GRC Business Continuity and Resilience 5 — Questions and Answers
Question 1: Which BCP strategy involves geographically distributing operations so that a regional disaster cannot disrupt all facilities simultaneously?
- Geographic redundancy (Correct answer)
- Load balancing
- Cold standby clustering
- Data archiving
Correct answer: Geographic redundancy
Geographic redundancy places critical operations across multiple distant locations so a single regional event cannot affect all of them.
Question 2: A BCP coordinator is documenting which employees are cross-trained to perform critical functions. What planning element does this address?
- Succession planning and key person dependency risk (Correct answer)
- Data backup strategy
- Network redundancy
- Regulatory compliance mapping
Correct answer: Succession planning and key person dependency risk
Identifying and cross-training staff addresses key person dependency risk, ensuring critical functions can continue if specific individuals are unavailable.
Question 3: After a BCP activation, which activity ensures lessons are captured and the plan is improved?
- Root cause analysis only for IT failures
- Post-incident or post-exercise review (after-action review) (Correct answer)
- Immediate re-testing within 24 hours
- Regulatory self-assessment
Correct answer: Post-incident or post-exercise review (after-action review)
An after-action review systematically captures what worked, what failed, and what should be improved in the BCP following an activation or exercise.
Question 4: Which scenario best illustrates a 'pandemic' as a BCP threat category distinct from physical disasters?
- A hurricane destroys the primary data center
- Widespread employee illness simultaneously reduces workforce availability company-wide (Correct answer)
- A cyberattack encrypts all files
- A power grid failure affects the region for 72 hours
Correct answer: Widespread employee illness simultaneously reduces workforce availability company-wide
Pandemics threaten workforce availability across all locations simultaneously, unlike physical disasters that target specific facilities or infrastructure.
Question 5: In BCP documentation, what is the purpose of a call tree (also called a phone tree or notification tree)?
- To document server dependency mapping
- To establish a structured chain for rapidly notifying personnel during an incident (Correct answer)
- To track regulatory reporting deadlines
- To prioritize IT system restoration order
Correct answer: To establish a structured chain for rapidly notifying personnel during an incident
A call tree defines the cascading notification sequence so that personnel are quickly alerted about a disruption in a structured, efficient manner.
Question 6: Which regulatory framework in the US financial sector specifically requires covered institutions to maintain business continuity and recovery programs?
- HIPAA Security Rule
- FFIEC Business Continuity Management booklet (Correct answer)
- SOC 2 Type II
- PCI DSS Requirement 12
Correct answer: FFIEC Business Continuity Management booklet
The FFIEC Business Continuity Management booklet provides supervisory guidance requiring financial institutions to maintain robust BCM programs.
Question 7: A BCP exercise reveals that the backup generator fails to power the data center after 6 hours. This finding should be entered into which governance tool?
- The company's marketing plan
- The risk register and corrective action log (Correct answer)
- The employee handbook
- The annual report to shareholders
Correct answer: The risk register and corrective action log
Exercise findings that expose gaps or failures must be documented in the risk register and tracked through a corrective action log to ensure remediation.
GRC Business Continuity and Resilience 5
Which BCP strategy involves geographically distributing operations so that a regional disaster cannot disrupt all facilities simultaneously?