CORES Incident Management & Business Continuity Planning 4 — Questions and Answers
Question 1: A company invokes its BCP but finds that the designated alternate work site lacks sufficient network bandwidth. This failure MOST likely reflects a gap in:
- The risk appetite statement
- Testing and maintenance of the BCP (Correct answer)
- The enterprise risk committee charter
- Human resources succession planning
Correct answer: Testing and maintenance of the BCP
Regular testing and maintenance would have identified the bandwidth deficiency and enabled remediation before an actual invocation was required.
Question 2: The NIST SP 800-34 framework for contingency planning recommends which sequence for plan development?
- Test → Develop → Train → Maintain
- Develop policy → BIA → identify controls → create plan → train → test → maintain (Correct answer)
- Train → BIA → Develop → Test
- Identify risks → Transfer risks → Test controls → Document
Correct answer: Develop policy → BIA → identify controls → create plan → train → test → maintain
NIST SP 800-34 prescribes a structured seven-step process beginning with policy establishment, followed by BIA, control identification, plan development, training, testing, and maintenance.
Question 3: Which of the following BEST describes a 'tabletop exercise' in the context of BCP testing?
- A full failover test at the alternate recovery site
- A discussion-based simulation where participants walk through a scenario without activating systems (Correct answer)
- A live fire drill requiring employees to physically evacuate
- An automated system test run by IT without human participation
Correct answer: A discussion-based simulation where participants walk through a scenario without activating systems
Tabletop exercises are facilitated discussions that test decision-making and plan logic without operational disruption, making them low-cost and easy to schedule.
Question 4: Under the Incident Command System (ICS), the 'Operations Section' is responsible for:
- Managing public information and media relations
- Directing all tactical activities to achieve incident objectives (Correct answer)
- Tracking incident costs and resource expenditures
- Ensuring the safety and health of all responders
Correct answer: Directing all tactical activities to achieve incident objectives
The Operations Section executes the tactical response activities as directed by the Incident Action Plan to achieve the incident's operational objectives.
Question 5: A third-party vendor that provides a critical outsourced process suffers a major outage. The FIRST action a risk manager should take is:
- Terminate the vendor contract immediately
- Activate the vendor-related contingency procedures in the BCP (Correct answer)
- File a complaint with the relevant regulator
- Issue a press release about the service disruption
Correct answer: Activate the vendor-related contingency procedures in the BCP
The BCP should include third-party dependency scenarios, and activating those pre-planned procedures is the fastest way to mitigate impact on the firm's operations.
Question 6: Which risk treatment strategy is implicitly chosen when an organization decides NOT to develop a BCP for a non-critical process?
- Risk transfer
- Risk avoidance
- Risk acceptance (Correct answer)
- Risk mitigation
Correct answer: Risk acceptance
Choosing not to invest in recovery capabilities for a non-critical process means the organization accepts the risk of that process being unavailable without a pre-planned response.
Question 7: The primary purpose of maintaining a detailed incident log throughout an event is to:
- Satisfy audit requirements only after the incident is resolved
- Provide a chronological record that supports decision-making, lessons learned, and potential legal proceedings (Correct answer)
- Replace the post-incident review report
- Limit liability by documenting only favorable actions taken
Correct answer: Provide a chronological record that supports decision-making, lessons learned, and potential legal proceedings
A contemporaneous incident log captures the timeline, decisions, and actions in real time, supporting both immediate situational awareness and subsequent review, legal, and regulatory purposes.
CORES Incident Management & Business Continuity Planning 4
A company invokes its BCP but finds that the designated alternate work site lacks sufficient network bandwidth.
This failure MOST likely reflects a gap in: