DRI Risk Assessment & Business Impact Analysis 2

Question 1

In a Business Impact Analysis (BIA), what does 'Maximum Tolerable Downtime (MTD)' represent?

Accepted Answer

The total duration the organization can survive without a critical function before it reaches an unacceptable outcome

Answer

Maximum Tolerable Downtime (MTD) is the total time a business function can be unavailable before the organization suffers irreversible consequences—financial, operational, legal, or reputational—from which it cannot recover.

Question 2

A qualitative risk assessment approach rates risks using categories such as 'High, Medium, Low' rather than numerical values. What is a primary LIMITATION of this approach?

Accepted Answer

Ratings can be inconsistent across different assessors without clear definitions

Answer

Qualitative risk assessments rely on subjective judgment, meaning two different assessors may rate the same risk differently without standardized definitions for each rating level, reducing consistency and comparability.

Question 3

What is the difference between a 'threat' and a 'vulnerability' in risk assessment?

Accepted Answer

A threat is a potential cause of harm; a vulnerability is a weakness that could be exploited by a threat

Answer

A threat is something external that could cause harm (hurricane, cyberattack, supply chain failure), while a vulnerability is an internal weakness or condition that makes the organization susceptible to harm from a threat.

Question 4

When conducting a BIA, what is the MOST important output for determining recovery strategy investment levels?

Accepted Answer

Prioritized business functions with their RTOs, RPOs, and MTDs

Answer

Prioritized business functions with their RTOs, RPOs, and MTDs are the critical BIA output—they directly drive decisions about how much to invest in recovery capabilities for each function and what recovery strategies are appropriate.

Question 5

In risk assessment, 'risk tolerance' differs from 'risk appetite' in that:

Accepted Answer

Risk appetite is the level of risk an organization is willing to accept to achieve objectives; risk tolerance is the acceptable deviation around that appetite

Answer

Risk appetite is the broad amount and type of risk an organization is willing to accept in pursuit of its objectives. Risk tolerance is the acceptable variation around the risk appetite—the boundaries within which specific risks can fluctuate before triggering escalation.

(DRI) Disaster Recovery Institute International Certification Practice Test

(DRI) Disaster Recovery Institute International Certification Practice Test

DRI Risk Assessment & Business Impact Analysis 2