DRII CBCP EXAM (2026/2027) | STUDY SET
WITH 100% VERIFIED SOLUTIONS
Disaster Recovery Institute International (DRII) Certified Business Continuity Professional
(CBCP) Certification Examination | Core Domains: Business Continuity (BC) Program
Initiation & Management, Risk Assessment & Business Impact Analysis (BIA), Business
Continuity Strategies & Solutions, Incident Response & Crisis Management, Plan Development
& Implementation, Awareness & Training Programs, Exercise, Audit & Maintenance, and
Coordination with External Agencies | Business Continuity Professional Certification Focus |
Global Certification Exam Format
Exam Structure
The DRII CBCP certification exam for the 2026/2027 cycle is a 100-question, multiple-choice
question (MCQ) examination.
Introduction
This DRII CBCP Exam study set for the 2026/2027 cycle prepares professionals for the
international certification examination in business continuity. The content tests mastery of the
ten professional practices outlined by DRII, focusing on the methodologies to develop,
implement, and maintain a comprehensive business continuity program that ensures
organizational resilience and recovery from disruptions.
Answer Format
All correct answers and business continuity principles must be presented in bold and green,
followed by detailed rationales that reference DRII's Professional Practices, explain the steps of
the BCM lifecycle (e.g., BIA, strategy development, plan exercise), and apply industry standards
(e.g., ISO 22301) to practical business continuity scenarios.
Full 100-Question DRII CBCP Exam Study Set
1. Which of the following is the primary purpose of a Business Impact Analysis (BIA)?
A. To identify external threats to the organization
B. To determine the criticality and recovery priorities of business functions
C. To select alternate recovery sites
D. To train crisis management teams
,According to DRII Professional Practice 3, the BIA identifies and prioritizes critical business
functions based on their impact over time. It quantifies financial, operational, regulatory, and
reputational impacts to establish Recovery Time Objectives (RTOs) and Recovery Point
Objectives (RPOs). Thus, To determine the criticality and recovery priorities of
business functions is correct.
2. What is the first step in initiating a Business Continuity Management (BCM) program?
A. Conducting a risk assessment
B. Obtaining executive management support and commitment
C. Developing business continuity plans
D. Performing a BIA
DRII Professional Practice 1 emphasizes that successful BCM programs require executive
sponsorship. Without leadership buy-in, resource allocation, policy enforcement, and cultural
integration will fail. Therefore, Obtaining executive management support and
commitment is the foundational first step.
3. Which standard provides the international framework for Business Continuity Management
Systems (BCMS)?
A. ISO 9001
B. NIST SP 800-34
C. ISO 22301
D. NFPA 1600
ISO 22301 is the globally recognized standard for BCMS, specifying requirements for
planning, establishing, implementing, operating, monitoring, reviewing, maintaining, and
continually improving a BCMS. It aligns closely with DRII’s professional practices.
4. What is the primary goal of a risk assessment in BCM?
A. To calculate insurance premiums
B. To identify potential threats and vulnerabilities that could disrupt critical
operations
,C. To prioritize employee training needs
D. To replace the BIA
Per DRII Professional Practice 2, risk assessment identifies natural, technological, and
human-caused threats and evaluates their likelihood and potential impact. This informs
mitigation strategies and complements the BIA. Hence, To identify potential threats and
vulnerabilities that could disrupt critical operations is correct.
5. Which term defines the maximum tolerable period of disruption for a business process?
A. Recovery Point Objective (RPO)
B. Maximum Tolerable Period of Disruption (MTPD)
C. Recovery Time Objective (RTO)
D. Service Delivery Target (SDT)
MTPD is the maximum time a business process can be disrupted before the impact becomes
unacceptable. RTO is the target time to restore the process, which must be less than the MTPD.
Therefore, Maximum Tolerable Period of Disruption (MTPD) is the correct definition.
6. Who should be included in the Business Continuity Steering Committee?
A. Only IT personnel
B. Senior leaders from key business units and support functions
C. External vendors only
D. Frontline employees exclusively
The Steering Committee provides governance and strategic direction. DRII recommends it
include senior leaders from key business units and support functions to ensure
cross-functional alignment, resource allocation, and accountability.
7. What is the primary purpose of a Business Continuity Plan (BCP)?
A. To replace insurance policies
, B. To provide documented procedures for responding to and recovering from
disruptions
C. To eliminate all risks
D. To serve as a legal contract with vendors
A BCP outlines roles, responsibilities, and step-by-step actions to maintain or restore critical
operations during a disruption. As per DRII Professional Practice 5, its purpose is to provide
documented procedures for responding to and recovering from disruptions.
8. Which of the following best describes a "work area recovery" strategy?
A. Using cloud-based email only
B. Providing temporary workspace with necessary technology and communications
for staff
C. Outsourcing all business functions permanently
D. Shutting down non-critical operations indefinitely
Work area recovery involves securing alternate facilities (e.g., hot sites, office space) equipped
with desks, phones, computers, and network access so employees can resume critical tasks.
Thus, Providing temporary workspace with necessary technology and
communications for staff is correct.
9. What is the role of the Crisis Management Team (CMT)?
A. To perform daily IT backups
B. To make strategic decisions, manage external communications, and oversee the
response to a major incident
C. To conduct employee payroll during outages
D. To write software code for recovery systems
The CMT is responsible for high-level decision-making during a crisis, including public
messaging, regulatory reporting, and resource mobilization. Per DRII Professional Practice 4,
To make strategic decisions, manage external communications, and oversee the
response to a major incident defines its role.
WITH 100% VERIFIED SOLUTIONS
Disaster Recovery Institute International (DRII) Certified Business Continuity Professional
(CBCP) Certification Examination | Core Domains: Business Continuity (BC) Program
Initiation & Management, Risk Assessment & Business Impact Analysis (BIA), Business
Continuity Strategies & Solutions, Incident Response & Crisis Management, Plan Development
& Implementation, Awareness & Training Programs, Exercise, Audit & Maintenance, and
Coordination with External Agencies | Business Continuity Professional Certification Focus |
Global Certification Exam Format
Exam Structure
The DRII CBCP certification exam for the 2026/2027 cycle is a 100-question, multiple-choice
question (MCQ) examination.
Introduction
This DRII CBCP Exam study set for the 2026/2027 cycle prepares professionals for the
international certification examination in business continuity. The content tests mastery of the
ten professional practices outlined by DRII, focusing on the methodologies to develop,
implement, and maintain a comprehensive business continuity program that ensures
organizational resilience and recovery from disruptions.
Answer Format
All correct answers and business continuity principles must be presented in bold and green,
followed by detailed rationales that reference DRII's Professional Practices, explain the steps of
the BCM lifecycle (e.g., BIA, strategy development, plan exercise), and apply industry standards
(e.g., ISO 22301) to practical business continuity scenarios.
Full 100-Question DRII CBCP Exam Study Set
1. Which of the following is the primary purpose of a Business Impact Analysis (BIA)?
A. To identify external threats to the organization
B. To determine the criticality and recovery priorities of business functions
C. To select alternate recovery sites
D. To train crisis management teams
,According to DRII Professional Practice 3, the BIA identifies and prioritizes critical business
functions based on their impact over time. It quantifies financial, operational, regulatory, and
reputational impacts to establish Recovery Time Objectives (RTOs) and Recovery Point
Objectives (RPOs). Thus, To determine the criticality and recovery priorities of
business functions is correct.
2. What is the first step in initiating a Business Continuity Management (BCM) program?
A. Conducting a risk assessment
B. Obtaining executive management support and commitment
C. Developing business continuity plans
D. Performing a BIA
DRII Professional Practice 1 emphasizes that successful BCM programs require executive
sponsorship. Without leadership buy-in, resource allocation, policy enforcement, and cultural
integration will fail. Therefore, Obtaining executive management support and
commitment is the foundational first step.
3. Which standard provides the international framework for Business Continuity Management
Systems (BCMS)?
A. ISO 9001
B. NIST SP 800-34
C. ISO 22301
D. NFPA 1600
ISO 22301 is the globally recognized standard for BCMS, specifying requirements for
planning, establishing, implementing, operating, monitoring, reviewing, maintaining, and
continually improving a BCMS. It aligns closely with DRII’s professional practices.
4. What is the primary goal of a risk assessment in BCM?
A. To calculate insurance premiums
B. To identify potential threats and vulnerabilities that could disrupt critical
operations
,C. To prioritize employee training needs
D. To replace the BIA
Per DRII Professional Practice 2, risk assessment identifies natural, technological, and
human-caused threats and evaluates their likelihood and potential impact. This informs
mitigation strategies and complements the BIA. Hence, To identify potential threats and
vulnerabilities that could disrupt critical operations is correct.
5. Which term defines the maximum tolerable period of disruption for a business process?
A. Recovery Point Objective (RPO)
B. Maximum Tolerable Period of Disruption (MTPD)
C. Recovery Time Objective (RTO)
D. Service Delivery Target (SDT)
MTPD is the maximum time a business process can be disrupted before the impact becomes
unacceptable. RTO is the target time to restore the process, which must be less than the MTPD.
Therefore, Maximum Tolerable Period of Disruption (MTPD) is the correct definition.
6. Who should be included in the Business Continuity Steering Committee?
A. Only IT personnel
B. Senior leaders from key business units and support functions
C. External vendors only
D. Frontline employees exclusively
The Steering Committee provides governance and strategic direction. DRII recommends it
include senior leaders from key business units and support functions to ensure
cross-functional alignment, resource allocation, and accountability.
7. What is the primary purpose of a Business Continuity Plan (BCP)?
A. To replace insurance policies
, B. To provide documented procedures for responding to and recovering from
disruptions
C. To eliminate all risks
D. To serve as a legal contract with vendors
A BCP outlines roles, responsibilities, and step-by-step actions to maintain or restore critical
operations during a disruption. As per DRII Professional Practice 5, its purpose is to provide
documented procedures for responding to and recovering from disruptions.
8. Which of the following best describes a "work area recovery" strategy?
A. Using cloud-based email only
B. Providing temporary workspace with necessary technology and communications
for staff
C. Outsourcing all business functions permanently
D. Shutting down non-critical operations indefinitely
Work area recovery involves securing alternate facilities (e.g., hot sites, office space) equipped
with desks, phones, computers, and network access so employees can resume critical tasks.
Thus, Providing temporary workspace with necessary technology and
communications for staff is correct.
9. What is the role of the Crisis Management Team (CMT)?
A. To perform daily IT backups
B. To make strategic decisions, manage external communications, and oversee the
response to a major incident
C. To conduct employee payroll during outages
D. To write software code for recovery systems
The CMT is responsible for high-level decision-making during a crisis, including public
messaging, regulatory reporting, and resource mobilization. Per DRII Professional Practice 4,
To make strategic decisions, manage external communications, and oversee the
response to a major incident defines its role.
