GRC Business Continuity and Resilience 3 — Questions and Answers
Question 1: What document formally grants authority to activate the BCP and allocate emergency resources?
- Business impact analysis report
- Disaster recovery runbook
- Crisis management charter or emergency authority delegation (Correct answer)
- Incident response policy
Correct answer: Crisis management charter or emergency authority delegation
A crisis management charter or emergency authority delegation document defines who can activate the BCP and commit organizational resources.
Question 2: Which BCP testing method involves actually switching operations to the alternate site to verify full functionality?
- Tabletop exercise
- Parallel test
- Full interruption test (Correct answer)
- Checklist review
Correct answer: Full interruption test
A full interruption test shuts down the primary site and fully transfers operations to the DR site, providing the most realistic validation.
Question 3: An organization sets its RPO at zero for financial transaction data. What technology best supports this requirement?
- Daily tape backup
- Weekly full backup with incremental backups
- Synchronous real-time replication (Correct answer)
- Asynchronous batch replication every 4 hours
Correct answer: Synchronous real-time replication
Synchronous replication writes data to both primary and secondary locations simultaneously, ensuring zero data loss (RPO = 0).
Question 4: Which element of a BIA quantifies the financial impact per hour of a critical process being unavailable?
- Threat assessment
- Downtime cost analysis (Correct answer)
- Control gap analysis
- Risk appetite statement
Correct answer: Downtime cost analysis
Downtime cost analysis within a BIA calculates the monetary impact of unavailability per unit of time for each critical process.
Question 5: A BCP plan owner discovers the contact list has not been updated in 18 months. This violates which BCP principle?
- Testing frequency
- Plan maintenance and currency (Correct answer)
- Risk acceptance
- Change management integration
Correct answer: Plan maintenance and currency
BCPs must be regularly maintained and updated to remain accurate, including personnel contact information and organizational changes.
Question 6: What is the key difference between business continuity planning and disaster recovery planning?
- BCP focuses only on IT systems while DRP covers all business functions
- BCP addresses maintaining business operations broadly; DRP focuses on restoring IT infrastructure (Correct answer)
- DRP is a legal requirement; BCP is optional
- BCP applies only to natural disasters; DRP covers cyber incidents
Correct answer: BCP addresses maintaining business operations broadly; DRP focuses on restoring IT infrastructure
BCP encompasses maintaining all critical business functions during a disruption, while DRP is the IT-specific subset focused on technology recovery.
Question 7: Which standard provides internationally recognized guidance specifically for business continuity management systems?
- ISO 27001
- ISO 22301 (Correct answer)
- NIST SP 800-53
- COBIT 2019
Correct answer: ISO 22301
ISO 22301 is the international standard specifying requirements for planning, establishing, and implementing a Business Continuity Management System (BCMS).
GRC Business Continuity and Resilience 3
What document formally grants authority to activate the BCP and allocate emergency resources?