DRII CBCP Exam

D.

Defining a business continuity problem statement

1. Being able to answer the question, "What is important to your business?" is part of what process?

A. Gaining senior management support

B. Getting an executive sponsor

C. Developing a budget

D. Defining a business continuity problem statement

C.

It shows management's commitment to BC planning process

2. What is the value of a BCM policy statement?

A. It forces middle management to comply with senior directives

B. It shows employees how to do their part in the planning process

C. It shows management's commitment to BC planning process

D. It provides senior management a direction in which to make future decisions

D.

A BCM staff with a budget

3. What would be evidence of management support for BCM?

A. A steering committee that reports to the emergency response team

B. An executive sponsor who reports to the damage assessment committee

C. A project plan developed solely by the business continuity planner

D. A BCM staff with a budget

D.

The survivability of the organization when faced with a disaster

4. What is a benefit to the organization of having an effective business continuity program?

A. Internal disasters will not go unreported

B. The business continuity program will relate to organizational mission, objectives, and operations

C. Employees will be amazed at the organization's multi-faceted response to a disaster

D. The survivability of the organization when faced with a disaster

B.

Personally determining what is critical to the organization

5. What must the planner avoid when developing a business continuity program?

A. Obtaining management support

B. Personally determining what is critical to the organization

C. Organizing and managing the project

D. Completing the project within agreed upon time and budget limits

A.

To communicate up to management, laterally to other programs, and down to project members

6. Why is it important to track and report project progress?

A. To communicate up to management, laterally to other programs, and down to project members

B. To conduct meetings to ensure that all members of the organization share responsibility in the project plan

C. To involve all organizational personnel in developing and adjusting scope

D. To validate that the planning team is sticking to the project plan

B.

A full description of the quality of the work completed by the project team

7. A presentation to leadership should avoid which of the following?

A. Data presentation charts

B. A full description of the quality of the work completed by the project team

C. Cost/Benefit slides

D. A full written report provided as a supplement to the presentation

A.

Entire organization

8.What should be the initial scope or focus when developing a BCM program?

A. Entire organization

B. IT / Information Systems

C. Financial Department

D. Critical business units

C.

Gain senior management commitment to project

9.What step needs to occur first in Program Initiation and Management

A. Develop a detailed project plan

B. Identify project objectives and risks

C. Gain senior management commitment to project

D. Establish framework of project

D.

Project planning

10.Planning, organizing and managing tasks and resources can best be described as...

A. Strategy development

B. Data gathering

C. Coordinating with external agencies

D. Project planning

A.

Reduction

11.Which of the following best describes the steps taken to identify and mitigate risk?

A. Reduction

B. Restoration

C. Recovery

D. Response

D.

Identifies risks, threats, vulnerabilities and the probability of them occurring to an organization

12.What is the benefit of performing a risk assessment and analysis?

A. Eliminates vulnerabilities to potential loss

B. Stabilizes the incident and provides for improved employee safety

C. Eliminates the impact of the threats to the organization

D. Identifies risks, threats, vulnerabilities and the probability of them occurring to an organization

A.

Suppliers of goods and services

13.Which of the following would be considered an external risk factor?

A. Suppliers of goods and services

B. Disgruntled employees

C. Employee drug screening

D. Clean desk policy procedures

D.

Clean desk policy procedures

14.Which of the following would be considered a control?

A. Loss of access to facilities

B. A tornado

C. Lack of fire suppression systems

D. Clean desk policy procedures

C.

To determine where mitigating factors should be implemented

15.The result of performing a risk analysis is

A. All risks are eliminated

B. All risk will be mitigated to prevent a disaster

C. To determine where mitigating factors should be implemented

D. To prevent a risk from occurring and causing a disaster

C.

To identify which business processes and assets require the highest level of protection, establishing priorities, and a time line

16.Which answer describes the purpose of a business impact analysis?

A. To calculate the probability of disruptions to the organization

B. To evaluate the effectiveness of existing controls and safeguards

C. To identify which business processes and assets require the highest level of protection, establishing priorities,

and a time line

D. To develop preparations and procedures for responding to a disaster

B.

Loss of employee morale

17.Which of the following is an example of a qualitative impact?

A. Loss of sales

B. Loss of employee morale

C. Loss of revenue due to penalties

D. Extra expense

C.

Loss of sales

18.Which of the following is an example of a quantitative impact?

A. Lower level of customer service

B. A disruption of quality assurance

C. Loss of sales

D. Reduced financial credibility

D.

Identifies threats from sabotage and/or terrorism and how to eliminate those threats using cost-effective controls.

19.Which of the following is NOT a result of conducting a BIA?

A. Identifies all essential business functions and operations and their critical dependencies.

B. Determines when the exposures and impacts begin and how they escalate over time.

C. Identifies the technology and workspace needs as well as potential unbudgeted expenses.

D. Identifies threats from sabotage and/or terrorism and how to eliminate those threats using cost-effective controls.

B.

Provides the facts upon which to develop strategies

20.What is primary purpose of conducting a Risk Evaluation and BIA?

A. Establishes the organizational structure

B. Provides the facts upon which to develop strategies

C. Decreases the chances of problems occurring during an emergency event

D. Ensures employee safety

A.

Protects viability of the organization by positioning it to respond quickly and appropriately in an emergency event

21.What is the purpose of developing recovery strategies?

A. Protects viability of the organization by positioning it to respond quickly and appropriately in an emergency event

B. Sufficiently exercises documented procedures

C. Positions organization to have zero downtime following an emergency event

D. Ensures procedures for verifying critical recovery resources are implemented and functioning properly

A.

Duplicate site/distributed workload

22.Which of the following would be considered an internal recovery strategy?

A. Duplicate site/distributed workload

B. Vendor hot site

C. Commercial recovery center

D. Supplier service level agreements

D.

Fully operational facility

23.Which of the following best describes a "Hot Site"?

A. Environmental infrastructure for technology operations

B. Agreement with a similar industry to provide recovery capabilities

C. Provides business services

D. Fully operational facility

A.

To compare the cost of the strategy with the risk to the organization

24.What is the purpose of conducting a cost/benefit analysis?

A. To compare the cost of the strategy with the risk to the organization

B. It is required for DRII certification

C. Management requires this information

D. It is a requirement for the budget

C.

A lower level of customer service

25.What statement describes a potential qualitative business impact?

A. The loss of market share

B. Extra expense incurred

C. A lower level of customer service

D. Penalties on the revenue stream

D.

One recovery strategy may recover multiple functional areas

26.What is the primary benefit of consolidating strategies?

A. Allows the organization to get better contracts with vendors

B. Builds consensus among different functional areas

C. Allows the support service strategies to handle all strategies

D. One recovery strategy may recover multiple functional areas

C.

Determine if the response is consistent with the request, the specifications of the RFP, and is supported by the BIA

27.When evaluating recovery proposals, it is important to:

A. Use "patented" terminology and check vendor references

B. Meet with the vendor several times to fully understand the proposal

C. Determine if the response is consistent with the request, the specifications of the RFP, and is supported by the BIA

D. Look primarily at vendors who service only customers in your regional area

C.

Attends to duties they are trained for; addresses the Board and critical customers

28.What is the role of an executive during an emergency event?

A. Orders the evacuation and shutdown of the facility

B. During a disaster, assists in the implementation of response and alternate operating strategies

C. Attends to duties they are trained for; addresses the Board and critical customers

D. Takes charge of emergency response activities

C.

The Crisis Management Team

29.Which team focuses on stabilizing and returning the organization to normal operations as quickly as possible after the plan has been activated and provides support and resources?

A. The Budget team

B. The Risk Management & Insurance Team

C. The Crisis Management Team

D. The Facilities and Finance Team

A.

To determine the severity level of an event and the appropriate response

30.What is the purpose of escalation procedures?

A. To determine the severity level of an event and the appropriate response

B. To select the appropriate recovery response for each potential cause of disruption

C. To mobilize the Crisis Management Team

D. To enable the organization to restore all business functions

D.

Minimize the exposure to loss of life and property

31.What is the most important purpose of emergency response procedures and plans?

A. Prevent/limit degradation to critical functions and services

B. Assure owners/investors that the organization is stable and all critical functions are recoverable

C. Continuation of the mission and objectives of the organization

D. Minimize the exposure to loss of life and property

B.

Establishing the location of shelter space or a safe room with emergency supplies

32.What is an example of a procedure that could protect lives?

A. Identification of personnel with authority to order an evacuation

B. Establishing the location of shelter space or a safe room with emergency supplies

C. Barricading doors and windows and maintaining security at the incident scene

D. Identification of emergency response providers

D.

A location where the Crisis Management Team provides support

33.The Emergency Operations Center provides...

A. A site for public agencies to manage the incident

B. A location for an evacuation rally point

C. A site for stabilizing the incident

D. A location where the Crisis Management Team provides support

A.

Provides dedicated, focused support in the areas of team members' particular experience and expertise

34.What is the benefit of the team approach during plan development?

A. Provides dedicated, focused support in the areas of team members' particular experience and expertise

B. Decreases the amount of time and energy invested by individuals in the effort

C. Ensures someone will always be available to develop the plan

D. Decreases the potential for a broad spectrum of opinions on issues

C.

It should fit the needs of the organization

35.Which answer best describes which plan design approach should be used?

A. It should be determined by the software tool being used

B. It is usually determined by the consulting team

C. It should fit the needs of the organization

D. It is determined by the critical processes of the organization

A.

Incident Management

36.In which section of the Business Continuity Plan should the Disaster Declaration guidelines be documented?

A. Incident Management

B. Critical Key Processes

C. Overview

D. Disaster Recovery Procedures

D.

Develop a Business Continuity Plan

37.After developing business continuity strategies and emergency response procedures, the next step is:

A. Conduct awareness and training

B. Perform a Risk Assessment

C. Develop a Business Impact Analysis report

D. Develop a Business Continuity Plan

C.

The average employee needs repeated exposure to gain understanding

38.Why should there be a sustained approach to training and awareness?

A. Long-term behavior will change with a short and focused approach

B. Job security for the trainer

C. The average employee needs repeated exposure to gain understanding

D. Change is resisted, training is not

C.

Understand the different audiences and take advantage of resources and methods already in place

39.When establishing a BCM awareness and training program, the planner should...

A. Keep BCM awareness and training programs separate from other organizational programs to lessen confusion

B. Ensure training is held annually

C. Understand the different audiences and take advantage of resources and methods already in place

D. Start a new, innovative program to get employees interested in BCM

B.

Explain the importance of why a BCM program is being developed

40.One goal for awareness programs to achieve is to

A. Establish an adequate training budget

B. Explain the importance of why a BCM program is being developed

C. Recruit team leaders for the more specialized training sessions

D. Introduce BCM terms into the organization to lessen confusion during plan development

D.

Evacuation, shelter and accountability procedures

41.What is an example of training activities in which all personnel should participate?

A. Hazardous materials cleanup

B. Project management training

C. Power down/power up procedures

D. Evacuation, shelter and accountability procedures

D.

Realistic & complicated enough to focus planning and exercising on issues that engage participants and exercise major components of the plan

42.In order for scenarios to be effective during an exercise, they need to be:

A. Simple enough to involve only one functional unit at a time

B. Broad enough to address many goals and objectives

C. Complex enough to make it difficult to solve

D. Realistic & complicated enough to focus planning and exercising on issues that engage participants and exercise major components of the plan

B.

Procedures, frequency and personnel responsible for making updates

43.A program for updating the plan should include:

A. The software tool that automatically makes the updates

B. Procedures, frequency and personnel responsible for making updates

C. The relevant plan owner who will make all decisions regarding plan

D. The template used to make the updates

C.

To be "Guardian or Steward" of the Business Continuity Plan

44.What is NOT the role of an internal or external auditor of the plan?

A. To work with the planner because both are concerned with the survivability of the organization

B. To audit the plan documentation and control procedures

C. To be "Guardian or Steward" of the Business Continuity Plan

D. To confirm that plan updates are completed and use these updates as audit points on the next exercise

C.

Once a year

45.At a minimum, how often should a business continuity plan be updated?

A. Once a month

B. Once a quarter

C. Once a year

D. Once every 2 years

C.

Damage assessment procedures

46.Which of the following elements would NOT be part of a crisis communication plan?

A. Call and emergency contact lists

B. Media contact log

C. Damage assessment procedures

D. Designated spokesperson(s)

A.

An intermediary between the spokesperson and the ultimate audience

47.Which answer best describes the role of the media?

A. An intermediary between the spokesperson and the ultimate audience

B. An adversary to the spokesperson for the organization

C. Are careful in judging the spokesperson's presentation style under pressure

D. Are always sensitive to the nature of an incident when reporting

A.

A trained media spokesperson

48.Who should communicate with the media during or after a disaster?

A. A trained media spokesperson

B. The CEO or highest executive

C. The Business Continuity Coordinator

D. The head of the public relations department

D.

The public sector is in charge until command is transferred to the private sector

49.During the height of an event...

A. The private sector complies with and supports the mission of the public sector

B. The public sector complies with and supports the mission of the private sector

C. The private sector is in charge while the public sector waits to be handed the control

D. The public sector is in charge until command is transferred to the private sector

B.

Stabilizing the event and protecting lives

50.The Fire department responding to an event is responsible for

A. Protecting your vital records

B. Stabilizing the event and protecting lives

C. Listening to your leaderships commands

D. Cleanup after the fire is extinguished