DRI International Qualifying Examination (CBCP/ABCP) — Questions and Answers

Question 1: What is the correct sequence when building an exercise program from least to most complex?

Drill → Tabletop → Functional → Full-scale (Correct answer)
Full-scale → Functional → Tabletop → Drill
Tabletop → Drill → Full-scale → Functional
Seminar → Full-scale → Tabletop → Functional

Correct answer: Drill → Tabletop → Functional → Full-scale

DRI and FEMA guidance recommends a progressive exercise program starting with drills, advancing to tabletops, then functional, and finally full-scale exercises.

Question 2: A company subject to the EU's Digital Operational Resilience Act (DORA) is classified as a financial entity. DORA's ICT-related incident reporting requirement mandates initial notification to the competent authority within:

72 hours of initial detection
4 hours of classification as a major incident (Correct answer)
24 hours of classification as a major incident
48 hours of detection regardless of classification

Correct answer: 4 hours of classification as a major incident

DORA Article 19 requires financial entities to submit an initial notification to the competent authority within 4 hours from the classification of an event as a major ICT-related incident, and no later than 24 hours from detection.

Question 3: What must be verified about a Memorandum of Understanding (MOU) or reciprocal agreement to ensure it remains viable as a recovery strategy?

That it was signed by the CEO
That it includes penalty clauses
That the partner organization still has sufficient spare capacity to host your operations (Correct answer)
That it is stored offsite

Correct answer: That the partner organization still has sufficient spare capacity to host your operations

Organizations grow and change, so a reciprocal agreement partner may no longer have adequate spare capacity, making periodic revalidation essential to ensure the strategy is still workable.

Question 4: What is the purpose of a 'decision log' during incident response, separate from the general incident log?

To document all regulatory decisions required during the incident
To record all decisions made by IT staff during technical recovery activities
To track all purchase decisions and expenses during the response
To capture who made significant decisions, the information available at the time, the options considered, and the rationale for the chosen course of action (Correct answer)

Correct answer: To capture who made significant decisions, the information available at the time, the options considered, and the rationale for the chosen course of action

A decision log captures the key decision points, decision-makers, available information, options considered, and rationale for each significant choice—providing a defensible record of decision-making quality and enabling honest after-action analysis.

Question 5: What is the purpose of conducting a 'lessons learned' review after a disaster recovery exercise?

To identify gaps and improvements so the DR plan and procedures can be updated (Correct answer)
To satisfy annual compliance audits only
To assign blame for failures
To calculate the cost of the exercise

Correct answer: To identify gaps and improvements so the DR plan and procedures can be updated

Lessons learned reviews systematically capture what worked, what failed, and what can be improved, driving continuous improvement of the DR program.

Question 6: A business continuity professional is reviewing the crisis communication plan after a major incident. Which document should be updated to reflect lessons learned?

After-Action Report (AAR) and the crisis communication plan itself (Correct answer)
Risk register only
Business Impact Analysis (BIA)
Vendor contracts and SLAs

Correct answer: After-Action Report (AAR) and the crisis communication plan itself

An After-Action Report captures what worked and what did not, and its findings should be used to directly update the crisis communication plan to close identified gaps.

Question 7: A 'tabletop exercise' differs from a 'full-scale exercise' primarily in that:

Tabletop exercises assess plans; full-scale exercises only assess personnel performance
Tabletop exercises are limited to executive participants; full-scale exercises involve all employees
Tabletop exercises are discussion-based with no actual resource activation; full-scale exercises involve actual activation of recovery capabilities and real resources (Correct answer)
Tabletop exercises are conducted by external consultants; full-scale exercises are conducted internally

Correct answer: Tabletop exercises are discussion-based with no actual resource activation; full-scale exercises involve actual activation of recovery capabilities and real resources

The fundamental distinction is resource activation: tabletop exercises are discussion-based simulations where participants talk through responses without activating actual systems or facilities; full-scale exercises involve actual activation of recovery capabilities with real resources.

Question 8: What distinguishes a 'Business Continuity Plan (BCP)' from a 'Disaster Recovery Plan (DRP)'?

A BCP covers the recovery of business functions and operations; a DRP focuses specifically on the recovery of IT systems and technology infrastructure (Correct answer)
A BCP is created by business units; a DRP is created by external consultants
A BCP is used for large organizations; a DRP is used by smaller companies
A BCP is required by regulation; a DRP is voluntary

Correct answer: A BCP covers the recovery of business functions and operations; a DRP focuses specifically on the recovery of IT systems and technology infrastructure

A BCP addresses the continuation and recovery of business functions, processes, and operations, while a DRP specifically addresses the recovery of IT infrastructure, systems, and data. The DRP is a technical component that supports the broader BCP.

Question 9: Which action should be taken when a vendor's BC plan does not meet your organization's RTOs?

Accept the risk and proceed with the vendor relationship unchanged
Require the vendor to improve their plan or identify an alternate vendor who can meet requirements (Correct answer)
Reduce your own RTO to match the vendor's capability
Remove the RTO requirement from your BC plan

Correct answer: Require the vendor to improve their plan or identify an alternate vendor who can meet requirements

If a vendor's BC plan cannot support your RTOs, you must either require improvements or identify alternate vendors whose capabilities align with your recovery time requirements.

Question 10: A BC practitioner is preparing for an ISO 22301 Stage 1 audit. The MAIN purpose of the Stage 1 audit is to:

Issue the ISO 22301 certificate upon completion
Verify that BC plan exercises have been conducted successfully
Review BCMS documentation and readiness for the Stage 2 audit (Correct answer)
Test the organization's incident response capabilities

Correct answer: Review BCMS documentation and readiness for the Stage 2 audit

The ISO 22301 Stage 1 (document review) audit assesses the organization's BCMS documentation and determines whether the organization is sufficiently prepared for the Stage 2 on-site certification audit.

Question 11: What role does network configuration documentation play in technology recovery?

It enables recovery teams to quickly re-establish network connectivity and routing at the recovery site (Correct answer)
It helps facilities staff set up physical office space
It is used to bill vendors for connectivity charges
It is used only for compliance reporting

Correct answer: It enables recovery teams to quickly re-establish network connectivity and routing at the recovery site

Accurate network configuration documentation allows recovery teams to replicate IP addressing, routing, firewall rules, and DNS settings at the recovery site without guessing.

Question 12: Which communication channel is typically MOST reliable during infrastructure-disrupting disasters when other channels fail?

Satellite phone (Correct answer)
Email
Social media platforms
Corporate intranet

Correct answer: Satellite phone

Satellite phones operate independently of terrestrial network infrastructure, making them reliable when cellular and internet systems are damaged or overloaded.

Question 13: What is the key risk of using asynchronous replication compared to synchronous replication?

Requirement for identical hardware at both sites
Potential data loss between the last sync and the failure event (Correct answer)
Higher network latency on primary transactions
Inability to replicate across geographic distances

Correct answer: Potential data loss between the last sync and the failure event

Asynchronous replication acknowledges writes on the primary before confirming them on the secondary, meaning a failure can result in loss of the data that was in-flight at the time of the outage.

Question 14: What is the primary purpose of a 'hot wash' conducted immediately after a BC exercise?

To update the BCP based on the exercise script
To clean and restore IT systems used during the drill
To capture immediate participant feedback and observations while memories are fresh (Correct answer)
To calculate the financial cost of the exercise

Correct answer: To capture immediate participant feedback and observations while memories are fresh

A hot wash immediately after an exercise captures raw participant feedback and initial observations before recall fades.

Question 15: Which framework describes crisis responses along a continuum from deny to accommodate based on the organization's responsibility level?

CERC Model
Situational Crisis Communication Theory (SCCT) (Correct answer)
Image Restoration Theory
Chaos Theory of Crisis

Correct answer: Situational Crisis Communication Theory (SCCT)

SCCT, developed by Timothy Coombs, matches crisis response strategies to the level of organizational responsibility attributed by stakeholders.

Question 16: When a business continuity plan includes coordination with the local emergency operations center (EOC), the organization should ensure that:

The EOC has complete administrative access to internal databases
Contact information and liaison roles are pre-established and regularly updated (Correct answer)
All employees are trained to report directly to the EOC during emergencies
The organization operates as a subordinate unit of the EOC during all incidents

Correct answer: Contact information and liaison roles are pre-established and regularly updated

Pre-establishing contact information and liaison roles ensures smooth coordination with the EOC during an incident when time is critical.

Question 17: What is the importance of pre-establishing 'mutual aid agreements' for emergency operations?

They establish in advance the terms under which organizations will share resources, personnel, and capabilities during incidents exceeding a single organization's capacity (Correct answer)
They fulfill insurance policy requirements for emergency management
They document the financial compensation due from an organization that causes a shared infrastructure failure
They define the regulatory reporting obligations between multiple organizations in a shared facility

Correct answer: They establish in advance the terms under which organizations will share resources, personnel, and capabilities during incidents exceeding a single organization's capacity

Mutual aid agreements pre-establish the terms, conditions, and processes for organizations to share resources, personnel, facilities, and capabilities during major incidents—ensuring that aid is available when needed without requiring negotiation during the crisis itself.

Question 18: What is the significance of professional networking in the Disaster Recovery Institute International field?

It facilitates knowledge exchange, referrals, and collaborative problem-solving (Correct answer)
It distracts from actual work
It is only useful for finding new employment
It is only important early in one's career

Correct answer: It facilitates knowledge exchange, referrals, and collaborative problem-solving

Professional networking facilitates knowledge exchange, generates referrals, and enables collaborative problem-solving that improves practice quality.

Question 19: When selecting a recovery strategy, which factor most directly constrains the range of feasible options?

Staff skill levels
Cost versus recovery time trade-off (Correct answer)
Physical distance to alternate site
Vendor availability

Correct answer: Cost versus recovery time trade-off

Cost and recovery time have an inverse relationship — faster recovery requires greater investment — making this trade-off the primary constraint on strategy selection.

Question 20: Which BCP strategy involves routing work to another location already staffed and operational?

Cold site activation
Reciprocal agreement
Hot site failover (Correct answer)
Warm site failover

Correct answer: Hot site failover

A hot site is a fully equipped, staffed alternate facility that can take over operations immediately with minimal or no switchover delay.

Question 21: During an incident, what is the purpose of maintaining an 'incident log'?

To satisfy real-time regulatory reporting requirements
To document all significant actions, decisions, communications, and resource deployments throughout the incident for accountability and after-action analysis (Correct answer)
To track employee attendance during the response
To record financial expenditures for insurance reimbursement claims

Correct answer: To document all significant actions, decisions, communications, and resource deployments throughout the incident for accountability and after-action analysis

The incident log provides a timestamped record of all significant actions, decisions, communications, and resource deployments—it is essential for situational awareness during the incident and for post-incident analysis, legal defensibility, and insurance claims.

Question 22: What is the 'Hotwash' (immediate debrief) in exercise methodology and when is it conducted?

A sanitization process for exercise equipment after a biological or chemical scenario
A technical review of IT systems performance during the exercise conducted by the IT team
A formal written report submitted within 24 hours of exercise completion
An immediate, informal debrief conducted right after an exercise ends while observations and reactions are fresh (Correct answer)

Correct answer: An immediate, informal debrief conducted right after an exercise ends while observations and reactions are fresh

A Hotwash is an immediate informal debrief conducted at the conclusion of an exercise—while observations, reactions, and experiences are fresh—to capture immediate impressions, identify key themes, and acknowledge participant contributions before participants disperse.

Question 23: The 'pilot light' cloud DR strategy differs from a warm standby primarily because:

Pilot light requires manual intervention to replicate data
Pilot light keeps only the minimal core infrastructure running, not a scaled version of the full environment (Correct answer)
Pilot light runs no infrastructure at all in the cloud
Pilot light is exclusive to database recovery

Correct answer: Pilot light keeps only the minimal core infrastructure running, not a scaled version of the full environment

A pilot light keeps just the critical core components (such as a database replica) running in the cloud, requiring additional resources to be provisioned at failover, unlike a warm standby which runs a scaled-down but complete environment.

Question 24: Which crisis communication principle states that the organization should be the first to report bad news about itself?

Transparency
Steal thunder (Correct answer)
Agenda-setting
Inoculation theory

Correct answer: Steal thunder

The 'steal thunder' principle holds that self-disclosing bad news before it leaks externally reduces negative audience reactions and preserves credibility.

Question 25: What is the 'stage 1 audit' in the ISO 22301 certification process and what does it assess?

The first of multiple annual surveillance audits conducted after initial certification
An initial self-assessment conducted internally before engaging a certification body
A preliminary audit conducted by the certification body to set the certification fee
A documentation review and readiness assessment conducted before the main certification audit to determine if the organization is ready to proceed to stage 2 (Correct answer)

Correct answer: A documentation review and readiness assessment conducted before the main certification audit to determine if the organization is ready to proceed to stage 2

The Stage 1 audit is a documentation review and readiness assessment conducted by the certification body to evaluate whether the BCMS is sufficiently developed and implemented to proceed to the Stage 2 on-site certification audit.

Question 26: Why is it important to validate recovery procedures after a significant infrastructure change?

To update the disaster recovery budget
To train new hires on the updated systems
To generate audit reports for regulators
To ensure procedures remain accurate and recovery capabilities are not degraded by the change (Correct answer)

Correct answer: To ensure procedures remain accurate and recovery capabilities are not degraded by the change

Infrastructure changes can invalidate existing recovery procedures, so re-testing after changes ensures the documented steps still work in the updated environment.

Question 27: ISO 22301:2019 replaced which predecessor standard for business continuity management systems?

NFPA 1600:2016
ISO 27001:2013
BS 25999-2 (Correct answer)
ISO 22313:2012

Correct answer: BS 25999-2

BS 25999-2 was the British Standard for BCMS that ISO 22301 replaced and internationalized when first published in 2012 and subsequently updated in 2019.

Question 28: What is 'concentration risk' in the context of supply chain continuity?

The risk of losing focus during an incident
Over-reliance on a single vendor or geographic region for critical supplies (Correct answer)
Concentrating recovery resources at one site
Having too many vendors for one product

Correct answer: Over-reliance on a single vendor or geographic region for critical supplies

Concentration risk occurs when an organization depends too heavily on a single supplier or region, creating a single point of failure that can disrupt the entire supply chain.

Question 29: Which ICS position is responsible for the overall management of an incident and has authority over all personnel?

Logistics Section Chief
Incident Commander (Correct answer)
Safety Officer
Operations Section Chief

Correct answer: Incident Commander

The Incident Commander holds overall responsibility and authority for managing all aspects of an incident.

Question 30: An organization experiences a power outage affecting its primary data center. The BC team activates the alternate site per the BCP. This activation phase is best described as:

Recovery
Prevention
Mitigation
Response (Correct answer)

Correct answer: Response

Activating alternate facilities and mobilizing the BC team in the immediate aftermath of a disruptive event falls within the response phase of the incident lifecycle.

Question 31: What is the primary distinction between a functional exercise and a full-scale exercise?

Functional exercises are unannounced; full-scale exercises are pre-scheduled
Functional exercises test a single function; full-scale tests the entire plan (Correct answer)
Full-scale exercises involve only senior leadership; functional exercises involve all staff
Functional exercises use real resources; full-scale exercises are simulated only

Correct answer: Functional exercises test a single function; full-scale tests the entire plan

A functional exercise tests specific functions or capabilities, while a full-scale exercise activates all aspects of the plan with real resource deployment.

Question 32: In IT disaster recovery, what is a 'runbook' and why is it essential?

A checklist used for routine IT maintenance tasks
A log of all system runs and batch jobs executed in the past 30 days
A document tracking which servers are running at any given time
A detailed, step-by-step technical procedure guide for executing specific IT recovery tasks (Correct answer)

Correct answer: A detailed, step-by-step technical procedure guide for executing specific IT recovery tasks

A runbook is a detailed, step-by-step technical guide documenting exactly how to execute a specific IT recovery task—server failover, database restoration, network reconfiguration—providing sufficient detail for a qualified technician to execute the procedure correctly under stress.

Question 33: Which term describes the documented set of procedures for returning a business to normal operations after recovery activities are complete?

Continuity of Operations Plan (COOP)
Business Resumption Plan (Correct answer)
Return to Operations Plan (RTOP)
Crisis Management Plan

Correct answer: Business Resumption Plan

A Business Resumption Plan outlines the steps to transition from temporary recovery mode back to normal, fully restored business operations.

Question 34: Which audit sampling method is most appropriate when an auditor wants to ensure that every item in a population has an equal chance of being selected?

Random sampling (Correct answer)
Block sampling
Stratified sampling
Judgmental sampling

Correct answer: Random sampling

Random sampling gives every item an equal probability of selection, reducing bias and supporting statistical validity.

Question 35: In database recovery, what is the purpose of transaction logs?

To record all database changes, enabling point-in-time recovery (Correct answer)
To store user authentication credentials
To archive old records automatically
To optimize query performance

Correct answer: To record all database changes, enabling point-in-time recovery

Transaction logs record every change made to a database, allowing recovery teams to replay transactions and restore the database to any specific point in time.

Question 36: The Emergency Management Assistance Compact (EMAC) is best described as:

A FEMA directive mandating state emergency plans
A mutual aid agreement among U.S. states and territories for sharing resources (Correct answer)
An international treaty for cross-border disaster assistance
A federal funding mechanism for disaster recovery

Correct answer: A mutual aid agreement among U.S. states and territories for sharing resources

EMAC is a congressionally ratified mutual aid compact that allows states and territories to share resources, personnel, and expertise during emergencies.

Question 37: What is the 'essential worker' designation and how does it affect pandemic business continuity planning?

A legal designation that exempts certain employees from pandemic health orders
An HR classification determining which employees receive pandemic-related bonuses
A government designation that only applies to public sector and healthcare workers
A planning classification identifying roles that must be physically performed on-site because they cannot be conducted remotely and are critical to operations, requiring enhanced protection measures (Correct answer)

Correct answer: A planning classification identifying roles that must be physically performed on-site because they cannot be conducted remotely and are critical to operations, requiring enhanced protection measures

Essential worker designations identify roles that must be physically present and are critical to operations—these employees cannot work remotely and require enhanced infection control protections, priority access to PPE, and specific continuity planning attention.

Question 38: Which cloud DR strategy provides the lowest cost but the longest recovery time by storing data in the cloud without pre-provisioned compute resources?

Pilot light
Multi-site active-active
Warm standby
Backup and restore (Correct answer)

Correct answer: Backup and restore

The backup and restore strategy stores data backups in the cloud but provisions no running compute, making it the cheapest option at the cost of longer recovery time when resources must be spun up.

Question 39: A CBCP (Certified Business Continuity Professional) designation requires candidates to demonstrate knowledge across how many DRII Professional Practices?

5
10 (Correct answer)
12
7

Correct answer: 10

The DRII framework comprises 10 Professional Practices that together cover the full lifecycle of a business continuity management program.

Question 40: What is 'database shadowing' in the context of IT disaster recovery?

Running concurrent transactions against both the primary and backup databases in real time to maintain synchronization (Correct answer)
Monitoring database performance to detect anomalies before they cause failures
Maintaining a compressed archive of database transaction logs offsite
Creating encrypted copies of sensitive databases for compliance purposes

Correct answer: Running concurrent transactions against both the primary and backup databases in real time to maintain synchronization

Database shadowing involves simultaneously writing transactions to both the primary database and one or more shadow copies in real time, maintaining continuously synchronized duplicates that can be activated immediately if the primary fails.

Question 41: During a multi-day emergency, operational period briefings are typically held:

Only when the Incident Commander requests them
After the incident is fully resolved
At the beginning of each operational period (Correct answer)
Once per week to conserve response energy

Correct answer: At the beginning of each operational period

Operational period briefings are conducted at the start of each operational period to communicate the IAP and coordinate activities.

Question 42: What does 'competency-based training' mean in the context of BC/DR programs?

Training focused on ensuring staff can perform specific recovery tasks correctly, not just understand concepts (Correct answer)
Training evaluated solely through written examinations
Training designed for highly skilled IT staff only
An advanced certification program for BC professionals

Correct answer: Training focused on ensuring staff can perform specific recovery tasks correctly, not just understand concepts

Competency-based BC/DR training focuses on verified ability to perform specific recovery tasks correctly, ensuring practical readiness rather than just theoretical knowledge of the plan.

Question 43: What is the most effective leadership style for managing diverse teams?

Laissez-faire leadership with no direction
Authoritarian leadership with strict control
Adaptive leadership that adjusts approach based on team needs and situations (Correct answer)
One consistent style regardless of circumstances

Correct answer: Adaptive leadership that adjusts approach based on team needs and situations

Adaptive leadership adjusts to team needs, individual capabilities, and situational demands, maximizing team performance across diverse conditions.

Question 44: Which metric is most useful for tracking whether BCP gaps identified in prior audits are being resolved?

Test scenario complexity score
Corrective action closure rate (Correct answer)
Number of new threats identified
Annual plan revision count

Correct answer: Corrective action closure rate

The corrective action closure rate directly measures whether identified gaps from prior audits are being remediated on schedule.

Question 45: What is 'geographic clustering' risk in pandemic supply chain planning?

The practice of clustering essential workers in specific geographic zones to minimize transmission risk
The risk that concentrating suppliers, logistics providers, or operations in a single geographic area creates vulnerability when that area experiences severe pandemic impact (Correct answer)
The risk that pandemic outbreak clusters in specific geographies will disrupt transportation routes
The risk associated with geographic data clustering in remote work arrangements

Correct answer: The risk that concentrating suppliers, logistics providers, or operations in a single geographic area creates vulnerability when that area experiences severe pandemic impact

Geographic clustering risk arises when suppliers, logistics nodes, or operational facilities are concentrated in a single area—creating a single point of vulnerability if pandemic conditions are particularly severe in that geography, eliminating what appears to be supply diversity.

Question 46: What is 'bridging' in spokesperson media training?

Sharing a story across multiple social media platforms simultaneously
Connecting two separate press conferences with a coordinated narrative
Acknowledging a reporter's question and transitioning to a key message (Correct answer)
Coordinating messaging between the CEO and legal counsel

Correct answer: Acknowledging a reporter's question and transitioning to a key message

Bridging is the technique of briefly acknowledging a question, then transitioning to a prepared key message using phrases like 'What's most important to know is…'

Question 47: An organization's crisis communication plan should be tested through which of the following?

Reading the plan aloud during a staff meeting
Conducting tabletop or functional exercises that simulate crisis scenarios (Correct answer)
Publishing the plan on the corporate website
Submitting it to legal review annually

Correct answer: Conducting tabletop or functional exercises that simulate crisis scenarios

Exercises—tabletop or functional—test the plan under simulated conditions, revealing gaps that a document review alone cannot expose.

Question 48: How does ISO 22301 define the relationship between recovery time objectives (RTOs) and the Business Continuity Management System?

RTOs are set by the certification body based on industry benchmarks during the certification audit
ISO 22301 mandates specific RTO thresholds for different types of organizations
ISO 22301 treats RTOs as aspirational targets rather than binding BCMS requirements
RTOs determined through BIA are requirements that drive BCMS strategy and resource decisions, and the BCMS must demonstrate through exercise that RTOs are achievable (Correct answer)

Correct answer: RTOs determined through BIA are requirements that drive BCMS strategy and resource decisions, and the BCMS must demonstrate through exercise that RTOs are achievable

In ISO 22301, RTOs are requirements derived from BIA that drive all downstream BCMS strategy and resource decisions—strategies must be designed to meet RTOs, and exercises must demonstrate that RTOs are achievable in practice.

Question 49: DRI Professional Practices recommend that business continuity plans should be exercised at minimum:

Every two years
Only after significant organizational changes
At least annually (Correct answer)
Every five years

Correct answer: At least annually

DRI Professional Practices and most industry standards require BC plans to be tested at least annually to validate their continued effectiveness.

Question 50: Which of the following human factors can MOST undermine an effective evacuation during an emergency?

Failure of automated alarm systems to activate
Insufficient number of emergency exits in the building
Lack of a designated assembly point outside the building
Herding behavior where people follow others rather than following established evacuation routes (Correct answer)

Correct answer: Herding behavior where people follow others rather than following established evacuation routes

Herding behavior, where people instinctively follow others regardless of whether they are following correct procedures, is one of the most dangerous human factors during emergency evacuations.

Question 51: What is the primary goal of business continuity planning?

To ensure the organization can continue operations (Correct answer)
To improve the company's marketing strategy.
To increase company profits.
To minimize the financial impact of disasters.

Correct answer: To ensure the organization can continue operations

Business continuity planning (BCP) focuses on preparing an organization to maintain essential functions during and after a disruptive event. Its primary goal is to ensure the continuous availability of critical business processes, services, and resources, minimizing downtime and impact on stakeholders.

Question 52: During a risk assessment, the team identifies that a critical supplier is the sole provider of a key component. This is BEST addressed through which type of risk treatment?

Risk reduction — qualify and onboard alternative suppliers to reduce dependency (Correct answer)
Risk avoidance — discontinue the product line using the component
Risk acceptance — document the risk and monitor it quarterly
Risk transfer — purchase insurance to cover supply chain losses

Correct answer: Risk reduction — qualify and onboard alternative suppliers to reduce dependency

Risk reduction through qualifying and onboarding alternative suppliers directly addresses the single-supplier vulnerability, reducing the likelihood and impact of supply chain disruption without eliminating the business activity.

Question 53: Why should technology recovery procedures be written at a level that can be executed by someone unfamiliar with the specific system?

To simplify vendor audits
To ensure recovery can proceed even if key personnel are unavailable during the disaster (Correct answer)
To comply with federal plain-language regulations
To reduce the need for technical staff

Correct answer: To ensure recovery can proceed even if key personnel are unavailable during the disaster

Disasters often occur when key staff are unavailable, so clear, detailed procedures enable other qualified personnel to execute recovery without system-specific expertise.

Question 54: An organization's exercise program consistently tests IT systems recovery but never involves business unit representatives. This gap primarily risks:

Exceeding the approved exercise budget
Validating technical recovery without confirming business processes can actually resume operations (Correct answer)
Over-testing IT systems causing unnecessary wear on equipment
Generating redundant corrective actions already captured by IT

Correct answer: Validating technical recovery without confirming business processes can actually resume operations

IT recovery without business unit participation cannot confirm that recovered systems actually support the business processes needed to meet RTOs, leaving a critical validation gap.

Question 55: A 'call tree' (phone tree) is used in BCP primarily for:

Rapidly notifying personnel during an emergency activation (Correct answer)
Documenting recovery steps in sequence
Tracking vendor SLA compliance
Scheduling tabletop exercises

Correct answer: Rapidly notifying personnel during an emergency activation

A call tree is a tiered notification structure where each contact reaches a defined set of others, ensuring rapid cascade of emergency communications.

Question 56: A company activates its Crisis Management Team (CMT) during a severe weather event. The CMT's PRIMARY focus should be:

Detailed technical response operations
Generating press releases for social media
Hands-on coordination with first responders on scene
Strategic decision-making, stakeholder communication, and resource authorization (Correct answer)

Correct answer: Strategic decision-making, stakeholder communication, and resource authorization

The CMT operates at the strategic level, making high-level decisions, authorizing resources, and managing external stakeholder communications.

Question 57: What is 'capability assessment' in business continuity program evaluation?

An assessment of individual employee capabilities and skill levels
The technical assessment of IT system recovery capabilities and performance benchmarks
A competitive analysis comparing the organization's BC capabilities against industry peers
A structured evaluation of the organization's current business continuity capabilities against defined maturity standards to identify gaps and prioritize improvements (Correct answer)

Correct answer: A structured evaluation of the organization's current business continuity capabilities against defined maturity standards to identify gaps and prioritize improvements

Capability assessment evaluates the organization's current business continuity capabilities against defined maturity standards or competency frameworks, identifying gaps between current and target states to prioritize program investments and improvements.

Question 58: Which metric would BEST measure the effectiveness of an exercise program over time?

Percentage of corrective actions closed within defined timelines (Correct answer)
Total cost of exercises relative to budget
Number of participants attending each exercise
Number of exercises conducted per year

Correct answer: Percentage of corrective actions closed within defined timelines

Tracking corrective action closure rates measures whether the exercise program is actually driving improvement rather than just generating documentation.

Question 59: An organization's BC program audit charter should define all of the following EXCEPT:

The scope and objectives of the audit function
The authority and independence of auditors
Audit reporting requirements and frequency
The specific recovery strategies to be used in a disaster (Correct answer)

Correct answer: The specific recovery strategies to be used in a disaster

Recovery strategies are defined in the BCP, not the audit charter, which governs the audit function's authority and operations.

Question 60: Which metric answers the question: 'At what point in time must systems be restored to avoid unacceptable data loss?'

Maximum Tolerable Downtime (MTD)
Recovery Point Objective (RPO) (Correct answer)
Recovery Time Objective (RTO)
Service Delivery Objective (SDO)

Correct answer: Recovery Point Objective (RPO)

RPO defines the maximum age of data that must be recovered from backup storage for normal operations to resume, essentially dictating backup frequency.

Question 61: Under ISO 22301, what is the term for systematic activities to determine whether BC activities comply with planned arrangements?

Management review
Business impact analysis
Internal audit (Correct answer)
Risk assessment

Correct answer: Internal audit

ISO 22301 defines internal audit as the systematic process of determining whether BC activities and results comply with planned arrangements.

Question 62: A recovery strategy that routes incoming customer calls to an outsourced call center during a disaster is an example of which strategy type?

Geographic dispersion
Mutual aid agreement
Data mirroring
Third-party service provider arrangement (Correct answer)

Correct answer: Third-party service provider arrangement

Contracting with an outsourced call center to handle customer contacts during a disruption is a third-party service provider strategy for maintaining customer-facing operations.

Question 63: Which DR strategy involves maintaining a fully operational duplicate of the primary site that is always running and can accept failover instantly?

Warm site
Mobile site
Cold site
Hot site (Correct answer)

Correct answer: Hot site

A hot site is a fully equipped, always-on duplicate facility that enables near-instant failover with minimal data loss.

Question 64: What is residual risk?

Risk that only affects other organizations
The original risk before any action
Risk that has been completely eliminated
The risk remaining after mitigation measures have been applied (Correct answer)

Correct answer: The risk remaining after mitigation measures have been applied

Residual risk is what remains after mitigation measures are applied, and it must be accepted, further reduced, or transferred based on organizational risk tolerance.

Question 65: What is the concept of 'progressive exercise complexity' in a multi-year test program?

Systematically advancing from simpler exercise types to more complex and realistic ones over time (Correct answer)
Increasing the number of participants in each successive exercise
Extending the duration of exercises by one hour per year
Adding more geographically distributed sites to each exercise cycle

Correct answer: Systematically advancing from simpler exercise types to more complex and realistic ones over time

Progressive complexity builds organizational exercise competency by starting with orientations and tabletops and advancing toward functional and full-scale exercises as maturity increases.

Question 66: Which document serves as the primary legal authority establishing state emergency management powers and the Governor's emergency authority?

National Incident Management System (NIMS)
State Emergency Operations Plan (EOP)
State Emergency Management Act (or equivalent statute) (Correct answer)
National Response Framework (NRF)

Correct answer: State Emergency Management Act (or equivalent statute)

State Emergency Management Acts establish the legal framework for state emergency management, including the Governor's authority to declare emergencies and deploy resources.

Question 67: A BC program continuous improvement review identifies that plan maintenance tasks are consistently completed late. Applying a process improvement lens, the first step should be to:

Outsource plan maintenance to a third party
Map the current plan maintenance process to identify where delays originate (Correct answer)
Assign penalties for late submissions
Shorten the maintenance review window

Correct answer: Map the current plan maintenance process to identify where delays originate

Process mapping identifies where bottlenecks or inefficiencies occur before any solution is applied.

Question 68: What is the role of the 'Business Continuity Steering Committee' in a mature BCM program?

To execute recovery procedures during actual incidents
To provide executive sponsorship, strategic direction, and resource allocation decisions for the BCM program (Correct answer)
To conduct technical testing of IT disaster recovery capabilities
To manage relationships with all external vendors and service providers

Correct answer: To provide executive sponsorship, strategic direction, and resource allocation decisions for the BCM program

A Business Continuity Steering Committee provides executive-level governance: strategic direction, organizational commitment, resource allocation, and accountability for the BCM program—it governs the program, not operationally executes it.

Question 69: Which NIMS component establishes standardized resource management practices such as typing, credentialing, and inventorying?

Communications and Information Management
Command and Coordination
Resource Management (Correct answer)
Incident Command System

Correct answer: Resource Management

NIMS Resource Management establishes standard mechanisms to identify, acquire, allocate, and track resources during incidents.

Question 70: Which cloud deployment model is most commonly used to provide rapid scalability during a disaster recovery activation?

Public cloud (IaaS) (Correct answer)
Legacy mainframe hosting
On-premises virtualization
Private cloud only

Correct answer: Public cloud (IaaS)

Public cloud IaaS allows organizations to rapidly provision compute and storage resources on demand during DR activation without capital investment in standby hardware.

Question 71: Under NIMS, which term describes a standardized, on-scene, all-hazards incident management concept?

Incident Command System (ICS) (Correct answer)
Comprehensive Emergency Management (CEM)
Emergency Support Function (ESF)
National Response Framework (NRF)

Correct answer: Incident Command System (ICS)

ICS is the standardized on-scene incident management system that is a core component of NIMS and applicable to all hazards.

Question 72: What is 'exercise scenario development' and why must scenarios be carefully constructed?

The documentation of actual historical incidents that should be simulated in exercises
The process of selecting which regulatory scenarios are required for compliance exercises
The approval process for exercise scenarios by the organization's legal counsel
The design of realistic, plausible incident scenarios that achieve defined exercise objectives, challenge participants appropriately, and avoid compromising production systems (Correct answer)

Correct answer: The design of realistic, plausible incident scenarios that achieve defined exercise objectives, challenge participants appropriately, and avoid compromising production systems

Exercise scenario development creates realistic, plausible scenarios that are carefully calibrated to achieve defined learning objectives, challenge participants at the appropriate level, and avoid scenarios so extreme they are not credible or so specific they create legal exposure.

Question 73: Why is creating a psychologically safe environment important?

It is only important in creative industries
It eliminates the need for accountability
It encourages innovation, honest communication, and learning from mistakes (Correct answer)
It makes work less challenging

Correct answer: It encourages innovation, honest communication, and learning from mistakes

Psychological safety encourages team members to share ideas, admit mistakes, and ask questions without fear of punishment, driving innovation and continuous improvement.

Question 74: How should Disaster Recovery Institute International professionals approach quality improvement?

By copying what competitors do
By waiting for client complaints
Through systematic evaluation of outcomes and implementation of evidence-based changes (Correct answer)
Quality improvement is the responsibility of management only

Correct answer: Through systematic evaluation of outcomes and implementation of evidence-based changes

Systematic evaluation of outcomes with evidence-based improvements ensures continuous quality enhancement and demonstrates professional commitment to excellence.

Question 75: Which principle ensures that the person who identifies a corrective action is not solely responsible for verifying its closure?

Management by exception
Peer review policy
Segregation of duties (Correct answer)
Single point of accountability

Correct answer: Segregation of duties

Segregation of duties ensures that the identification and verification of corrective actions are performed by different individuals to maintain objectivity.

Question 76: The Sarbanes-Oxley Act (SOX) Section 404 is primarily relevant to business continuity because it requires:

Management assessment of internal controls over financial reporting, including controls supporting system availability (Correct answer)
Annual penetration testing of financial systems
Segregation of duties for all financial transactions above $10,000
Mandatory cyber incident reporting to the SEC within 72 hours

Correct answer: Management assessment of internal controls over financial reporting, including controls supporting system availability

SOX Section 404 requires management to assess and report on internal controls over financial reporting, which includes IT general controls such as system availability, backup, and recovery—core business continuity elements.

Question 77: Which of the following BEST describes the role of an Emergency Support Function (ESF) in the National Response Framework?

A grouping of government capabilities organized by functional area for response (Correct answer)
A legal framework defining state emergency authority
A training curriculum for emergency managers
A funding mechanism for FEMA disaster declarations

Correct answer: A grouping of government capabilities organized by functional area for response

ESFs are organizational constructs in the NRF that group government response capabilities into functional areas such as transportation, communications, and mass care.

Question 78: When activating an Emergency Operations Center, the FIRST action that should be taken is:

Contacting external vendors for supply support
Notifying all media outlets of the activation
Notifying personnel per the activation roster and establishing communications (Correct answer)
Updating the organization's website with emergency information

Correct answer: Notifying personnel per the activation roster and establishing communications

The first step in EOC activation is notifying required personnel and establishing communications to begin coordinated response operations.

Question 79: In a disaster recovery scenario, 'parallel testing' means:

Testing multiple vendors simultaneously
Conducting tabletop exercises without using real systems
Running backups in parallel with live systems
Testing the DR plan while the primary system remains operational (Correct answer)

Correct answer: Testing the DR plan while the primary system remains operational

Parallel testing activates recovery systems alongside the primary system to validate DR capability without disrupting live production operations.

Question 80: What is 'muscle memory' in the context of BC/DR training?

Physical fitness training for emergency responders
The ability to perform critical recovery procedures automatically through repeated practice, reducing errors under stress (Correct answer)
The documentation of frequently repeated manual recovery steps
Automated scripts that execute recovery procedures without human input

Correct answer: The ability to perform critical recovery procedures automatically through repeated practice, reducing errors under stress

In BC/DR training, 'muscle memory' refers to the ability to perform critical procedures automatically through repeated practice, reducing the cognitive load and error rate when stress is high during an actual incident.

Question 81: Which of the following BEST describes a 'fourth-party risk'?

Risk posed by your vendor's vendors who also support your operations (Correct answer)
Risk from the fourth tier of your organization's hierarchy
Risk from vendors in four different geographic locations
Risk from four separate vendor failures occurring simultaneously

Correct answer: Risk posed by your vendor's vendors who also support your operations

Fourth-party risk refers to the risk introduced by the subcontractors and suppliers that your own vendors rely upon, creating an extended chain of dependency.

Question 82: What is 'failback' in a disaster recovery context?

Activating the secondary site when the primary fails
Reverting to a previous backup version
Moving operations from the DR site back to the restored primary site (Correct answer)
Failing to meet the RTO during a test

Correct answer: Moving operations from the DR site back to the restored primary site

Failback is the process of returning operations from the DR/secondary site to the original primary site once it has been repaired and validated after a disaster.

Question 83: Which international standard specifically addresses supply chain continuity and provides requirements for business continuity within the context of supply chain resilience?

ISO 27001
ISO 31000
ISO 28000 (Correct answer)
ISO 9001

Correct answer: ISO 28000

ISO 28000 specifies requirements for a security management system for the supply chain, including business continuity elements relevant to supply chain disruptions.

Question 84: In continuous improvement methodology, 'benchmarking' a BC program involves:

Documenting the minimum acceptable BCP document length
Setting internal performance targets for recovery teams
Measuring server benchmark speeds at the recovery site
Comparing the program's practices and metrics against industry peers or standards (Correct answer)

Correct answer: Comparing the program's practices and metrics against industry peers or standards

Benchmarking compares an organization's BC program practices and performance against external peers or recognized standards.

Question 85: The NIST Cybersecurity Framework (CSF) function 'Recover' directly supports business continuity by focusing on:

Detecting anomalous activity through monitoring
Identifying organizational cybersecurity risk through asset management
Preventing cyberattacks through access controls and encryption
Developing and implementing restoration activities after a cybersecurity incident (Correct answer)

Correct answer: Developing and implementing restoration activities after a cybersecurity incident

The NIST CSF 'Recover' function focuses on developing and implementing appropriate activities to maintain plans for resilience and restore capabilities or services impaired by a cybersecurity incident—directly supporting business continuity objectives.

Question 86: How does pandemic planning interact with an organization's essential business functions determination?

Pandemic planning requires a separate BIA that is different from the standard business continuity BIA
Essential function determination during pandemics is determined exclusively by government mandate
Pandemic planning overrides the standard BIA prioritization during declared health emergencies
The standard BIA's identification of critical functions drives pandemic prioritization, but pandemic plans add workforce absenteeism as a variable determining which functions can actually be maintained (Correct answer)

Correct answer: The standard BIA's identification of critical functions drives pandemic prioritization, but pandemic plans add workforce absenteeism as a variable determining which functions can actually be maintained

The standard BIA identifies which functions are critical—pandemic planning adds the workforce dimension: which critical functions can actually be maintained given potential peak absenteeism rates, and how must staffing and procedures be adapted to protect those functions.

Question 87: A BCP testing program should include which types of exercises in a progressive sequence?

Audits, inspections, and regulatory reviews
Internal reviews, external reviews, and certification assessments
Tabletop exercises, functional exercises, and full-scale simulations (Correct answer)
Desktop analysis, gap analysis, and maturity assessments

Correct answer: Tabletop exercises, functional exercises, and full-scale simulations

A progressive exercise program moves from low-cost, low-disruption tabletop exercises (discussion-based) through functional exercises (testing specific components) to full-scale simulations (activating actual recovery capabilities), with complexity and realism increasing at each level.

Question 88: What is 'surge capacity' planning in the context of health emergency business continuity?

The pre-planned ability to rapidly scale up operations, staffing, or services in response to sudden demand increases during a health emergency (Correct answer)
The maximum capacity of the organization's healthcare benefits to cover employee medical expenses
The reserve financial funds maintained for unexpected health emergency costs
The process of hiring temporary workers to replace absent employees during a pandemic

Correct answer: The pre-planned ability to rapidly scale up operations, staffing, or services in response to sudden demand increases during a health emergency

Surge capacity planning addresses the organization's ability to rapidly scale up specific capabilities—particularly critical services, essential personnel pools, and supply reserves—to meet sudden demand increases or compensate for resource losses during a health emergency.

Question 89: How does maintaining proper credentials demonstrate regulatory compliance?

It only matters during audits
It is only needed for job applications
It proves the practitioner has met all requirements for legal practice (Correct answer)
It has no relation to compliance

Correct answer: It proves the practitioner has met all requirements for legal practice

Current credentials demonstrate that a practitioner has met educational, examination, and continuing education requirements mandated by regulatory bodies for legal practice.

Question 90: What is the primary goal of a 'post-exercise report' following a BCP drill?

To document findings, gaps, and corrective actions to improve the plan (Correct answer)
To calculate the financial cost of the exercise
To grade individual employee performance
To satisfy regulatory requirements only

Correct answer: To document findings, gaps, and corrective actions to improve the plan

The post-exercise report captures observations, identifies weaknesses in the plan or execution, and drives an action plan to close gaps before a real event.

Question 91: Which factor is most important when determining treatment frequency?

Evidence-based clinical guidelines and patient response (Correct answer)
Practitioner schedule availability
Insurance coverage limits
Patient preference alone

Correct answer: Evidence-based clinical guidelines and patient response

Treatment frequency should be based on evidence-based clinical guidelines and individual patient response to ensure optimal outcomes.

Question 92: In incident response, what is 'triage' and why is it the first analytical step?

The initial assessment to determine incident severity, scope, and required response level, enabling appropriate resource allocation (Correct answer)
The technical investigation to identify the root cause of the incident
The process of documenting all financial impacts of the incident
The notification process for informing all stakeholders about the incident

Correct answer: The initial assessment to determine incident severity, scope, and required response level, enabling appropriate resource allocation

Triage is the initial assessment of an incident's severity, scope, and impact to determine the appropriate response level and resource allocation—ensuring that limited response resources are deployed proportionately to the actual incident severity.

Question 93: A Joint Information Center (JIC) is established during a major incident primarily to:

Serve as the primary EOC for the jurisdiction
Manage all incoming mutual aid requests
Provide a central location for coordinating public information and media relations (Correct answer)
Coordinate financial reimbursement between responding agencies

Correct answer: Provide a central location for coordinating public information and media relations

A JIC is established to coordinate the public information function across multiple agencies, ensuring consistent and accurate messaging.

Question 94: What is the value of including 'lessons learned' sessions as part of every BC exercise?

To create evidence of compliance for regulatory auditors
To identify gaps between planned and actual performance and drive continuous improvement of the BC program (Correct answer)
To document which employees performed poorly so they can be retrained
To determine whether the exercise met its budget and schedule goals

Correct answer: To identify gaps between planned and actual performance and drive continuous improvement of the BC program

Lessons learned sessions after each exercise capture what worked, what didn't, and why, providing the actionable insights needed to continuously improve the BC program.

Question 95: During a BC program audit, an auditor discovers that a critical vendor's recovery capability has never been verified. This is best categorized as:

A documentation gap only
A minor observation
A material finding requiring corrective action (Correct answer)
An acceptable risk acceptance

Correct answer: A material finding requiring corrective action

An unverified critical vendor recovery capability represents a material gap that requires a formal corrective action plan.

Question 96: Which U.S. federal law requires continuity planning for critical infrastructure sectors and designates sector-specific agencies to coordinate resilience efforts?

The Computer Fraud and Abuse Act
The Stafford Act
The Federal Information Security Modernization Act (FISMA)
Presidential Policy Directive 21 (PPD-21) (Correct answer)

Correct answer: Presidential Policy Directive 21 (PPD-21)

PPD-21 establishes national policy on critical infrastructure security and resilience, designates 16 critical infrastructure sectors, and assigns sector-specific agencies responsible for coordinating protective efforts.

Question 97: A company's social media manager begins posting updates during a crisis without authorization from the crisis team. This MOST directly threatens:

Legal discovery processes
Regulatory compliance
Message consistency and organizational credibility (Correct answer)
IT security protocols

Correct answer: Message consistency and organizational credibility

Unauthorized social media posts can contradict official statements, creating inconsistent messaging that undermines organizational credibility during a crisis.

Question 98: Which phase of incident response focuses on returning business operations to normal while preserving evidence for investigation?

Post-incident analysis phase
Recovery phase (Correct answer)
Eradication phase
Containment phase

Correct answer: Recovery phase

The Recovery phase focuses on restoring systems and operations to normal while maintaining the careful balance between operational restoration and evidence preservation for ongoing investigation—security forensics may require maintaining certain system states even during restoration.

Question 99: Which group should be included in crisis communication notification lists but is often overlooked?

Employees' families and dependents (Correct answer)
Regulatory bodies
Local and national media contacts
Senior executives

Correct answer: Employees' families and dependents

Employees' families are a frequently overlooked stakeholder group. During a crisis affecting personnel, their families need information about employee safety and company response, which reduces rumors and demonstrates organizational care.

Question 100: Which element should be established FIRST when designing a new exercise?

Scenario narrative
Exercise objectives (Correct answer)
Inject schedule
Participant list

Correct answer: Exercise objectives

Exercise objectives must be defined first because they drive all other planning decisions, including scenario selection, inject development, and evaluation criteria.

DRI International Qualifying Examination (CBCP/ABCP)

The DRI International Qualifying Examination assesses knowledge across 10 professional practice areas of business continuity management, serving as the prerequisite exam for CBCP and ABCP certifications. It covers the full business continuity lifecycle from risk evaluation and business impact analysis through plan development, crisis communications, and ongoing maintenance.

100

Questions

150 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds