Business Continuity and Resilience Flashcards
7 cards from real GRC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Business Continuity and Resilience flashcards as text
Which BCP strategy involves geographically distributing operations so that a regional disaster cannot disrupt all facilities simultaneously?
Answer: Geographic redundancy
Geographic redundancy places critical operations across multiple distant locations so a single regional event cannot affect all of them.
A BCP coordinator is documenting which employees are cross-trained to perform critical functions. What planning element does this address?
Answer: Succession planning and key person dependency risk
Identifying and cross-training staff addresses key person dependency risk, ensuring critical functions can continue if specific individuals are unavailable.
After a BCP activation, which activity ensures lessons are captured and the plan is improved?
Answer: Post-incident or post-exercise review (after-action review)
An after-action review systematically captures what worked, what failed, and what should be improved in the BCP following an activation or exercise.
Which scenario best illustrates a 'pandemic' as a BCP threat category distinct from physical disasters?
Answer: Widespread employee illness simultaneously reduces workforce availability company-wide
Pandemics threaten workforce availability across all locations simultaneously, unlike physical disasters that target specific facilities or infrastructure.
In BCP documentation, what is the purpose of a call tree (also called a phone tree or notification tree)?
Answer: To establish a structured chain for rapidly notifying personnel during an incident
A call tree defines the cascading notification sequence so that personnel are quickly alerted about a disruption in a structured, efficient manner.
Which regulatory framework in the US financial sector specifically requires covered institutions to maintain business continuity and recovery programs?
Answer: FFIEC Business Continuity Management booklet
The FFIEC Business Continuity Management booklet provides supervisory guidance requiring financial institutions to maintain robust BCM programs.
A BCP exercise reveals that the backup generator fails to power the data center after 6 hours. This finding should be entered into which governance tool?
Answer: The risk register and corrective action log
Exercise findings that expose gaps or failures must be documented in the risk register and tracked through a corrective action log to ensure remediation.