DRII CBCP Exam Latest Update with Verified Solutions

DRII CBCP Exam Latest Update with Verified Solutions 1. Being able to answer the question, "What is important to your business?" is part of what process? A. Gaining senior management support B. Getting an executive sponsor C. Developing a budget D. Defining a business continuity problem statement D. Defining a business continuity problem statement 2. What is the value of a BCM policy statement? A. It forces middle management to comply with senior directives B. It shows employees how to do their part in the planning process C. It shows management's commitment to BC planning process D. It provides senior management a direction in which to make future decisions C. It shows management's commitment to BC planning process 3. What would be evidence of management support for BCM? A. A steering committee that reports to the emergency response team B. An executive sponsor who reports to the damage assessment committee C. A project plan developed solely by the business continuity planner D. A BCM staff with a budget D. A BCM staff with a budget 4. What is a benefit to the organization of having an effective business continuity program? A. Internal disasters will not go unreported B. The business continuity program will relate to organizational mission, objectives, and operations C. Employees will be amazed at the organization's multi-faceted response to a disaster D. The survivability of the organization when faced with a disaster D. The survivability of the organization when faced with a disaster 5. What must the planner avoid when developing a business continuity program? A. Obtaining management support B. Personally determining what is critical to the organization C. Organizing and managing the project D. Completing the project within agreed upon time and budget limits B. Personally determining what is critical to the organization 6. Why is it important to track and report project progress? A. To communicate up to management, laterally to other programs, and down to project members B. To conduct meetings to ensure that all members of the organization share responsibility in the project plan C. To involve all organizational personnel in developing and adjusting scope D. To validate that the planning team is sticking to the project plan A. To communicate up to management, laterally to other programs, and down to project members 7. A presentation to leadership should avoid which of the following? A. Data presentation charts B. A full description of the quality of the work completed by the project team C. Cost/Benefit slides D. A full written report provided as a supplement to the presentation B. A full description of the quality of the work completed by the project team 8.What should be the initial scope or focus when developing a BCM program? A. Entire organization B. IT / Information Systems C. Financial Department D. Critical business units A. Entire organization 9.What step needs to occur first in Program Initiation and Management A. Develop a detailed project plan B. Identify project objectives and risks C. Gain senior management commitment to project D. Establish framework of project C. Gain senior management commitment to project 10.Planning, organizing and managing tasks and resources can best be described as... A. Strategy development B. Data gathering C. Coordinating with external agencies D. Project planning D. Project planning 11.Which of the following best describes the steps taken to identify and mitigate risk? A. Reduction B. Restoration C. Recovery D. Response A. Reduction 12.What is the benefit of performing a risk assessment and analysis? A. Eliminates vulnerabilities to potential loss B. Stabilizes the incident and provides for improved employee safety C. Eliminates the impact of the threats to the organization D. Identifies risks, threats, vulnerabilities and the probability of them occurring to an organization D. Identifies risks, threats, vulnerabilities and the probability of them occurring to an organization 13.Which of the following would be considered an external risk factor? A. Suppliers of goods and services B. Disgruntled employees C. Employee drug screening D. Clean desk policy procedures A. Suppliers of goods and services 14.Which of the following would be considered a control? A. Loss of access to facilities B. A tornado C. Lack of fire suppression systems D. Clean desk policy procedures D. Clean desk policy procedures 15.The result of performing a risk analysis is A. All risks are eliminated B. All risk will be mitigated to prevent a disaster C. To determine where mitigating factors should be implemented D. To prevent a risk from occurring and causing a disaster C. To determine where mitigating factors should be implemented 16.Which answer describes the purpose of a business impact analysis? A. To calculate the probability of disruptions to the organization B. To evaluate the effectiveness of existing controls and safeguards C. To identify which business processes and assets require the highest level of protection, establishing priorities, and a time line D. To develop preparations and procedures for responding to a disaster C. To identify which business processes and assets require the highest level of protection, establishing priorities, and a time line 17.Which of the following is an example of a qualitative impact? A. Loss of sales B. Loss of employee morale C. Loss of revenue due to penalties D. Extra expense B. Loss of employee morale 18.Which of the following is an example of a quantitative impact? A. Lower level of customer service B. A disruption of quality assurance C. Loss of sales D. Reduced financial credibility C. Loss of sales 19.Which of the following is NOT a result of conducting a BIA? A. Identifies all essential business functions and operations and their critical dependencies. B. Determines when the exposures and impacts begin and how they escalate over time. C. Identifies the technology and workspace needs as well as potential unbudgeted expenses. D. Identifies threats from sabotage and/or terrorism and how to eliminate those threats using cost-effective controls. D. Identifies threats from sabotage and/or terrorism and how to eliminate those threats using cost-effective controls. 20.What is primary purpose of conducting a Risk Evaluation and BIA? A. Establishes the organizational structure B. Provides the facts upon which to develop strategies C. Decreases the chances of problems occurring during an emergency event D. Ensures employee safety B. Provides the facts upon which to develop strategies 21.What is the purpose of developing recovery strategies? A. Protects viability of the organization by positioning it to respond quickly and appropriately in an emergency event B. Sufficiently exercises documented procedures C. Positions organization to have zero downtime following an emergency event D. Ensures procedures for verifying critical recovery resources are implemented and functioning properly A. Protects viability of the organization by positioning it to respond quickly and appropriately in an emergency event 22.Which of the following would be considered an internal recovery strategy? A. Duplicate site/distributed workload B. Vendor hot site C. Commercial recovery center D. Supplier service level agreements A. Duplicate site/distributed workload 23.Which of the following best describes a "Hot Site"? A. Environmental infrastructure for technology operations B. Agreement with a similar industry to provide recovery capabilities C. Provides business services D. Fully operational facility D. Fully operational facility 24.What is the purpose of conducting a cost/benefit analysis? A. To compare the cost of the strategy with the risk to the organization B. It is required for DRII certification C. Management requires this information D. It is a requirement for the budget A. To compare the cost of the strategy with the risk to the organization 25.What statement describes a potential qualitative business impact? A. The loss of market share B. Extra expense incurred C. A lower level of customer service D. Penalties on the revenue stream C. A lower level of customer service 26.What is the primary benefit of consolidating strategies? A. Allows the organization to get better contracts with vendors B. Builds consensus among different functional areas C. Allows the support service strategies to handle all strategies D. One recovery strategy may recover multiple functional areas D. One recovery strategy may recover multiple functional areas 27.When evaluating recovery proposals, it is important to: A. Use "patented" terminology and check vendor references B. Meet with the vendor several times to fully understand the proposal C. Determine if the response is consistent with the request, the specifications of the RFP, and is supported by the BIA D. Look primarily at vendors who service only customers in your regional area C. Determine if the response is consistent with the request, the specifications of the RFP, and is supported by the BIA 28.What is the role of an executive during an emergency event? A. Orders the evacuation and shutdown of the facility B. During a disaster, assists in the implementation of response and alternate operating strategies C. Attends to duties they are trained for; addresses the Board and critical customers D. Takes charge of emergency response activities C. Attends to duties they are trained for; addresses the Board and critical customers 29.Which team focuses on stabilizing and returning the organization to normal operations as quickly as possible after the plan has been activated and provides support and resources? A. The Budget team B. The Risk Management & Insurance Team C. The Crisis Management Team D. The Facilities and Finance Team C. The Crisis Management Team 30.What is the purpose of escalation procedures? A. To determine the severity level of an event and the appropriate response B. To select the appropriate recovery response for each potential cause of disruption C. To mobilize the Crisis Management Team D. To enable the organization to restore all business functions A. To determine the severity level of an event and the appropriate response 31.What is the most important purpose of emergency response procedures and plans? A. Prevent/limit degradation to critical functions and services B. Assure owners/investors that the organization is stable and all critical functions are recoverable C. Continuation of the mission and objectives of the organization D. Minimize the exposure to loss of life and property D. Minimize the exposure to loss of life and property 32.What is an example of a procedure that could protect lives? A. Identification of personnel with authority to order an evacuation B. Establishing the location of shelter space or a safe room with emergency supplies C. Barricading doors and windows and maintaining security at the incident scene D. Identification of emergency response providers B. Establishing the location of shelter space or a safe room with emergency supplies 33.The Emergency Operations Center provides... A. A site for public agencies to manage the incident B. A location for an evacuation rally point C. A site for stabilizing the incident D. A location where the Crisis Management Team provides support D. A location where the Crisis Management Team provides support 34.What is the benefit of the team approach during plan development? A. Provides dedicated, focused support in the areas of team members' particular experience and expertise B. Decreases the amount of time and energy invested by individuals in the effort C. Ensures someone will always be available to develop the plan D. Decreases the potential for a broad spectrum of opinions on issues A. Provides dedicated, focused support in the areas of team members' particular experience and expertise 35.Which answer best describes which plan design approach should be used? A. It should be determined by the software tool being used B. It is usually determined by the consulting team C. It should fit the needs of the organization D. It is determined by the critical processes of the organization C. It should fit the needs of the organization 36.In which section of the Business Continuity Plan should the Disaster Declaration guidelines be documented? A. Incident Management B. Critical Key Processes C. Overview D. Disaster Recovery Procedures A. Incident Management 37.After developing business continuity strategies and emergency response procedures, the next step is: A. Conduct awareness and training B. Perform a Risk Assessment C. Develop a Business Impact Analysis report D. Develop a Business Continuity Plan D. Develop a Business Continuity Plan 38.Why should there be a sustained approach to training and awareness? A. Long-term behavior will change with a short and focused approach B. Job security for the trainer C. The average employee needs repeated exposure to gain understanding D. Change is resisted, training is not C. The average employee needs repeated exposure to gain understanding 39.When establishing a BCM awareness and training program, the planner should... A. Keep BCM awareness and training programs separate from other organizational programs to lessen confusion B. Ensure training is held annually C. Understand the different audiences and take advantage of resources and methods already in place D. Start a new, innovative program to get employees interested in BCM C. Understand the different audiences and take advantage of resources and methods already in place 40.One goal for awareness programs to achieve is to A. Establish an adequate training budget B. Explain the importance of why a BCM program is being developed C. Recruit team leaders for the more specialized training sessions D. Introduce BCM terms into the organization to lessen confusion during plan development B. Explain the importance of why a BCM program is being developed 41.What is an example of training activities in which all personnel should participate? A. Hazardous materials cleanup B. Project management training C. Power down/power up procedures D. Evacuation, shelter and accountability procedures D. Evacuation, shelter and accountability procedures 42.In order for scenarios to be effective during an exercise, they need to be: A. Simple enough to involve only one functional unit at a time B. Broad enough to address many goals and objectives C. Complex enough to make it difficult to solve D. Realistic & complicated enough to focus planning and exercising on issues that engage participants and exercise major components of the plan D. Realistic & complicated enough to focus planning and exercising on issues that engage participants and exercise major components of the plan 43.A program for updating the plan should include: A. The software tool that automatically makes the updates B. Procedures, frequency and personnel responsible for making updates C. The relevant plan owner who will make all decisions regarding plan D. The template used to make the updates B. Procedures, frequency and personnel responsible for making updates 44.What is NOT the role of an internal or external auditor of the plan? A. To work with the planner because both are concerned with the survivability of the organization B. To audit the plan documentation and control procedures C. To be "Guardian or Steward" of the Business Continuity Plan D. To confirm that plan updates are completed and use these updates as audit points on the next exercise C. To be "Guardian or Steward" of the Business Continuity Plan 45.At a minimum, how often should a business continuity plan be updated? A. Once a month B. Once a quarter C. Once a year D. Once every 2 years C. Once a year 46.Which of the following elements would NOT be part of a crisis communication plan? A. Call and emergency contact lists B. Media contact log C. Damage assessment procedures D. Designated spokesperson(s) C. Damage assessment procedures 47.Which answer best describes the role of the media? A. An intermediary between the spokesperson and the ultimate audience B. An adversary to the spokesperson for the organization C. Are careful in judging the spokesperson's presentation style under pressure D. Are always sensitive to the nature of an incident when reporting A. An intermediary between the spokesperson and the ultimate audience 48.Who should communicate with the media during or after a disaster? A. A trained media spokesperson B. The CEO or highest executive C. The Business Continuity Coordinator D. The head of the public relations department A. A trained media spokesperson 49.During the height of an event... A. The private sector complies with and supports the mission of the public sector B. The public sector complies with and supports the mission of the private sector C. The private sector is in charge while the public sector waits to be handed the control D. The public sector is in charge until command is transferred to the private sector D. The public sector is in charge until command is transferred to the private sector 50.The Fire department responding to an event is responsible for A. Protecting your vital records B. Stabilizing the event and protecting lives C. Listening to your leaderships commands D. Cleanup after the fire is extinguished B. Stabilizing the event and protecting lives