DRI International Qualifying Examination (CBCP/ABCP) — Questions and Answers

Question 1: What is the purpose of a 'recovery time objective' (RTO) gap analysis?

Comparing actual recovery times achieved in tests against the defined RTO targets (Correct answer)
Measuring network bandwidth at the DR site
Determining which staff will work at the DR site
Calculating the cost of backup storage

Correct answer: Comparing actual recovery times achieved in tests against the defined RTO targets

An RTO gap analysis compares tested recovery performance against the agreed RTO to identify where improvements are needed in recovery procedures or infrastructure.

Question 2: Which of the following is the MOST important criterion when selecting an alternate processing site location?

Lowest possible monthly lease cost
Proximity to the primary site for easy commuting
Distance sufficient to avoid the same regional disaster risk (Correct answer)
Availability of local restaurants for staff

Correct answer: Distance sufficient to avoid the same regional disaster risk

The alternate site must be far enough from the primary site that a single regional disaster cannot affect both locations simultaneously.

Question 3: A BCP component that documents the alternate procedures for performing critical business functions manually or with limited technology is called:

A disaster recovery plan
A workaround procedure or manual fallback procedure (Correct answer)
An emergency operations center runbook
A business impact analysis update

Correct answer: A workaround procedure or manual fallback procedure

Workaround procedures (also called manual fallback procedures) document how critical business functions can be performed using manual or alternative methods when normal systems, tools, or processes are unavailable.

Question 4: What is the role of emotional intelligence in leadership?

It enables understanding and managing emotions in oneself and others for better outcomes (Correct answer)
It is irrelevant in professional settings
It replaces the need for technical competence
It only matters in counseling roles

Correct answer: It enables understanding and managing emotions in oneself and others for better outcomes

Emotional intelligence enables leaders to understand and manage their own emotions and those of team members, improving communication, motivation, and decision-making.

Question 5: In the context of supply chain continuity, what is 'supplier diversification'?

Auditing a single preferred vendor annually
Negotiating lower prices by consolidating to one vendor
Sourcing the same material from multiple independent vendors to reduce dependency risk (Correct answer)
Creating an internal supply function

Correct answer: Sourcing the same material from multiple independent vendors to reduce dependency risk

Supplier diversification reduces single-vendor dependency by qualifying multiple independent sources for critical materials or services.

Question 6: In a parallel test, what distinguishes it from a full interruption test?

Parallel tests activate DR systems without shutting down the primary environment (Correct answer)
Parallel tests use simulated data only
Parallel tests are conducted offsite
Parallel tests do not involve IT staff

Correct answer: Parallel tests activate DR systems without shutting down the primary environment

A parallel test brings DR systems online and verifies they can process workloads while the primary site continues normal operations, unlike a full interruption test that shuts the primary site down.

Question 7: What is the significance of professional networking in the Disaster Recovery Institute International field?

It is only useful for finding new employment
It distracts from actual work
It is only important early in one's career
It facilitates knowledge exchange, referrals, and collaborative problem-solving (Correct answer)

Correct answer: It facilitates knowledge exchange, referrals, and collaborative problem-solving

Professional networking facilitates knowledge exchange, generates referrals, and enables collaborative problem-solving that improves practice quality.

Question 8: How should an organization handle a situation where an exercise reveals a critical gap that cannot be immediately remediated?

Document the gap in the exercise report, assess the risk it represents, develop an interim mitigation, assign a remediation owner, and track to resolution (Correct answer)
Accept the gap as an inherent limitation and remove the affected function from the BC plan scope
Cancel future exercises until the gap is resolved to avoid identifying additional unfixable gaps
Immediately notify all stakeholders that the BC plan has a known critical deficiency

Correct answer: Document the gap in the exercise report, assess the risk it represents, develop an interim mitigation, assign a remediation owner, and track to resolution

Gaps that cannot be immediately fixed require: documented risk assessment, interim mitigations to reduce exposure, specific ownership for remediation, and active tracking until resolved—not program stoppage, scope reduction, or premature stakeholder notification.

Question 9: A BC manager discovers that a critical vendor's SLA does not align with the organization's RTO. Under ISO 22301, the MOST appropriate first action is:

Implement a manual workaround without further analysis
Document the gap in the risk register and assess impact through the BIA (Correct answer)
Notify regulators of the compliance gap
Terminate the vendor contract immediately

Correct answer: Document the gap in the risk register and assess impact through the BIA

ISO 22301 requires organizations to evaluate and address risks from interested parties (including suppliers); documenting the gap and assessing its impact through the BIA ensures a risk-based, evidence-based response.

Question 10: What is the MOST important document produced after a business continuity exercise?

The corrective action plan assigning specific improvements to owners with deadlines (Correct answer)
The compliance certificate for regulatory filing
The attendance register confirming who participated
The exercise scenario script and MSEL for future reference

Correct answer: The corrective action plan assigning specific improvements to owners with deadlines

The corrective action plan—assigning specific improvement actions to named owners with target completion dates—is the most important post-exercise document because it converts findings into actual program improvements; without it, exercises produce no lasting benefit.

Question 11: What is the primary purpose of an Incident Action Plan (IAP) in emergency operations?

Document post-incident financial losses
Record contact information for all responders
Establish long-term recovery milestones
Communicate objectives and tactics for a specific operational period (Correct answer)

Correct answer: Communicate objectives and tactics for a specific operational period

An IAP specifies the incident objectives, strategies, tactics, and assignments for a defined operational period.

Question 12: What is the most important principle in professional Disaster Recovery Institute International practice?

Working as quickly as possible
Maintaining competence through continuous learning and adherence to standards (Correct answer)
Maximizing revenue from each client
Following only personal judgment

Correct answer: Maintaining competence through continuous learning and adherence to standards

Maintaining competence through continuous learning and adherence to professional standards ensures quality service delivery and public protection in Disaster Recovery Institute International practice.

Question 13: A BC program manager wants to demonstrate year-over-year program improvement to senior leadership. The most effective approach is to:

Report the number of exercises conducted during the year
Present trended KPI data showing measurable progress against prior baselines (Correct answer)
List all vendors that participated in BC testing
Show that the BCP document has grown in page count

Correct answer: Present trended KPI data showing measurable progress against prior baselines

Trended KPI data provides quantitative, comparable evidence of program improvement over time, which is most persuasive to leadership.

Question 14: In technology recovery, what is meant by 'system hardening' as part of DR preparation?

Reducing attack surface and vulnerabilities on recovery systems so they are secure when activated (Correct answer)
Encrypting backup tapes with physical cases
Installing physical security locks on servers
Upgrading hardware to higher-performance models

Correct answer: Reducing attack surface and vulnerabilities on recovery systems so they are secure when activated

System hardening applies security configurations to recovery systems to prevent them from being exploited when activated, since DR environments are sometimes less routinely patched.

Question 15: When should an organization activate its Crisis Management Team (CMT) versus its local Incident Response Team (IRT)?

The IRT manages operational-level response; the CMT is activated when incidents threaten strategic business objectives, executive decision-making, or cross-organizational coordination (Correct answer)
The CMT should be activated for every incident; the IRT is only used for IT-related incidents
The IRT is activated first and immediately transfers authority to the CMT upon activation
The CMT handles external communications; the IRT handles internal communications

Correct answer: The IRT manages operational-level response; the CMT is activated when incidents threaten strategic business objectives, executive decision-making, or cross-organizational coordination

Local IRTs manage operational incident response within their scope. The CMT is activated for incidents that escalate to strategic significance—threatening major business objectives, requiring executive decisions, necessitating cross-organizational coordination, or creating significant external stakeholder impact.

Question 16: Empathy expressed early in a crisis communication typically serves to:

Satisfy legal requirements for duty of care
Delay media coverage while investigations proceed
Transfer responsibility to affected parties
Reduce outrage and build goodwill before factual information is available (Correct answer)

Correct answer: Reduce outrage and build goodwill before factual information is available

Expressing empathy early signals that the organization prioritizes people over operational concerns, which reduces emotional outrage and makes audiences more receptive to subsequent factual messages.

Question 17: How does pandemic planning interact with an organization's essential business functions determination?

Pandemic planning requires a separate BIA that is different from the standard business continuity BIA
Essential function determination during pandemics is determined exclusively by government mandate
The standard BIA's identification of critical functions drives pandemic prioritization, but pandemic plans add workforce absenteeism as a variable determining which functions can actually be maintained (Correct answer)
Pandemic planning overrides the standard BIA prioritization during declared health emergencies

Correct answer: The standard BIA's identification of critical functions drives pandemic prioritization, but pandemic plans add workforce absenteeism as a variable determining which functions can actually be maintained

The standard BIA identifies which functions are critical—pandemic planning adds the workforce dimension: which critical functions can actually be maintained given potential peak absenteeism rates, and how must staffing and procedures be adapted to protect those functions.

Question 18: What is the primary output of the exercise evaluation process?

A revised Business Continuity Plan
An After-Action Report (AAR) with a Corrective Action Plan (CAP) (Correct answer)
An updated risk register
A new exercise schedule for the following year

Correct answer: An After-Action Report (AAR) with a Corrective Action Plan (CAP)

The After-Action Report documents observed strengths and areas for improvement, and the Corrective Action Plan assigns responsibility and timelines for addressing gaps.

Question 19: The 'span of control' principle in ICS recommends that each supervisor directly manage how many personnel?

3 to 7 individuals (Correct answer)
15 to 20 individuals
8 to 12 individuals
2 to 4 individuals

Correct answer: 3 to 7 individuals

ICS guidelines recommend a span of control ratio of 1 supervisor to 3–7 subordinates, with 5 being the optimal ratio.

Question 20: In the CERC (Crisis and Emergency Risk Communication) model, which phase involves providing consistent updates as the situation stabilizes?

Maintenance (Correct answer)
Initial
Resolution
Pre-crisis

Correct answer: Maintenance

The Maintenance phase of CERC focuses on sustaining public trust through regular, consistent updates while the situation is still ongoing but under control.

Question 21: Which approach best supports achieving a near-zero RPO for a critical database?

Daily tape backups
Monthly disaster recovery testing
Synchronous replication to a remote site (Correct answer)
Weekly full backups

Correct answer: Synchronous replication to a remote site

Synchronous replication writes data to both the primary and remote replica simultaneously, ensuring near-zero data loss if the primary site fails.

Question 22: Which action should be taken when a vendor's BC plan does not meet your organization's RTOs?

Require the vendor to improve their plan or identify an alternate vendor who can meet requirements (Correct answer)
Accept the risk and proceed with the vendor relationship unchanged
Reduce your own RTO to match the vendor's capability
Remove the RTO requirement from your BC plan

Correct answer: Require the vendor to improve their plan or identify an alternate vendor who can meet requirements

If a vendor's BC plan cannot support your RTOs, you must either require improvements or identify alternate vendors whose capabilities align with your recovery time requirements.

Question 23: A company's Emergency Response Team (ERT) has been activated. The FIRST priority in life-safety situations is:

Accounting for all personnel and ensuring evacuation (Correct answer)
Documenting the sequence of events
Notifying the media of the situation
Protecting company assets and equipment

Correct answer: Accounting for all personnel and ensuring evacuation

Life safety is always the first priority in emergency response, requiring personnel accountability and safe evacuation before addressing other concerns.

Question 24: What is the primary concern when using asynchronous replication for disaster recovery?

It requires identical hardware at both sites
There may be a lag between the primary and replica, resulting in potential data loss equal to the replication delay (Correct answer)
It is too expensive for most organizations
It cannot be used with cloud-based recovery sites

Correct answer: There may be a lag between the primary and replica, resulting in potential data loss equal to the replication delay

Asynchronous replication does not wait for acknowledgment from the replica before completing a write, so a failure during the lag window results in data loss.

Question 25: During a crisis, which communication principle is MOST critical for maintaining stakeholder trust?

Delegating all communication to the public relations team
Withholding information until all facts are confirmed
Providing timely, accurate, and transparent information (Correct answer)
Limiting communications to internal audiences only

Correct answer: Providing timely, accurate, and transparent information

Timely, accurate, and transparent communication is the cornerstone of effective crisis communication. Delays or misinformation erode stakeholder trust and can worsen the crisis impact.

Question 26: What is the 'dual-use' challenge in pandemic preparedness investments?

Investments in pandemic capabilities that can also provide value for non-pandemic scenarios, justifying costs that might not be supportable for pandemic preparedness alone (Correct answer)
The difficulty of training personnel for both pandemic response and normal operations simultaneously
The challenge of using the same pandemic plan for both biological and chemical hazards
The regulatory challenge of using the same PPE for both pandemic and chemical hazard protection

Correct answer: Investments in pandemic capabilities that can also provide value for non-pandemic scenarios, justifying costs that might not be supportable for pandemic preparedness alone

Dual-use investments address the organizational challenge of justifying pandemic preparedness expenditures by identifying where pandemic capabilities also provide value for non-pandemic scenarios, enabling business cases that don't depend solely on pandemic probability assessments.

Question 27: What is the primary purpose of regulatory compliance in professional practice?

To protect public safety and ensure minimum standards of care (Correct answer)
To create bureaucratic obstacles
To limit the number of practitioners
To increase operating costs

Correct answer: To protect public safety and ensure minimum standards of care

Regulatory compliance exists primarily to protect public safety by ensuring all practitioners meet minimum standards of competence and ethical conduct.

Question 28: After a major emergency, a 'After-Action Report (AAR)' primarily serves to:

Compile a historical narrative for public records only
Document successes and areas for improvement to enhance future response capabilities (Correct answer)
Notify insurers of claims arising from the incident
Establish financial liability among responding agencies

Correct answer: Document successes and areas for improvement to enhance future response capabilities

An AAR captures lessons learned — what worked, what didn't, and recommended improvements — to strengthen future emergency preparedness and response.

Question 29: How should strategy implementation be monitored?

Only when problems are reported
Through key performance indicators aligned with strategic objectives (Correct answer)
Through informal observations
By waiting for annual review results

Correct answer: Through key performance indicators aligned with strategic objectives

KPIs aligned with strategic objectives provide ongoing, objective measurement of implementation progress, enabling timely adjustments when needed.

Question 30: How should a Disaster Recovery Institute International professional handle situations beyond their expertise?

Accept the work to maintain the business relationship
Ignore the complexity and apply standard approaches
Refer to a qualified specialist and communicate transparently with the client (Correct answer)
Attempt the work and learn from experience

Correct answer: Refer to a qualified specialist and communicate transparently with the client

Referring to qualified specialists when facing situations beyond personal expertise protects clients and upholds professional integrity.

Question 31: In a business continuity context, what is the primary purpose of a regulatory compliance matrix?

To map specific regulatory requirements to business continuity program elements and identify gaps (Correct answer)
To document financial penalties associated with non-compliance
To record all regulatory audits and their findings
To track employee compliance training completion rates

Correct answer: To map specific regulatory requirements to business continuity program elements and identify gaps

A regulatory compliance matrix maps specific regulatory and legal requirements to corresponding elements of the business continuity program, helping organizations identify coverage gaps and ensure all obligations are addressed.

DRI International Qualifying Examination (CBCP/ABCP)

The DRI International Qualifying Examination assesses knowledge across 10 professional practice areas of business continuity management, serving as the prerequisite exam for CBCP and ABCP certifications. It covers the full business continuity lifecycle from risk evaluation and business impact analysis through plan development, crisis communications, and ongoing maintenance.

Questions

35 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds