Gather data → Scope → Analyze impacts → Report findings
Analyze impacts → Scope → Gather data → Report findings → Determine RTOs/RPOs
Scope → Gather data → Analyze impacts → Determine RTOs/RPOs → Report findings (Correct answer)
Gather data → Define scope → Report findings → Analyze impacts → Determine RTOs/RPOs

Correct answer: Scope → Gather data → Analyze impacts → Determine RTOs/RPOs → Report findings

The BIA follows a logical sequence beginning with scoping, then data collection, impact analysis, setting objectives, and reporting.

CBCI Certification Exam

The CBCI certification validates a professional's knowledge and understanding of the Business Continuity Institute's Good Practice Guidelines and the principles of business continuity management.

100

Questions

120 min

Time Limit

60%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds