DRI Business Continuity Planning 3 — Questions and Answers
Question 1: Which DRII Professional Practice addresses the process of identifying exposures that could lead to a business interruption?
- Crisis Communications
- Business Impact Analysis
- Risk Evaluation and Control (Correct answer)
- Exercise, Audit and Maintenance
Correct answer: Risk Evaluation and Control
DRII Professional Practice 2, Risk Evaluation and Control, covers identifying, assessing, and managing risks that could cause business interruptions.
Question 2: A company decides to split operations between two active data centers so each can absorb the other's load if one fails. This strategy is called:
- Active-passive clustering
- Active-active configuration (Correct answer)
- Cold standby
- Geographic load balancing
Correct answer: Active-active configuration
An active-active configuration means both sites run production workloads simultaneously and can absorb each other's traffic if one fails, with near-zero downtime.
Question 3: In the context of supply chain continuity, what is 'supplier diversification'?
- Sourcing the same material from multiple independent vendors to reduce dependency risk (Correct answer)
- Negotiating lower prices by consolidating to one vendor
- Creating an internal supply function
- Auditing a single preferred vendor annually
Correct answer: Sourcing the same material from multiple independent vendors to reduce dependency risk
Supplier diversification reduces single-vendor dependency by qualifying multiple independent sources for critical materials or services.
Question 4: Which metric answers the question: 'At what point in time must systems be restored to avoid unacceptable data loss?'
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO) (Correct answer)
- Maximum Tolerable Downtime (MTD)
- Service Delivery Objective (SDO)
Correct answer: Recovery Point Objective (RPO)
RPO defines the maximum age of data that must be recovered from backup storage for normal operations to resume, essentially dictating backup frequency.
Question 5: When should a Business Continuity Plan be reviewed and updated?
- Only after a declared disaster
- Only when senior management requests it
- Periodically and after significant organizational changes, tests, or incidents (Correct answer)
- Every five years as part of strategic planning
Correct answer: Periodically and after significant organizational changes, tests, or incidents
BCP maintenance must be ongoing — triggered by scheduled reviews, organizational changes, exercise results, and post-incident lessons learned.
Question 6: A 'call tree' (phone tree) is used in BCP primarily for:
- Documenting recovery steps in sequence
- Rapidly notifying personnel during an emergency activation (Correct answer)
- Tracking vendor SLA compliance
- Scheduling tabletop exercises
Correct answer: Rapidly notifying personnel during an emergency activation
A call tree is a tiered notification structure where each contact reaches a defined set of others, ensuring rapid cascade of emergency communications.
Question 7: The concept of 'resilience' in business continuity differs from 'recovery' in that resilience refers to:
- Restoring operations after a failure has occurred
- The ability to absorb disruption and continue operating with minimal impact (Correct answer)
- Identifying and eliminating all risks before a disruption
- Transferring risk to a third party via insurance
Correct answer: The ability to absorb disruption and continue operating with minimal impact
Resilience is the capacity to withstand disruptions and maintain operations during them, whereas recovery is the process of restoring normalcy after an interruption.
DRI Business Continuity Planning 3
Which DRII Professional Practice addresses the process of identifying exposures that could lead to a business interruption?