CRP Risk Assessment & Business Impact Analysis 2 — Questions and Answers
Question 1: Which BIA metric measures the point in time to which data must be recovered after a disruption?
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO) (Correct answer)
- Maximum Tolerable Downtime (MTD)
- Work Recovery Time (WRT)
Correct answer: Recovery Point Objective (RPO)
RPO defines the maximum acceptable age of data that can be recovered, establishing the data backup frequency requirement.
Question 2: During a BIA workshop, a department head claims their function is 'Tier 1 critical' but cannot quantify financial impact. What should the BC analyst do?
- Accept the Tier 1 designation based on stakeholder authority
- Probe for operational dependencies and downstream impacts to substantiate the claim (Correct answer)
- Default to Tier 2 since no financial data was provided
- Escalate to the CISO for adjudication
Correct answer: Probe for operational dependencies and downstream impacts to substantiate the claim
A skilled BIA analyst uses dependency mapping and downstream impact analysis when direct financial figures are unavailable.
Question 3: What is the primary purpose of a risk register in a resilience program?
- Document insurance claims for risk transfer
- Centrally track identified risks, their likelihood, impact, and assigned owners (Correct answer)
- Replace the Business Impact Analysis for smaller organizations
- Record historical incidents for compliance audits
Correct answer: Centrally track identified risks, their likelihood, impact, and assigned owners
A risk register is the authoritative repository that consolidates all identified risks with their attributes and ownership.
Question 4: A company's payroll function has an MTD of 72 hours. Its RTO is set at 48 hours and WRT is 18 hours. Is this configuration valid?
- No, because RTO must always equal MTD
- Yes, because RTO + WRT (66 hours) is within the 72-hour MTD (Correct answer)
- No, because WRT must be longer than RTO
- Yes, but only if the RPO is also 72 hours
Correct answer: Yes, because RTO + WRT (66 hours) is within the 72-hour MTD
A valid recovery configuration requires that RTO + WRT does not exceed MTD, which 48 + 18 = 66 hours satisfies.
Question 5: Which risk treatment option involves contracting a third-party vendor to manage a specific IT function, thereby shifting responsibility for uptime?
- Risk avoidance
- Risk reduction
- Risk transfer (Correct answer)
- Risk acceptance
Correct answer: Risk transfer
Outsourcing shifts operational and contractual liability to the vendor, which is a form of risk transfer.
Question 6: In quantitative risk analysis, which formula correctly expresses Annual Loss Expectancy (ALE)?
- ALE = Asset Value × Recovery Cost
- ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO) (Correct answer)
- ALE = Maximum Tolerable Downtime × Daily Revenue
- ALE = Threat Likelihood × Control Effectiveness
Correct answer: ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO)
ALE is calculated by multiplying SLE (the cost of a single event) by ARO (expected frequency per year).
Question 7: A BIA identifies that a regulatory reporting function must resume within 4 hours to avoid fines. This 4-hour window represents which BIA output?
- Maximum Tolerable Downtime
- Recovery Point Objective
- Recovery Time Objective (Correct answer)
- Minimum Business Continuity Objective (MBCO)
Correct answer: Recovery Time Objective
RTO is the targeted duration within which a process must be restored to avoid unacceptable consequences such as regulatory fines.
CRP Risk Assessment & Business Impact Analysis 2
Which BIA metric measures the point in time to which data must be recovered after a disruption?