DRI International Qualifying Examination (CBCP/ABCP) — Questions and Answers

Question 1: In continuous improvement methodology, 'benchmarking' a BC program involves:

Comparing the program's practices and metrics against industry peers or standards (Correct answer)
Documenting the minimum acceptable BCP document length
Measuring server benchmark speeds at the recovery site
Setting internal performance targets for recovery teams

Correct answer: Comparing the program's practices and metrics against industry peers or standards

Benchmarking compares an organization's BC program practices and performance against external peers or recognized standards.

Question 2: Which of the following is a key difference between a 'lesson learned' and a 'best practice' in exercise documentation?

A lesson learned identifies what went wrong; a best practice identifies what worked well and should be repeated (Correct answer)
Lessons learned are documented by controllers; best practices are documented by players
There is no formal difference between the two terms in DRI standards
A best practice applies only to tabletop exercises; a lesson learned applies to full-scale exercises

Correct answer: A lesson learned identifies what went wrong; a best practice identifies what worked well and should be repeated

Lessons learned capture gaps or failures to be corrected, while best practices document effective responses worth replicating and sharing across the organization.

Question 3: Which of the following is a key characteristic of a 'Type 1' incident under the ICS typing system?

Managed with local resources, limited to one operational period
Requires only two ICS functional sections to be activated
The most complex incidents requiring national resources and extensive organization (Correct answer)
Involves fewer than 10 responding personnel

Correct answer: The most complex incidents requiring national resources and extensive organization

Type 1 incidents are the most complex, involving national-level resources, multiple operational periods, and a fully activated ICS organization.

Question 4: Why must pandemic plans specifically address 'long-term resource depletion' as a planning consideration?

Unlike time-limited disasters, pandemic duration (months to years) means resources initially available may be exhausted, requiring sustainability strategies beyond typical BC resource stockpiling (Correct answer)
Insurance coverage for pandemics depletes more rapidly than for other risk types
Pandemics consume more IT resources than other disruptions due to remote work expansion
Pandemic events are more geographically widespread, requiring resources to be distributed across more locations

Correct answer: Unlike time-limited disasters, pandemic duration (months to years) means resources initially available may be exhausted, requiring sustainability strategies beyond typical BC resource stockpiling

Pandemic duration fundamentally changes resource planning—resources adequate for a 72-hour crisis may be exhausted within weeks. Pandemic plans must address sustainable resource strategies: supply chain replenishment, budget authorization for extended operations, and workforce sustainability rather than just surge capacity.

Question 5: During an EOC activation, the 'unified command' structure is BEST used when:

Multiple agencies share incident jurisdiction or responsibility (Correct answer)
Only federal agencies are involved in the response
The incident is confined to one geographic location
A single agency has full jurisdiction over the incident

Correct answer: Multiple agencies share incident jurisdiction or responsibility

Unified command is established when multiple agencies with overlapping jurisdictions or different functional responsibilities must coordinate on a single incident.

Question 6: How does ISO 22301 handle 'nonconformities' identified during internal audits or exercises?

Nonconformities are reported to the certification body for external resolution
Nonconformities discovered internally may be deferred until the annual management review
ISO 22301 only requires corrective action for nonconformities discovered by external auditors
Organizations must react to nonconformities, investigate root causes, implement corrective actions, and verify effectiveness, retaining documented evidence of all actions (Correct answer)

Correct answer: Organizations must react to nonconformities, investigate root causes, implement corrective actions, and verify effectiveness, retaining documented evidence of all actions

ISO 22301 Clause 10.1 requires organizations to react to nonconformities promptly, investigate root causes, implement corrective actions proportionate to the significance of the nonconformity, verify effectiveness, and retain documented evidence of the entire corrective action process.

Question 7: How often should a Business Continuity Plan be reviewed and updated, according to DRI best practices?

Whenever a new senior executive joins the organization
At least annually and after significant changes to the business, systems, or threat environment (Correct answer)
Every five years to align with strategic planning cycles
Only when a significant disruption has occurred

Correct answer: At least annually and after significant changes to the business, systems, or threat environment

DRI best practices require BCP review at least annually and following significant organizational changes—new systems, reorganizations, facility changes, acquisitions, or changes in the threat environment—to keep plans current and effective.

Question 8: Which type of exercise involves participants walking through their roles in a scenario without activating actual resources or personnel?

Functional exercise
Drill
Tabletop exercise (Correct answer)
Full-scale exercise

Correct answer: Tabletop exercise

A tabletop exercise is a discussion-based session where participants talk through their roles and responses to a scenario without deploying real resources.

Question 9: What is the purpose of version control in BCP documentation?

To prevent unauthorized personnel from reading the plan
To comply with ISO 27001 document control requirements only
To track how many times each employee has accessed the plan
To ensure all plan holders are working from the current, authorized version and to maintain an audit trail of changes (Correct answer)

Correct answer: To ensure all plan holders are working from the current, authorized version and to maintain an audit trail of changes

Version control ensures all plan holders are using the current authorized version and maintains an audit trail of what the plan said at any given time—critical for avoiding the scenario where responders use outdated procedures during an incident.

Question 10: What is the key distinction between 'crisis management' and 'crisis communications'?

Crisis communications is a subset of IT disaster recovery
Crisis management involves operational decisions; crisis communications involves information flow to stakeholders (Correct answer)
Crisis management is reactive; crisis communications is always proactive
Crisis management focuses on recovery; crisis communications focuses on prevention

Correct answer: Crisis management involves operational decisions; crisis communications involves information flow to stakeholders

Crisis management encompasses strategic and operational decisions to resolve the incident, while crisis communications focuses on how information is shared with internal and external stakeholders.

Question 11: Which of the following is a key component of a supply chain BC strategy for a US-based organization?

Eliminating all international suppliers to reduce risk
Keeping all suppliers in the same geographic region for easier management
Maintaining safety stock of critical materials to bridge supply gaps during disruptions (Correct answer)
Reducing the number of suppliers to simplify procurement

Correct answer: Maintaining safety stock of critical materials to bridge supply gaps during disruptions

Maintaining safety stock of critical materials provides a buffer that allows operations to continue during supply chain disruptions while alternate sources are activated.

Question 12: A spokesperson delivers technically accurate information during a press conference but uses jargon unfamiliar to the public. Which communication principle has been violated?

Timeliness
Audience appropriateness (Correct answer)
Consistency
Accuracy

Correct answer: Audience appropriateness

Effective crisis communication must be tailored to the audience's knowledge level; technical jargon alienates the public and undermines understanding.

Question 13: What is the significance of a vendor's SOC 2 report in third-party BC risk management?

It validates the vendor's marketing claims about service quality
It confirms the vendor's financial stability and creditworthiness
It provides independent assurance that the vendor's controls, including availability and continuity controls, are effective (Correct answer)
It certifies that the vendor's employees have passed background checks

Correct answer: It provides independent assurance that the vendor's controls, including availability and continuity controls, are effective

A SOC 2 report provides independent auditor attestation of a vendor's operational controls including availability and continuity-related controls, giving assurance of their resilience posture.

Question 14: In supply chain risk management, what does 'geographic diversification' mean?

Expanding your own organization into multiple geographic markets
Hiring staff from diverse geographic backgrounds
Storing backup data in geographically distributed centers
Sourcing from suppliers in different locations to reduce regional disaster exposure (Correct answer)

Correct answer: Sourcing from suppliers in different locations to reduce regional disaster exposure

Geographic diversification in supply chain management means sourcing critical materials or services from suppliers in different locations so a single regional disaster cannot disrupt all sources simultaneously.

Question 15: What role does documentation play in Disaster Recovery Institute International professional practice?

It is optional for experienced professionals
It is an administrative burden with no practical value
It is only needed for billing purposes
It creates accountability, supports decision-making, and provides legal protection (Correct answer)

Correct answer: It creates accountability, supports decision-making, and provides legal protection

Documentation creates accountability, supports informed decision-making, and provides legal protection for both the professional and the client.

Question 16: During a DR test, the team discovers the recovery procedure for the ERP system takes 9 hours but the RTO is 6 hours. What is the BEST immediate action?

Revise the RTO to 9 hours
Accept the variance and document it
Cancel the DR test and restart from scratch
Identify and eliminate bottlenecks in the recovery procedure to meet the 6-hour RTO (Correct answer)

Correct answer: Identify and eliminate bottlenecks in the recovery procedure to meet the 6-hour RTO

When a test reveals the recovery time exceeds the RTO, the team must analyze and remove procedural bottlenecks to bring actual recovery time within the agreed RTO.

Question 17: Which BCP strategy involves routing work to another location already staffed and operational?

Cold site activation
Reciprocal agreement
Warm site failover
Hot site failover (Correct answer)

Correct answer: Hot site failover

A hot site is a fully equipped, staffed alternate facility that can take over operations immediately with minimal or no switchover delay.

Question 18: After a major emergency, a 'After-Action Report (AAR)' primarily serves to:

Compile a historical narrative for public records only
Document successes and areas for improvement to enhance future response capabilities (Correct answer)
Notify insurers of claims arising from the incident
Establish financial liability among responding agencies

Correct answer: Document successes and areas for improvement to enhance future response capabilities

An AAR captures lessons learned — what worked, what didn't, and recommended improvements — to strengthen future emergency preparedness and response.

Question 19: What is an 'exercise master scenario events list (MSEL)' and why is it a critical planning tool?

A list of all previous exercises conducted by the organization and their outcomes
A chronological timeline of all planned scenario events, injects, and expected participant actions used to control exercise flow (Correct answer)
A regulatory submission documenting planned exercise activities
A master list of all business scenarios that have been exercised across the program's history

Correct answer: A chronological timeline of all planned scenario events, injects, and expected participant actions used to control exercise flow

An MSEL is the detailed chronological script for an exercise—listing each timed event, inject, or stimulus, the expected participant response, the responsible exercise controller, and evaluation criteria—enabling coordinated, controlled exercise facilitation.

Question 20: What is the primary distinction between a functional exercise and a full-scale exercise?

Functional exercises are unannounced; full-scale exercises are pre-scheduled
Full-scale exercises involve only senior leadership; functional exercises involve all staff
Functional exercises use real resources; full-scale exercises are simulated only
Functional exercises test a single function; full-scale tests the entire plan (Correct answer)

Correct answer: Functional exercises test a single function; full-scale tests the entire plan

A functional exercise tests specific functions or capabilities, while a full-scale exercise activates all aspects of the plan with real resource deployment.

Question 21: What is 'pandemic phase planning' and why does it require BC plans to be tiered?

Planning for multiple pandemic scenarios of varying lethality and transmissibility
Planning across the three phases of pandemic response: prevention, response, and recovery
Dividing pandemic planning responsibilities across different tiers of management
Aligning continuity responses to the WHO or national health authority pandemic phase declarations, with increasingly aggressive measures as the phase escalates (Correct answer)

Correct answer: Aligning continuity responses to the WHO or national health authority pandemic phase declarations, with increasingly aggressive measures as the phase escalates

Pandemic phase planning aligns BC activation triggers and response measures to official pandemic phase declarations, enabling the organization to implement progressively more aggressive measures proportionate to actual conditions rather than activating the most extreme responses prematurely.

Question 22: When developing recovery strategies for supply chain disruptions, which approach involves identifying and qualifying multiple vendors for critical inputs?

Sole-source contracting
Single-source procurement
Just-in-time inventory
Vendor diversification (Correct answer)

Correct answer: Vendor diversification

Vendor diversification qualifies multiple suppliers for critical goods or services so that the failure or disruption of one vendor does not halt production or operations.

Question 23: What is the importance of pre-establishing 'mutual aid agreements' for emergency operations?

They establish in advance the terms under which organizations will share resources, personnel, and capabilities during incidents exceeding a single organization's capacity (Correct answer)
They fulfill insurance policy requirements for emergency management
They document the financial compensation due from an organization that causes a shared infrastructure failure
They define the regulatory reporting obligations between multiple organizations in a shared facility

Correct answer: They establish in advance the terms under which organizations will share resources, personnel, and capabilities during incidents exceeding a single organization's capacity

Mutual aid agreements pre-establish the terms, conditions, and processes for organizations to share resources, personnel, facilities, and capabilities during major incidents—ensuring that aid is available when needed without requiring negotiation during the crisis itself.

Question 24: According to DRI professional practices, what element should a pandemic annex to a BCP specifically contain that standard BC plans may not fully address?

A detailed clinical protocol for treating infected employees
Financial projections for pandemic-related revenue losses by product line
Specific workforce absenteeism escalation triggers, remote work activation procedures, and infection control protocols tailored to the organization's operational environment (Correct answer)
A comprehensive list of all pandemic scenarios identified by the World Health Organization

Correct answer: Specific workforce absenteeism escalation triggers, remote work activation procedures, and infection control protocols tailored to the organization's operational environment

A pandemic annex specifically addresses the unique pandemic risk profile: workforce absenteeism triggers and thresholds, remote work activation procedures, and infection control protocols specific to the organization's facilities and operations—gaps that standard BCPs focused on facility and technology recovery do not fully address.

Question 25: When an organization recovers technology systems at an alternate site, what must be verified before resuming full operations?

That data integrity is confirmed and recovered systems are functioning correctly (Correct answer)
That the new site has a cafeteria
That all employees have physically relocated to the alternate site
That the original site's lease has been terminated

Correct answer: That data integrity is confirmed and recovered systems are functioning correctly

Before resuming full operations, teams must validate data integrity and confirm all recovered systems are functioning correctly to avoid processing corrupt or incomplete data.

Question 26: In business continuity, 'interdependency analysis' is conducted to:

Evaluate competitor vulnerabilities
Map how critical business processes rely on each other and on shared resources (Correct answer)
Prioritize IT patch management
Determine employee compensation during a crisis

Correct answer: Map how critical business processes rely on each other and on shared resources

Interdependency analysis identifies upstream and downstream relationships between business functions and shared infrastructure, preventing blind spots in recovery sequencing.

Question 27: During an emergency response, the 'demobilization' phase begins when:

Surplus resources are identified and a plan is made for their orderly release (Correct answer)
The Incident Commander is replaced by a new commander
The Finance Section completes cost documentation
Emergency notifications are sent to all stakeholders

Correct answer: Surplus resources are identified and a plan is made for their orderly release

Demobilization starts when resources are no longer needed and involves the planned, safe, and cost-effective release of resources from an incident.

Question 28: Which metric is most useful for tracking whether BCP gaps identified in prior audits are being resolved?

Test scenario complexity score
Corrective action closure rate (Correct answer)
Number of new threats identified
Annual plan revision count

Correct answer: Corrective action closure rate

The corrective action closure rate directly measures whether identified gaps from prior audits are being remediated on schedule.

Question 29: During exercise planning, what is the purpose of 'injects'?

To introduce new scenario events that prompt participants to make decisions (Correct answer)
To inject real data into the DR system during testing
To physically inject failover commands into production servers
To insert corrective actions identified from prior exercises

Correct answer: To introduce new scenario events that prompt participants to make decisions

Injects are scripted messages or events introduced by controllers during an exercise to prompt participants to take specific actions and test their response capabilities.

Question 30: Which factor is MOST critical in pandemic workforce continuity planning?

Purchasing pandemic insurance to cover lost revenue during health emergencies
Identifying mission-critical roles and ensuring sufficient depth of cross-trained backup personnel for each (Correct answer)
Ensuring all employees are vaccinated before a pandemic occurs
Establishing relationships with temporary staffing agencies for rapid workforce replacement

Correct answer: Identifying mission-critical roles and ensuring sufficient depth of cross-trained backup personnel for each

Identifying mission-critical roles and ensuring multiple cross-trained personnel can perform each role is the most critical workforce continuity factor—it addresses the fundamental pandemic risk that key personnel may be simultaneously unavailable due to illness or caregiving responsibilities.

Question 31: In IT disaster recovery planning, what is the 'Recovery Time Actual (RTA)' metric used for?

Calculating the financial cost of recovery operations
Setting the initial RTO target during BIA
Measuring the actual time taken to recover a system during a test or actual incident, for comparison against the RTO target (Correct answer)
Determining the staffing requirements for the recovery team

Correct answer: Measuring the actual time taken to recover a system during a test or actual incident, for comparison against the RTO target

Recovery Time Actual (RTA) measures the real time taken to recover a system during an exercise or actual incident, enabling comparison against the RTO target to determine whether the recovery solution is meeting its performance requirements.

Question 32: When should an organization activate its Crisis Management Team (CMT) versus its local Incident Response Team (IRT)?

The IRT manages operational-level response; the CMT is activated when incidents threaten strategic business objectives, executive decision-making, or cross-organizational coordination (Correct answer)
The CMT should be activated for every incident; the IRT is only used for IT-related incidents
The CMT handles external communications; the IRT handles internal communications
The IRT is activated first and immediately transfers authority to the CMT upon activation

Correct answer: The IRT manages operational-level response; the CMT is activated when incidents threaten strategic business objectives, executive decision-making, or cross-organizational coordination

Local IRTs manage operational incident response within their scope. The CMT is activated for incidents that escalate to strategic significance—threatening major business objectives, requiring executive decisions, necessitating cross-organizational coordination, or creating significant external stakeholder impact.

Question 33: What is the role of an 'emergency change management process' during technology recovery?

To cancel all pending software updates
To allow expedited changes needed to restore systems while maintaining documentation and accountability (Correct answer)
To reassign all change approvals to the CEO
To freeze all system changes during the disaster

Correct answer: To allow expedited changes needed to restore systems while maintaining documentation and accountability

An emergency change management process streamlines approvals during a crisis while still capturing changes made, preserving auditability and enabling accurate post-incident review.

Question 34: A company's RPO is set at 4 hours. What is the MAXIMUM acceptable interval for automated data backups?

24 hours
4 hours (Correct answer)
1 hour
8 hours

Correct answer: 4 hours

The backup interval must not exceed the RPO; if RPO is 4 hours, backups must run at least every 4 hours to avoid exceeding allowable data loss.

Question 35: An organization's exercise program consistently tests IT systems recovery but never involves business unit representatives. This gap primarily risks:

Validating technical recovery without confirming business processes can actually resume operations (Correct answer)
Over-testing IT systems causing unnecessary wear on equipment
Exceeding the approved exercise budget
Generating redundant corrective actions already captured by IT

Correct answer: Validating technical recovery without confirming business processes can actually resume operations

IT recovery without business unit participation cannot confirm that recovered systems actually support the business processes needed to meet RTOs, leaving a critical validation gap.

Question 36: During an incident, what is the purpose of maintaining an 'incident log'?

To document all significant actions, decisions, communications, and resource deployments throughout the incident for accountability and after-action analysis (Correct answer)
To satisfy real-time regulatory reporting requirements
To record financial expenditures for insurance reimbursement claims
To track employee attendance during the response

Correct answer: To document all significant actions, decisions, communications, and resource deployments throughout the incident for accountability and after-action analysis

The incident log provides a timestamped record of all significant actions, decisions, communications, and resource deployments—it is essential for situational awareness during the incident and for post-incident analysis, legal defensibility, and insurance claims.

Question 37: What does 'Maximum Tolerable Downtime' (MTD) represent in business continuity planning?

The longest a business function can be disrupted before causing irreversible harm (Correct answer)
The time between backups
The average downtime expected per year
The time needed to restore full operations

Correct answer: The longest a business function can be disrupted before causing irreversible harm

MTD (also called Maximum Tolerable Period of Disruption) is the threshold beyond which an organization cannot survive the loss of a critical function.

Question 38: What is the 'essential worker' designation and how does it affect pandemic business continuity planning?

A planning classification identifying roles that must be physically performed on-site because they cannot be conducted remotely and are critical to operations, requiring enhanced protection measures (Correct answer)
An HR classification determining which employees receive pandemic-related bonuses
A legal designation that exempts certain employees from pandemic health orders
A government designation that only applies to public sector and healthcare workers

Correct answer: A planning classification identifying roles that must be physically performed on-site because they cannot be conducted remotely and are critical to operations, requiring enhanced protection measures

Essential worker designations identify roles that must be physically present and are critical to operations—these employees cannot work remotely and require enhanced infection control protections, priority access to PPE, and specific continuity planning attention.

Question 39: An organization issues contradictory statements through different departments during a crisis. The BEST corrective action is to:

Activate a single, centralized communication command structure immediately (Correct answer)
Refer all inquiries to legal counsel only
Issue a retraction for all previous statements
Increase posting frequency to drown out the confusion

Correct answer: Activate a single, centralized communication command structure immediately

Centralizing all crisis communications through one command structure and a single authorized spokesperson eliminates contradictions and restores message consistency.

Question 40: What does ISO 22301 clause 9.1 'Monitoring, measurement, analysis, and evaluation' require organizations to determine?

The exercise frequency required for each plan element
The financial metrics for evaluating BCM program return on investment
The regulatory reporting metrics that must be tracked for compliance purposes
What needs to be monitored, when, how, who will do it, and when results will be analyzed to evaluate BCMS performance (Correct answer)

Correct answer: What needs to be monitored, when, how, who will do it, and when results will be analyzed to evaluate BCMS performance

Clause 9.1 requires organizations to determine what to monitor and measure, the methods for ensuring valid results, when monitoring occurs, when results are analyzed and evaluated, and who is responsible—enabling evidence-based assessment of BCMS effectiveness.

Question 41: What is the 'Hotwash' (immediate debrief) in exercise methodology and when is it conducted?

A sanitization process for exercise equipment after a biological or chemical scenario
A formal written report submitted within 24 hours of exercise completion
An immediate, informal debrief conducted right after an exercise ends while observations and reactions are fresh (Correct answer)
A technical review of IT systems performance during the exercise conducted by the IT team

Correct answer: An immediate, informal debrief conducted right after an exercise ends while observations and reactions are fresh

A Hotwash is an immediate informal debrief conducted at the conclusion of an exercise—while observations, reactions, and experiences are fresh—to capture immediate impressions, identify key themes, and acknowledge participant contributions before participants disperse.

Question 42: A company's Emergency Response Team (ERT) has been activated. The FIRST priority in life-safety situations is:

Documenting the sequence of events
Notifying the media of the situation
Accounting for all personnel and ensuring evacuation (Correct answer)
Protecting company assets and equipment

Correct answer: Accounting for all personnel and ensuring evacuation

Life safety is always the first priority in emergency response, requiring personnel accountability and safe evacuation before addressing other concerns.

Question 43: Which document formally closes an audit cycle by confirming that all agreed corrective actions have been implemented?

A corrective action verification report or closure memo (Correct answer)
The updated business continuity plan
The next scheduled audit plan
The initial audit report

Correct answer: A corrective action verification report or closure memo

A corrective action verification report or closure memo formally documents that remediation has been completed and verified.

Question 44: Under the Dodd-Frank Act, systemically important financial institutions (SIFIs) face enhanced BC/DR requirements primarily because:

Their failure or disruption could pose systemic risk to U.S. financial stability (Correct answer)
SIFIs are exempt from FDIC oversight and require separate resilience standards
Dodd-Frank mandated annual third-party BC audits for all financial institutions
Dodd-Frank established the FFIEC to regulate bank continuity programs

Correct answer: Their failure or disruption could pose systemic risk to U.S. financial stability

Dodd-Frank designated certain institutions as SIFIs based on their size and interconnectedness, subjecting them to enhanced prudential standards including stricter operational resilience expectations due to their potential systemic impact.

Question 45: Which term describes the documented set of procedures for returning a business to normal operations after recovery activities are complete?

Continuity of Operations Plan (COOP)
Return to Operations Plan (RTOP)
Business Resumption Plan (Correct answer)
Crisis Management Plan

Correct answer: Business Resumption Plan

A Business Resumption Plan outlines the steps to transition from temporary recovery mode back to normal, fully restored business operations.

Question 46: Which DR testing method carries the HIGHEST risk to production operations but provides the most realistic validation?

Full interruption test (Correct answer)
Simulation test
Parallel test
Tabletop exercise

Correct answer: Full interruption test

A full interruption test shuts down the primary site completely and forces all operations to run on the DR site, providing the most realistic test but risking actual business disruption if the DR site fails.

Question 47: When multiple organizations respond to the same incident, coordinating their public communications is the responsibility of the:

Federal Emergency Management Agency alone
Senior elected official for the jurisdiction
Each organization's independent PR department
Joint Information Center (JIC) (Correct answer)

Correct answer: Joint Information Center (JIC)

A Joint Information Center (JIC) provides a centralized location where PIOs from all responding organizations coordinate and release unified, consistent public information.

Question 48: What role does insurance play in a comprehensive business continuity strategy?

It eliminates the need for a BCP
It guarantees instant restoration of operations
It is a risk transfer mechanism that complements but does not replace operational continuity plans (Correct answer)
It funds the BIA process

Correct answer: It is a risk transfer mechanism that complements but does not replace operational continuity plans

Insurance transfers financial risk but does not restore operations or protect customers, making it a complement to — not a substitute for — operational BCP.

Question 49: In the context of crisis management, what does the term 'Joint Information Center (JIC)' refer to?

A facility where response organizations coordinate public information activities (Correct answer)
A software platform for tracking crisis incidents
A committee that reviews communication plans annually
The secure communication channel between the CEO and the board

Correct answer: A facility where response organizations coordinate public information activities

A Joint Information Center (JIC) is a physical or virtual facility established during a major incident where multiple responding organizations coordinate their public communications to ensure consistent and unified messaging.

Question 50: Which phase of incident response focuses on returning business operations to normal while preserving evidence for investigation?

Recovery phase (Correct answer)
Containment phase
Eradication phase
Post-incident analysis phase

Correct answer: Recovery phase

The Recovery phase focuses on restoring systems and operations to normal while maintaining the careful balance between operational restoration and evidence preservation for ongoing investigation—security forensics may require maintaining certain system states even during restoration.

Question 51: How should Disaster Recovery Institute International professionals approach quality improvement?

By waiting for client complaints
Through systematic evaluation of outcomes and implementation of evidence-based changes (Correct answer)
By copying what competitors do
Quality improvement is the responsibility of management only

Correct answer: Through systematic evaluation of outcomes and implementation of evidence-based changes

Systematic evaluation of outcomes with evidence-based improvements ensures continuous quality enhancement and demonstrates professional commitment to excellence.

Question 52: A Mutual Aid Agreement (MAA) differs from a standard vendor contract primarily in that a MAA:

Requires payment in advance for all services
Applies solely to technology resources
Is only valid during federally declared disasters
Is reciprocal — either party may request or provide assistance depending on the situation (Correct answer)

Correct answer: Is reciprocal — either party may request or provide assistance depending on the situation

MAAs are reciprocal agreements where either party can request or provide assistance based on need, without the transactional nature of a vendor contract.

Question 53: Under the National Incident Management System (NIMS), the Incident Command System (ICS) structure is designed to:

Provide a standardized, scalable command structure for managing incidents of any size (Correct answer)
Apply exclusively to natural disaster scenarios
Operate only at the federal government level
Replace existing organizational hierarchies permanently

Correct answer: Provide a standardized, scalable command structure for managing incidents of any size

ICS under NIMS is a standardized, scalable command structure applicable to incidents of any type or size, enabling effective coordination across organizations.

Question 54: An organization seeks to certify its BC program against ISO 22301. Before the external certification audit, it must complete:

A full-scale live failover test
Regulatory approval from a government agency
At least one internal audit and one management review cycle (Correct answer)
A third-party business impact analysis

Correct answer: At least one internal audit and one management review cycle

ISO 22301 requires evidence of at least one internal audit and management review before an organization can pursue external certification.

Question 55: Which metric measures the maximum tolerable length of time that a system can be offline?

RPO
RTO (Correct answer)
MTBF
MTTR

Correct answer: RTO

Recovery Time Objective (RTO) defines the maximum acceptable downtime before business operations are critically impacted.

Question 56: What does a 'maturity model' measure in the context of a BC program?

Employee tenure in BC roles
The organization's capability and process sophistication over time (Correct answer)
The age of the business continuity plan documents
The number of completed DR tests

Correct answer: The organization's capability and process sophistication over time

A maturity model assesses the sophistication and capability level of BC processes, from ad hoc to optimized.

Question 57: What is the most important principle in professional Disaster Recovery Institute International practice?

Maximizing revenue from each client
Following only personal judgment
Maintaining competence through continuous learning and adherence to standards (Correct answer)
Working as quickly as possible

Correct answer: Maintaining competence through continuous learning and adherence to standards

Maintaining competence through continuous learning and adherence to professional standards ensures quality service delivery and public protection in Disaster Recovery Institute International practice.

Question 58: The NIST Cybersecurity Framework (CSF) function 'Recover' directly supports business continuity by focusing on:

Identifying organizational cybersecurity risk through asset management
Developing and implementing restoration activities after a cybersecurity incident (Correct answer)
Preventing cyberattacks through access controls and encryption
Detecting anomalous activity through monitoring

Correct answer: Developing and implementing restoration activities after a cybersecurity incident

The NIST CSF 'Recover' function focuses on developing and implementing appropriate activities to maintain plans for resilience and restore capabilities or services impaired by a cybersecurity incident—directly supporting business continuity objectives.

Question 59: Which framework describes crisis responses along a continuum from deny to accommodate based on the organization's responsibility level?

Image Restoration Theory
Situational Crisis Communication Theory (SCCT) (Correct answer)
Chaos Theory of Crisis
CERC Model

Correct answer: Situational Crisis Communication Theory (SCCT)

SCCT, developed by Timothy Coombs, matches crisis response strategies to the level of organizational responsibility attributed by stakeholders.

Question 60: What is the PRIMARY purpose of an Incident Response Plan (IRP)?

To document lessons learned after incidents for regulatory reporting
To ensure all incidents are reported to law enforcement immediately
To provide a structured framework for detecting, responding to, and recovering from incidents in a controlled and coordinated manner (Correct answer)
To assign financial liability for losses incurred during incidents

Correct answer: To provide a structured framework for detecting, responding to, and recovering from incidents in a controlled and coordinated manner

An Incident Response Plan provides the structured framework for detecting, containing, investigating, and recovering from incidents—its primary purpose is enabling effective, coordinated response that minimizes impact and restores normal operations.

Question 61: What is the primary purpose of a 'hot wash' conducted immediately after a BC exercise?

To capture immediate participant feedback and observations while memories are fresh (Correct answer)
To update the BCP based on the exercise script
To clean and restore IT systems used during the drill
To calculate the financial cost of the exercise

Correct answer: To capture immediate participant feedback and observations while memories are fresh

A hot wash immediately after an exercise captures raw participant feedback and initial observations before recall fades.

Question 62: Which regulatory body oversees business continuity and operational resilience requirements for U.S. federally insured depository institutions?

CFTC
FDIC (Correct answer)
FINRA
SEC

Correct answer: FDIC

The FDIC, along with the OCC and Federal Reserve, issues guidance on business continuity planning for federally insured depository institutions through the FFIEC IT Examination Handbook.

Question 63: Which document is used to formally declare the end of an incident response and transition to normal operations?

The incident log close-out report
A regulatory after-action report
A formal incident demobilization plan or stand-down order (Correct answer)
An incident debrief agenda

Correct answer: A formal incident demobilization plan or stand-down order

A formal incident demobilization plan or stand-down order formally closes the incident response, transitions activities back to normal operations, releases response resources, and establishes accountability for remaining actions.

Question 64: In IT disaster recovery, what is a 'runbook' and why is it essential?

A detailed, step-by-step technical procedure guide for executing specific IT recovery tasks (Correct answer)
A document tracking which servers are running at any given time
A checklist used for routine IT maintenance tasks
A log of all system runs and batch jobs executed in the past 30 days

Correct answer: A detailed, step-by-step technical procedure guide for executing specific IT recovery tasks

A runbook is a detailed, step-by-step technical guide documenting exactly how to execute a specific IT recovery task—server failover, database restoration, network reconfiguration—providing sufficient detail for a qualified technician to execute the procedure correctly under stress.

Question 65: When a business continuity professional says a plan is 'compliant,' this MOST accurately means the plan:

Addresses all applicable regulatory and standards requirements relevant to the organization (Correct answer)
Has been approved by the board of directors
Was written by a certified business continuity professional
Has never failed during an actual disruption

Correct answer: Addresses all applicable regulatory and standards requirements relevant to the organization

Compliance means the plan addresses all applicable regulatory requirements, legal obligations, and relevant standards—not that it has been board-approved, never failed, or was written by a certified professional.

Question 66: Under the National Incident Management System (NIMS), which function handles all public information activities during an incident?

Operations Section
Liaison Officer
Public Information Officer (PIO) (Correct answer)
Planning Section

Correct answer: Public Information Officer (PIO)

The Public Information Officer (PIO) is a Command Staff position under NIMS responsible for coordinating and releasing approved information to the public and media.

Question 67: What differentiates a 'reciprocal agreement' DR strategy from a hot site strategy?

Reciprocal agreements use cloud infrastructure
Reciprocal agreements only cover network recovery
Reciprocal agreements require government approval
Reciprocal agreements involve two organizations agreeing to host each other during a disaster (Correct answer)

Correct answer: Reciprocal agreements involve two organizations agreeing to host each other during a disaster

A reciprocal agreement is a mutual arrangement between two organizations to provide backup processing capacity for each other in the event of a disaster.

Question 68: Which communication channel is typically MOST reliable during infrastructure-disrupting disasters when other channels fail?

Corporate intranet
Satellite phone (Correct answer)
Email
Social media platforms

Correct answer: Satellite phone

Satellite phones operate independently of terrestrial network infrastructure, making them reliable when cellular and internet systems are damaged or overloaded.

Question 69: What is 'failback' in a disaster recovery context?

Failing to meet the RTO during a test
Moving operations from the DR site back to the restored primary site (Correct answer)
Reverting to a previous backup version
Activating the secondary site when the primary fails

Correct answer: Moving operations from the DR site back to the restored primary site

Failback is the process of returning operations from the DR/secondary site to the original primary site once it has been repaired and validated after a disaster.

Question 70: What is the most important principle in professional Disaster Recovery Institute International practice?

Maximizing revenue from each client
Maintaining competence through continuous learning and adherence to standards (Correct answer)
Following only personal judgment
Working as quickly as possible

Correct answer: Maintaining competence through continuous learning and adherence to standards

Question 71: What is the 'Golden Hour' principle in emergency response?

The optimal duration for an initial incident response briefing
The first hour after business opening when most emergency calls are received
The 60-minute window for completing all regulatory notifications
The critical first hour after an incident when initial response actions disproportionately determine the ultimate outcome (Correct answer)

Correct answer: The critical first hour after an incident when initial response actions disproportionately determine the ultimate outcome

The 'Golden Hour' principle holds that actions taken in the first hour after an incident—notification, initial containment, EOC activation, resource mobilization—disproportionately determine whether the incident escalates or is controlled, making rapid initial response critical.

Question 72: Which backup method copies ONLY the files that have changed since the last full backup and resets the archive bit after each run?

Incremental backup (Correct answer)
Snapshot backup
Mirror backup
Differential backup

Correct answer: Incremental backup

Incremental backups capture only changes since the last backup of any type and clear the archive bit, resulting in smaller, faster backups but longer restore times.

Question 73: Which of the following best describes a 'single point of failure' in a BCP context?

A vendor with a single contract
A risk that only affects one department
A component whose failure would halt an entire critical process (Correct answer)
A system that has redundant backups

Correct answer: A component whose failure would halt an entire critical process

A single point of failure is any element in a process or system that, if it fails, causes the entire critical function to stop with no fallback.

Question 74: What is the relationship between ISO 22301 and NFPA 1600 in business continuity practice?

ISO 22301 is the international certification standard for BCMS; NFPA 1600 is a US standard that covers similar ground and is referenced by DHS for private sector preparedness (Correct answer)
ISO 22301 applies to European organizations; NFPA 1600 applies to North American organizations
NFPA 1600 replaced ISO 22301 as the international standard in 2023
NFPA 1600 is required for ISO 22301 certification as a prerequisite

Correct answer: ISO 22301 is the international certification standard for BCMS; NFPA 1600 is a US standard that covers similar ground and is referenced by DHS for private sector preparedness

ISO 22301 is the international management system standard enabling BCMS certification; NFPA 1600 is a US standard covering similar disaster/emergency management and business continuity ground, referenced by DHS for private sector preparedness—they are complementary, not competing.

Question 75: A BC program continuous improvement review identifies that plan maintenance tasks are consistently completed late. Applying a process improvement lens, the first step should be to:

Shorten the maintenance review window
Outsource plan maintenance to a third party
Map the current plan maintenance process to identify where delays originate (Correct answer)
Assign penalties for late submissions

Correct answer: Map the current plan maintenance process to identify where delays originate

Process mapping identifies where bottlenecks or inefficiencies occur before any solution is applied.

Question 76: Which document formally authorizes the execution of disaster recovery procedures and the expenditure of recovery resources?

The Business Impact Analysis
The Recovery Time Objective statement
The Memorandum of Understanding
The Disaster Declaration (Correct answer)

Correct answer: The Disaster Declaration

A formal disaster declaration by authorized management triggers the activation of recovery plans and authorizes spending recovery resources per the DR plan.

Question 77: What is the role of emotional intelligence in leadership?

It is irrelevant in professional settings
It replaces the need for technical competence
It enables understanding and managing emotions in oneself and others for better outcomes (Correct answer)
It only matters in counseling roles

Correct answer: It enables understanding and managing emotions in oneself and others for better outcomes

Emotional intelligence enables leaders to understand and manage their own emotions and those of team members, improving communication, motivation, and decision-making.

Question 78: Which audit sampling method is most appropriate when an auditor wants to ensure that every item in a population has an equal chance of being selected?

Random sampling (Correct answer)
Stratified sampling
Judgmental sampling
Block sampling

Correct answer: Random sampling

Random sampling gives every item an equal probability of selection, reducing bias and supporting statistical validity.

Question 79: What is a 'Supplier Business Impact Analysis (BIA)' used for in supply chain continuity?

To identify which supplier relationships are most critical and the impact of their failure (Correct answer)
To determine which suppliers provide the best discounts
To measure supplier employee productivity
To rank suppliers by geographic proximity

Correct answer: To identify which supplier relationships are most critical and the impact of their failure

A Supplier BIA identifies the criticality of each supplier relationship and quantifies the operational and financial impact if that supplier cannot deliver, guiding prioritization of mitigation efforts.

Question 80: What is the primary goal of a 'post-exercise report' following a BCP drill?

To grade individual employee performance
To document findings, gaps, and corrective actions to improve the plan (Correct answer)
To calculate the financial cost of the exercise
To satisfy regulatory requirements only

Correct answer: To document findings, gaps, and corrective actions to improve the plan

The post-exercise report captures observations, identifies weaknesses in the plan or execution, and drives an action plan to close gaps before a real event.

Question 81: What is a critical aspect of disaster recovery planning?

Mapping out business operations only
Focusing on recovery plans for non-essential functions
Implementing continuous monitoring for vulnerabilities (Correct answer)
Identifying potential threats to business continuity

Correct answer: Implementing continuous monitoring for vulnerabilities

A critical aspect of disaster recovery planning is not just creating a plan, but ensuring its ongoing relevance and effectiveness. Implementing continuous monitoring for vulnerabilities allows an organization to proactively identify new threats, weaknesses in systems, and changes in the environment that could impact recovery capabilities, enabling timely updates and improvements to the DRP.

Question 82: Which of the following regulations is critical in disaster recovery?

Health Insurance Portability and Accountability Act (HIPAA)
General Data Protection Regulation (GDPR) (Correct answer)
Payment Card Industry Data Security Standard (PCI DSS)
Sarbanes-Oxley Act

Correct answer: General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is critical in disaster recovery because it imposes strict requirements for protecting personal data. Organizations must ensure that their data recovery plans comply with GDPR principles, such as data integrity, confidentiality, and the lawful processing of personal information, even after a disruptive event. Non-compliance can lead to significant fines and reputational damage.

Question 83: Which of the following BEST describes the concept of 'Defense in Depth' in IT resilience?

Using the most expensive security technology available for all systems
Maintaining a single, comprehensive system that addresses all resilience needs
Employing multiple layers of security and resilience controls so that failure of one layer does not compromise the entire system (Correct answer)
Focusing all resilience investment on the perimeter network to prevent intrusions

Correct answer: Employing multiple layers of security and resilience controls so that failure of one layer does not compromise the entire system

Defense in Depth applies multiple layers of controls so that a single failure cannot compromise the entire system—each layer provides protection that compensates for weaknesses in adjacent layers.

Question 84: What is the primary purpose of regulatory compliance in professional practice?

To increase operating costs
To limit the number of practitioners
To create bureaucratic obstacles
To protect public safety and ensure minimum standards of care (Correct answer)

Correct answer: To protect public safety and ensure minimum standards of care

Regulatory compliance exists primarily to protect public safety by ensuring all practitioners meet minimum standards of competence and ethical conduct.

Question 85: Which of the following is a critical element of a business continuity plan?

Recovery point objective (RPO) (Correct answer)
Competitive pricing strategies.
Customer service guidelines.
Employee engagement strategy.

Correct answer: Recovery point objective (RPO)

The Recovery Point Objective (RPO) is a critical metric in business continuity planning that defines the maximum acceptable amount of data loss measured in time. It determines how much data an organization can afford to lose from the point of failure to the last valid backup, guiding backup strategies and data replication efforts.

Question 86: Which document in a comprehensive BCM program typically provides the highest-level framework, defining scope, policy, and governance?

The Business Impact Analysis report
The Business Continuity Plan for the headquarters facility
The Business Continuity Management Policy (Correct answer)
The IT Disaster Recovery Plan

Correct answer: The Business Continuity Management Policy

The Business Continuity Management Policy is the highest-level BCM document, providing the governance framework—scope, objectives, roles and responsibilities, accountability, and commitment from executive leadership—that all other BCM documents operate within.

Question 87: When transitioning between treatment phases, what is essential?

Let the patient decide all treatment parameters
Document the rationale for change and update goals accordingly (Correct answer)
Continue the same approach indefinitely
Make changes without updating records

Correct answer: Document the rationale for change and update goals accordingly

Documenting the rationale for treatment phase changes and updating goals ensures continuity of care, clear communication, and appropriate progress tracking.

Question 88: In DRI's Professional Practices, who is ultimately responsible for ensuring BC training is conducted and maintained?

Individual employees, who must self-certify their BC knowledge
Senior management, who must champion and resource the BC program (Correct answer)
External consultants hired to manage the BC program
The IT department, as they own the technical recovery systems

Correct answer: Senior management, who must champion and resource the BC program

DRI's Professional Practices place ultimate responsibility for BC training on senior management, who must provide leadership, resources, and cultural support for the organization's BC program.

Question 89: How should BC training content be updated to remain relevant?

Every five years as part of a comprehensive BC program review
Whenever a new BC team member joins who needs updated materials
Only when the regulatory environment changes and new requirements are issued
After each exercise, audit, significant organizational change, or incident to reflect lessons learned (Correct answer)

Correct answer: After each exercise, audit, significant organizational change, or incident to reflect lessons learned

BC training content must be continuously updated after exercises, audits, organizational changes, and incidents to ensure it reflects current processes, personnel, and lessons learned.

Question 90: What role does documentation play in Disaster Recovery Institute International professional practice?

It creates accountability, supports decision-making, and provides legal protection (Correct answer)
It is optional for experienced professionals
It is an administrative burden with no practical value
It is only needed for billing purposes

Correct answer: It creates accountability, supports decision-making, and provides legal protection

Documentation creates accountability, supports informed decision-making, and provides legal protection for both the professional and the client.

Question 91: Why is supply chain pandemic planning particularly challenging compared to other supply chain disruptions?

Simultaneous global impact means that alternative suppliers, geographies, and logistics providers are all affected at the same time (Correct answer)
Pandemics are caused by biological agents that can contaminate physical goods in transit
International trade regulations specifically restrict supply chain activity during declared pandemics
Insurance policies typically exclude supply chain losses caused by pandemic events

Correct answer: Simultaneous global impact means that alternative suppliers, geographies, and logistics providers are all affected at the same time

The simultaneous global impact of pandemics means that backup suppliers, alternative geographies, and substitute logistics providers are all experiencing the same conditions—the geographic and supplier diversification strategies that address most supply chain disruptions may be ineffective.

Question 92: What does the term 'recovery time objective' (RTO) refer to?

The maximum allowable downtime before a business function is restored (Correct answer)
The time required for data entry.
The time needed to train employees.
The time needed for marketing campaigns.

Correct answer: The maximum allowable downtime before a business function is restored

The Recovery Time Objective (RTO) specifies the maximum acceptable duration of time within which a business process or system must be restored after a disaster or disruption to avoid unacceptable consequences. It dictates how quickly an organization needs to recover its operations to a functional state.

Question 93: What does 'competency-based training' mean in the context of BC/DR programs?

An advanced certification program for BC professionals
Training designed for highly skilled IT staff only
Training evaluated solely through written examinations
Training focused on ensuring staff can perform specific recovery tasks correctly, not just understand concepts (Correct answer)

Correct answer: Training focused on ensuring staff can perform specific recovery tasks correctly, not just understand concepts

Competency-based BC/DR training focuses on verified ability to perform specific recovery tasks correctly, ensuring practical readiness rather than just theoretical knowledge of the plan.

Question 94: Why is it important to test a business continuity plan regularly?

To identify any weaknesses or gaps in the plan (Correct answer)
To improve customer satisfaction.
To improve employee performance.
To increase profits.

Correct answer: To identify any weaknesses or gaps in the plan

Regular testing of a business continuity plan (BCP) is essential to validate its effectiveness and ensure it remains current and viable. Testing helps identify any deficiencies, outdated information, or procedural gaps that could hinder recovery efforts during an actual incident, allowing for necessary revisions and improvements.

Question 95: The concept of 'scalability' in emergency operations means that the response system should:

Maintain a fixed organizational structure for all incident types
Expand or contract based on the complexity and size of the incident (Correct answer)
Always activate the maximum level of resources to ensure safety
Automatically contact all responders regardless of incident size

Correct answer: Expand or contract based on the complexity and size of the incident

Scalability allows response structures like ICS and EOCs to be expanded for major incidents and reduced when not needed, matching the resource level to the incident.

Question 96: A BC program manager wants to demonstrate year-over-year program improvement to senior leadership. The most effective approach is to:

List all vendors that participated in BC testing
Report the number of exercises conducted during the year
Show that the BCP document has grown in page count
Present trended KPI data showing measurable progress against prior baselines (Correct answer)

Correct answer: Present trended KPI data showing measurable progress against prior baselines

Trended KPI data provides quantitative, comparable evidence of program improvement over time, which is most persuasive to leadership.

Question 97: What is the recommended approach when EOC staff must transition to the next operational period team (shift handoff)?

The incoming team reviews written logs independently without overlap
All operations halt until the new team is fully oriented
The Incident Commander verbally summarizes all events to the new team
A structured briefing with overlap time between outgoing and incoming staff (Correct answer)

Correct answer: A structured briefing with overlap time between outgoing and incoming staff

Effective shift transitions require a structured briefing with overlap so that outgoing staff can verbally transfer situational awareness to incoming staff.

Question 98: When conducting a BIA, what is the MOST important output for determining recovery strategy investment levels?

The cost-benefit analysis of different recovery technologies
The number of employees required to operate each business function
Prioritized business functions with their RTOs, RPOs, and MTDs (Correct answer)
A list of all IT systems used by each business unit

Correct answer: Prioritized business functions with their RTOs, RPOs, and MTDs

Prioritized business functions with their RTOs, RPOs, and MTDs are the critical BIA output—they directly drive decisions about how much to invest in recovery capabilities for each function and what recovery strategies are appropriate.

Question 99: Why is 'data classification' important for IT disaster recovery planning?

It enables organizations to apply appropriate recovery priorities, RPOs, and backup frequencies based on data criticality and sensitivity (Correct answer)
It satisfies regulatory requirements for data labeling and handling policies
It determines which data can be stored in cloud environments versus on-premises
It helps determine which employees are authorized to access specific systems during recovery

Correct answer: It enables organizations to apply appropriate recovery priorities, RPOs, and backup frequencies based on data criticality and sensitivity

Data classification enables organizations to apply recovery priorities, RPOs, backup frequencies, and protection levels that are proportionate to each data type's criticality and sensitivity—preventing both under-protection of critical data and over-investment in protecting trivial data.

Question 100: What is a key responsibility in crisis communication?

Focusing on addressing client complaints
Maintaining secrecy to prevent panic
Limiting public statements until the crisis ends
Ensuring transparency and timely information sharing (Correct answer)

Correct answer: Ensuring transparency and timely information sharing

Ensuring transparency and timely information sharing is a key responsibility in crisis communication to maintain trust and control the narrative. By providing accurate and prompt updates, organizations can reduce speculation, prevent the spread of misinformation, and demonstrate accountability to their stakeholders. This approach helps manage public perception and fosters confidence during challenging times.

DRI International Qualifying Examination (CBCP/ABCP)

The DRI International Qualifying Examination assesses knowledge across 10 professional practice areas of business continuity management, serving as the prerequisite exam for CBCP and ABCP certifications. It covers the full business continuity lifecycle from risk evaluation and business impact analysis through plan development, crisis communications, and ongoing maintenance.

100

Questions

150 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds