CORES Incident Management & Business Continuity Planning 3

Question 1

A financial institution's BCP must give special consideration to which regulatory requirement unique to the US banking sector?

Accepted Answer

FFIEC Business Continuity Management booklet guidance

Answer

The FFIEC Business Continuity Management booklet provides prescriptive guidance on BCP expectations specifically for US financial institutions supervised by federal banking regulators.

Question 2

Which technique is used to determine which business processes are most critical and must be recovered first?

Accepted Answer

Business Impact Analysis (BIA)

Answer

A Business Impact Analysis quantifies the operational, financial, and reputational consequences of process disruption, thereby establishing recovery priorities.

Question 3

During an active incident, 'situation reports' (SITREPs) serve to:

Accepted Answer

Provide structured, time-stamped updates to stakeholders on incident status and actions taken

Answer

SITREPs deliver consistent, periodic updates that keep decision-makers informed of current status, resource needs, and next actions during an evolving incident.

Question 4

The 'Recovery Point Objective' (RPO) specifically defines:

Accepted Answer

The acceptable amount of data loss measured in time

Answer

RPO specifies the point in time to which data must be restored, effectively defining the maximum tolerable data loss window.

Question 5

An organization discovers that its BCP has never been tested. The MOST significant risk this creates is:

Accepted Answer

Unvalidated assumptions that could cause plan failure during a real incident

Answer

Untested plans contain unverified assumptions about people, systems, and processes that may not hold under real conditions, leading to failure at the worst possible time.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Incident Management & Business Continuity Planning 3