CRP Risk Assessment & Business Impact Analysis 2

Question 1

Which BIA metric measures the point in time to which data must be recovered after a disruption?

Accepted Answer

Recovery Point Objective (RPO)

Answer

RPO defines the maximum acceptable age of data that can be recovered, establishing the data backup frequency requirement.

Question 2

During a BIA workshop, a department head claims their function is 'Tier 1 critical' but cannot quantify financial impact. What should the BC analyst do?

Accepted Answer

Probe for operational dependencies and downstream impacts to substantiate the claim

Answer

A skilled BIA analyst uses dependency mapping and downstream impact analysis when direct financial figures are unavailable.

Question 3

What is the primary purpose of a risk register in a resilience program?

Accepted Answer

Centrally track identified risks, their likelihood, impact, and assigned owners

Answer

A risk register is the authoritative repository that consolidates all identified risks with their attributes and ownership.

Question 4

A company's payroll function has an MTD of 72 hours. Its RTO is set at 48 hours and WRT is 18 hours. Is this configuration valid?

Accepted Answer

Yes, because RTO + WRT (66 hours) is within the 72-hour MTD

Answer

A valid recovery configuration requires that RTO + WRT does not exceed MTD, which 48 + 18 = 66 hours satisfies.

Question 5

Which risk treatment option involves contracting a third-party vendor to manage a specific IT function, thereby shifting responsibility for uptime?

Accepted Answer

Risk transfer

Answer

Outsourcing shifts operational and contractual liability to the vendor, which is a form of risk transfer.

(CRP) Certified Resilience Professional Practice Test

(CRP) Certified Resilience Professional Practice Test

CRP Risk Assessment & Business Impact Analysis 2