BCM Incident Response and Crisis Management 3 â Questions and Answers
Question 1: Which phase of the incident response lifecycle focuses on limiting the spread and impact of an active threat?
- Preparation
- Containment (Correct answer)
- Eradication
- Recovery
Correct answer: Containment
Containment aims to stop an incident from worsening or spreading while the organization gathers information and plans further response steps.
Question 2: A BCM practitioner reviewing crisis communication plans should ensure messages follow the 'SMEAC' framework. What does the 'E' stand for?
- Escalation
- Execution (Correct answer)
- Evaluation
- Elimination
Correct answer: Execution
In SMEAC (Situation, Mission, Execution, Administration/Logistics, Command/Signal), 'Execution' describes how the mission will be carried out.
Question 3: When categorizing incidents by severity, which factor MOST directly influences the assignment of a 'critical' severity level?
- The geographic location of the incident origin
- The potential for widespread operational disruption or life-safety impact (Correct answer)
- The seniority of the first responder who identified the incident
- The time of day the incident was reported
Correct answer: The potential for widespread operational disruption or life-safety impact
Severity levels are driven by potential impactâcritical incidents threaten core operations, safety, or organizational survival, not by when or where they originate.
Question 4: What is 'mutual aid' in the context of crisis and emergency management?
- Financial assistance provided by insurers after a declared disaster
- Pre-arranged agreements between organizations to share resources during emergencies (Correct answer)
- Government grants awarded to rebuild critical infrastructure
- Internal cross-departmental budget reallocation during an incident
Correct answer: Pre-arranged agreements between organizations to share resources during emergencies
Mutual aid agreements allow organizations or jurisdictions to request and receive resourcesâpersonnel, equipment, suppliesâfrom partners during emergencies they cannot handle alone.
Question 5: Which document formally authorizes the activation of an organization's Business Continuity Plan?
- The risk register
- The crisis declaration or activation notice issued by authorized leadership (Correct answer)
- The incident log maintained by the first responder
- The insurance policy endorsement
Correct answer: The crisis declaration or activation notice issued by authorized leadership
A formal crisis or continuity declaration by designated authorityâsuch as the CEO or Crisis Management Team leaderâis required to officially activate the BCP.
Question 6: In incident response, what is 'forensic preservation' and why is it important?
- Backing up data to off-site storage for routine disaster recovery
- Securing and maintaining evidence in its original state to support investigation or legal proceedings (Correct answer)
- Archiving post-incident reports for regulatory audits
- Encrypting incident data to protect organizational confidentiality
Correct answer: Securing and maintaining evidence in its original state to support investigation or legal proceedings
Forensic preservation protects the integrity of evidence so it can be analyzed and, if needed, admitted in legal or regulatory proceedings without contamination.
Question 7: Which metric is used to measure how quickly an organization can detect and begin responding to a security incident?
- Recovery Time Objective (RTO)
- Mean Time to Detect (MTTD) (Correct answer)
- Maximum Tolerable Downtime (MTD)
- Recovery Point Objective (RPO)
Correct answer: Mean Time to Detect (MTTD)
MTTD measures the average time between the occurrence of an incident and its detection by the organization, reflecting the effectiveness of monitoring and alerting systems.
BCM Incident Response and Crisis Management 3
Which phase of the incident response lifecycle focuses on limiting the spread and impact of an active threat?