DRII CBCP Actual Exam 2026/2027 |
Verified Questions
Disaster Recovery Institute International (DRII) | Verified
Q&A | Professional Business Continuity Candidates
Comprehensive 100-Question Original Actual Exam Set | 2026/2027
Introduction
This 2026/2027 comprehensive 100-question actual exam set provides original Professional certification
questions covering Program Initiation, Risk Assessment, and Business Impact Analysis, Business Continuity
Strategies and Plan Development, Incident Response, Crisis Communications, and External Agency Coordination,
and Plan Exercise, Audit, Maintenance, and Training Programs. The content is designed to reinforce official DRII
Professional Practices objectives for actual exam readiness and professional competency by strengthening
governance, impact analysis, risk treatment, recovery strategy selection, plan usability, crisis coordination,
communications, training, audit, and continual improvement. Each item includes Verified Questions with concise
rationales grounded in DRII Professional Practices for Business Continuity, ISO 22301 business continuity
management system concepts, and industry resilience frameworks.
Domain: Program Initiation, Risk Assessment, and Business Impact
Analysis
1. What is the primary purpose of obtaining executive sponsorship for a business continuity
program?
A. Secure authority, resources, and organizational alignment for the program
B. Replace the business impact analysis
C. Eliminate department participation
D. Avoid defining program scope
Correct Answer: A
Rationale: Executive sponsorship gives the program authority, funding, and cross-functional support
needed for sustainable implementation.
2. Which document best defines the boundaries, assumptions, objectives, and responsibilities of a
business continuity program?
A. Crisis press release
B. Program charter
C. Vendor invoice
D. Employee badge list
Correct Answer: B
Rationale: A program charter formally establishes scope, governance, roles, and objectives for business
continuity activities.
3. Which activity should occur early when setting business continuity governance?
A. Select recovery seats before requirements are known
B. Draft media statements before risks are identified
C. Define roles, committees, decision rights, and reporting relationships
D. Archive all existing plans without assessment
Correct Answer: C
DRII CBCP Actual Exam 2026/2027 | Verified Questions
, Rationale: Governance clarifies accountability and decision pathways before detailed continuity work
begins.
4. What is the main purpose of a business impact analysis?
A. Rank employees by seniority
B. Create a building floor plan only
C. Negotiate insurance premiums only
D. Identify time-sensitive activities, impacts, and recovery priorities
Correct Answer: D
Rationale: A BIA determines which activities are critical, the consequences of disruption, and recovery
requirements.
5. Which BIA metric identifies the maximum tolerable time before an activity must be restored?
A. Recovery Time Objective
B. Recovery Point Objective
C. Mean Time Between Failure
D. Return on Investment
Correct Answer: A
Rationale: RTO states the targeted time frame for resuming an activity after disruption.
6. Which BIA metric identifies the maximum acceptable data loss measured in time?
A. Recovery Time Objective
B. Recovery Point Objective
C. Minimum Business Continuity Objective
D. Maximum Tolerable Downtime only
Correct Answer: B
Rationale: RPO specifies how current information must be when systems or records are restored.
7. Which BIA output is most useful for prioritizing recovery sequence?
A. A list of office decorations
B. A map of employee parking spaces
C. Ranked critical activities with time-based requirements
D. A general mission slogan
Correct Answer: C
Rationale: Prioritized activities and time objectives guide the order and urgency of recovery efforts.
8. What does Maximum Tolerable Period of Disruption describe?
A. The shortest vendor contract term
B. The duration of a training class
C. The time needed to print badges
D. The longest period an organization can tolerate disruption before unacceptable impact
Correct Answer: D
Rationale: MTPD defines the outer limit of disruption tolerance before severe consequences occur.
9. Which information should a BIA collect about dependencies?
A. Required people, facilities, technology, suppliers, records, and upstream or downstream processes
B. Only office furniture colors
C. Only cafeteria menus
D. Only public website logos
Correct Answer: A
Rationale: Dependency data identifies what each activity needs to resume and what other functions rely on
it.
10. Which impact category is commonly assessed in a BIA?
A. Only employee birthdays
B. Financial, operational, legal, reputational, and customer impacts
C. Only building age
D. Only computer monitor size
DRII CBCP Actual Exam 2026/2027 | Verified Questions
, Correct Answer: B
Rationale: Multiple impact types show how disruption affects organizational obligations and value.
11. Which approach best improves BIA data quality?
A. Rely only on unverified assumptions
B. Ask one department to speak for all areas
C. Use structured interviews, questionnaires, workshops, and validation with process owners
D. Skip management signoff
Correct Answer: C
Rationale: Structured collection and validation improve consistency and credibility of BIA results.
12. What is the main goal of a risk assessment in business continuity?
A. Set holiday schedules
B. Assign office seating
C. Write final invoices
D. Identify threats, vulnerabilities, likelihood, and potential consequences
Correct Answer: D
Rationale: Risk assessment evaluates disruptive scenarios so risk treatment and continuity strategies can be
selected.
13. Which term describes a weakness that could be exploited by a threat?
A. Vulnerability
B. Capability
C. Objective
D. Milestone
Correct Answer: A
Rationale: A vulnerability is a gap or weakness that increases exposure to disruptive events.
14. Which term describes an event source that could cause harm or disruption?
A. Control owner
B. Threat
C. Procedure note
D. Recovery seat
Correct Answer: B
Rationale: A threat is a potential cause of disruption, such as cyberattack, flood, outage, or supplier failure.
15. Which risk treatment option involves reducing likelihood or impact through controls?
A. Acceptance only
B. Transfer only
C. Mitigation
D. Documentation only
Correct Answer: C
Rationale: Mitigation uses measures that reduce probability, impact, or both.
16. Which risk treatment option involves using insurance or contract terms to shift financial
exposure?
A. Avoidance only
B. Monitoring only
C. Exercise design
D. Transfer
Correct Answer: D
Rationale: Risk transfer shifts some financial consequence to another party but does not remove operational
responsibility.
17. Which risk treatment option means stopping an activity because the risk is unacceptable?
A. Avoidance
B. Acceptance
C. Transfer
DRII CBCP Actual Exam 2026/2027 | Verified Questions
Verified Questions
Disaster Recovery Institute International (DRII) | Verified
Q&A | Professional Business Continuity Candidates
Comprehensive 100-Question Original Actual Exam Set | 2026/2027
Introduction
This 2026/2027 comprehensive 100-question actual exam set provides original Professional certification
questions covering Program Initiation, Risk Assessment, and Business Impact Analysis, Business Continuity
Strategies and Plan Development, Incident Response, Crisis Communications, and External Agency Coordination,
and Plan Exercise, Audit, Maintenance, and Training Programs. The content is designed to reinforce official DRII
Professional Practices objectives for actual exam readiness and professional competency by strengthening
governance, impact analysis, risk treatment, recovery strategy selection, plan usability, crisis coordination,
communications, training, audit, and continual improvement. Each item includes Verified Questions with concise
rationales grounded in DRII Professional Practices for Business Continuity, ISO 22301 business continuity
management system concepts, and industry resilience frameworks.
Domain: Program Initiation, Risk Assessment, and Business Impact
Analysis
1. What is the primary purpose of obtaining executive sponsorship for a business continuity
program?
A. Secure authority, resources, and organizational alignment for the program
B. Replace the business impact analysis
C. Eliminate department participation
D. Avoid defining program scope
Correct Answer: A
Rationale: Executive sponsorship gives the program authority, funding, and cross-functional support
needed for sustainable implementation.
2. Which document best defines the boundaries, assumptions, objectives, and responsibilities of a
business continuity program?
A. Crisis press release
B. Program charter
C. Vendor invoice
D. Employee badge list
Correct Answer: B
Rationale: A program charter formally establishes scope, governance, roles, and objectives for business
continuity activities.
3. Which activity should occur early when setting business continuity governance?
A. Select recovery seats before requirements are known
B. Draft media statements before risks are identified
C. Define roles, committees, decision rights, and reporting relationships
D. Archive all existing plans without assessment
Correct Answer: C
DRII CBCP Actual Exam 2026/2027 | Verified Questions
, Rationale: Governance clarifies accountability and decision pathways before detailed continuity work
begins.
4. What is the main purpose of a business impact analysis?
A. Rank employees by seniority
B. Create a building floor plan only
C. Negotiate insurance premiums only
D. Identify time-sensitive activities, impacts, and recovery priorities
Correct Answer: D
Rationale: A BIA determines which activities are critical, the consequences of disruption, and recovery
requirements.
5. Which BIA metric identifies the maximum tolerable time before an activity must be restored?
A. Recovery Time Objective
B. Recovery Point Objective
C. Mean Time Between Failure
D. Return on Investment
Correct Answer: A
Rationale: RTO states the targeted time frame for resuming an activity after disruption.
6. Which BIA metric identifies the maximum acceptable data loss measured in time?
A. Recovery Time Objective
B. Recovery Point Objective
C. Minimum Business Continuity Objective
D. Maximum Tolerable Downtime only
Correct Answer: B
Rationale: RPO specifies how current information must be when systems or records are restored.
7. Which BIA output is most useful for prioritizing recovery sequence?
A. A list of office decorations
B. A map of employee parking spaces
C. Ranked critical activities with time-based requirements
D. A general mission slogan
Correct Answer: C
Rationale: Prioritized activities and time objectives guide the order and urgency of recovery efforts.
8. What does Maximum Tolerable Period of Disruption describe?
A. The shortest vendor contract term
B. The duration of a training class
C. The time needed to print badges
D. The longest period an organization can tolerate disruption before unacceptable impact
Correct Answer: D
Rationale: MTPD defines the outer limit of disruption tolerance before severe consequences occur.
9. Which information should a BIA collect about dependencies?
A. Required people, facilities, technology, suppliers, records, and upstream or downstream processes
B. Only office furniture colors
C. Only cafeteria menus
D. Only public website logos
Correct Answer: A
Rationale: Dependency data identifies what each activity needs to resume and what other functions rely on
it.
10. Which impact category is commonly assessed in a BIA?
A. Only employee birthdays
B. Financial, operational, legal, reputational, and customer impacts
C. Only building age
D. Only computer monitor size
DRII CBCP Actual Exam 2026/2027 | Verified Questions
, Correct Answer: B
Rationale: Multiple impact types show how disruption affects organizational obligations and value.
11. Which approach best improves BIA data quality?
A. Rely only on unverified assumptions
B. Ask one department to speak for all areas
C. Use structured interviews, questionnaires, workshops, and validation with process owners
D. Skip management signoff
Correct Answer: C
Rationale: Structured collection and validation improve consistency and credibility of BIA results.
12. What is the main goal of a risk assessment in business continuity?
A. Set holiday schedules
B. Assign office seating
C. Write final invoices
D. Identify threats, vulnerabilities, likelihood, and potential consequences
Correct Answer: D
Rationale: Risk assessment evaluates disruptive scenarios so risk treatment and continuity strategies can be
selected.
13. Which term describes a weakness that could be exploited by a threat?
A. Vulnerability
B. Capability
C. Objective
D. Milestone
Correct Answer: A
Rationale: A vulnerability is a gap or weakness that increases exposure to disruptive events.
14. Which term describes an event source that could cause harm or disruption?
A. Control owner
B. Threat
C. Procedure note
D. Recovery seat
Correct Answer: B
Rationale: A threat is a potential cause of disruption, such as cyberattack, flood, outage, or supplier failure.
15. Which risk treatment option involves reducing likelihood or impact through controls?
A. Acceptance only
B. Transfer only
C. Mitigation
D. Documentation only
Correct Answer: C
Rationale: Mitigation uses measures that reduce probability, impact, or both.
16. Which risk treatment option involves using insurance or contract terms to shift financial
exposure?
A. Avoidance only
B. Monitoring only
C. Exercise design
D. Transfer
Correct Answer: D
Rationale: Risk transfer shifts some financial consequence to another party but does not remove operational
responsibility.
17. Which risk treatment option means stopping an activity because the risk is unacceptable?
A. Avoidance
B. Acceptance
C. Transfer
DRII CBCP Actual Exam 2026/2027 | Verified Questions
