CBCI Certificate of the Business Continuity Institute

When defining the scope of a BCMS, what should be stated first?

• AWhich products, services, activities, sites, and entities are covered by the BCMS
• BThe exact dates of every future exercise for the year
• CThe full list of recovery vendors that might be used
• DThe step-by-step actions each team will take during an incident

Who should approve the organization's BCM policy?

• ATop management
• BAny department manager with an operational role
• CThe external auditor
• DThe exercise facilitator

What is the primary role of a BC sponsor or steering group within the BCMS?

• AProvide direction, remove blockers, and ensure resources and priorities stay aligned
• BWrite every business continuity plan personally
• CTake over all incident command responsibilities during disruptions
• DPerform the organization's internal audit of BCM controls

A BCM programme plan should sequence work primarily according to what?

• ABusiness priorities, dependencies, and the maturity of current capabilities
• BAlphabetical order of departments
• CThe departments with the largest headcount
• DThe renewal dates of office software licenses

How should regulatory and contractual continuity requirements be used in a BCMS?

• ATranslate them into BCMS requirements and controls that fit the organization's context
• BTreat them as a complete substitute for business impact analysis
• CApply them only after a major disruption has happened
• DDelegate them entirely to a key outsourced provider

Which governance artifact best demonstrates ongoing BCMS oversight by management?

• AManagement review records showing decisions, actions, owners, and follow-up
• BA one-time launch email announcing the programme
• CAn office floor plan for the recovery site
• DA raw attendance sheet from a single awareness session

If a shared service supports both in-scope and out-of-scope products, how should it usually be treated in the BCMS?

• ATreat it as a dependency and include the relevant interfaces and controls needed for in-s…
• BExclude it entirely because not every service user is in scope
• CExpand the BCMS immediately so every organizational activity becomes in scope
• DIgnore it until an external audit specifically asks about it

When BCM activities are supported by an external consultant, accountability for the BCMS remains with whom?

• AThe organization's management
• BThe consultant delivering the BCM project
• CThe insurer covering operational losses
• DThe regulator for the sector

What is the main purpose of a formal BCMS management review?

• ADecide whether the BCMS remains suitable, adequate, and effective, and what changes are r…
• BApprove every emergency contact list line by line
• CRerun all completed exercises from the prior year
• DReplace the organization's risk assessment process

Why should BCM stakeholders be mapped early in the programme?

• ASo expectations, inputs, approvals, and communications can be tailored to the right audie…
• BSo BIA interviews can be skipped entirely
• CSo executive sponsorship becomes less important
• DSo the budget is guaranteed before analysis begins

What best distinguishes BCM awareness from BCM training?

• AAwareness builds broad understanding, while training develops role-specific knowledge and…
• BAwareness is only for executives, while training is only for frontline staff
• CAwareness is mandatory, while training is always optional
• DAwareness and training mean the same thing in BCM

In a BCM programme rollout, the communication plan should primarily do what?

• AExplain why BCM matters, what is changing, and what each audience is expected to do
• BPublish every detailed recovery procedure to all staff at once
• CAvoid mentioning responsibilities until the first real incident occurs
• DFocus only on external media messaging

What is the best evidence that a crisis management team member is competent in their role?

• AThey have performed the role in training or exercises and any gaps have been addressed
• BThey attended the initial programme kickoff meeting
• CThey volunteered for the role without any practice
• DThey have worked for the organization a long time in an unrelated function

To embed BCM into organizational change management, project governance should require what?

• AAssessment of continuity impacts when products, processes, sites, suppliers, or technolog…
• BA review only after the project has fully gone live
• CBCM checks only for pure IT disaster recovery projects
• DNo BCM review for supplier or location changes

Which message is most likely to win middle management support for BCM?

• ABCM protects priority services and clarifies the local responsibilities needed to keep th…
• BBCM matters mainly because external consultants recommended it
• CBCM can be left entirely to the crisis team
• DBCM is useful only if there is a declared corporate crisis

Which approach is best for reminding named continuity role holders of their responsibilities before a forecast severe weather event?

• ASend a targeted multi-channel briefing to the specific role holders and alternates
• BRely only on a poster in a common area
• CMention the issue in the next annual report
• DWait until the disruption occurs and then explain roles

Which sign most strongly indicates that BCM is becoming part of organizational culture?

• AManagers routinely include continuity considerations in planning, changes, exercises, and…
• BThe BCM policy is stored on the intranet homepage
• CThe organization held a well-attended launch event once
• DEmployees can recognize the BCM logo on posters

What should BCM training records demonstrate?

• AWho was trained, for which role or topic, and when refreshers are due
• BWho attended lunch during the training day
• CWhat each participant thinks about all other corporate policies
• DWhich insurer will cover the next disruption

In a business impact analysis, what should be identified before deciding on recovery options?

• AThe organization's critical products, services, activities, and required timeframes
• BThe brand of laptops to buy for emergency use
• CThe final media statement for any future incident
• DThe names of all possible external auditors

What does maximum tolerable period of disruption (MTPD) describe?

• AThe longest period an activity can be unavailable before impacts become unacceptable
• BThe target time by which systems should ideally be recovered
• CThe preferred downtime for maintenance windows
• DThe repair commitment written into a supplier service desk contract

Why should dependencies be captured during BIA interviews?

• ATo understand which people, technology, sites, data, suppliers, and upstream services rec…
• BTo replace the need for a separate risk assessment
• CTo focus only on IT applications and ignore all other resources
• DTo avoid documenting any cross-functional handoffs

What is the purpose of a business continuity risk assessment?

• AEvaluate disruption threats and vulnerabilities so treatment priorities can be set
• BProve that every continuity plan already works perfectly
• CDecide the monthly payroll schedule for staff
• DCreate the organization's call tree without analyzing risks

Which impact measure is most useful for setting recovery priorities in a BIA?

• AA time-phased view showing how impacts escalate as outage duration increases
• BOnly the annual revenue of the department involved
• CThe number of people employed in the function
• DThe monthly rent of the primary office

Which statement best links recovery time objectives to resource requirements?

• AThe chosen recovery time should be supported by the minimum resources and dependencies ne…
• BEvery activity should be given the same recovery time regardless of need
• CResources should be considered only after a disruption is declared
• DRecovery times should be set by the facilities team alone

If a critical activity depends on a shared identity service, what should the BIA capture?

• AThat dependency and the recovery assumptions needed for the shared service to support the…
• BAn assumption that the identity service will always be available
• CA note to ignore the issue because identity is managed centrally
• DOnly the names of the software developers who built the service

For a ransomware scenario, a BC-focused risk assessment should emphasize what?

• AHow disruption could affect business operations over time, current controls, and residual…
• BOnly the list of malware signatures detected by endpoint tools
• COnly the amount of cyber insurance purchased
• DOnly the wording of the first external media response

What is the primary test of a proposed business continuity strategy?

• AWhether it meets recovery requirements within acceptable cost, complexity, and risk
• BWhether it is the most technologically advanced option available
• CWhether it uses the same vendor as the prior year
• DWhether it requires the largest capital budget

When selecting a work-area strategy for a customer service team, what should be considered first?

• AThe service volume, required recovery timeframe, and minimum staffing needed to maintain…
• BThe preferred office furniture style of the team
• CWhich building has the newest paint and decor
• DWhich site is closest to the chief executive's office

Which pairing is most appropriate when designing a data recovery strategy?

• ABackup or replication design aligned to the RPO, and restoration capability aligned to th…
• BAntivirus software aligned to the payroll calendar
• CLaptop model selection aligned to the office seating plan
• DEvacuation maps aligned to the annual training schedule

What is the strongest mitigation for a single-source supplier that supports a critical activity?

• AA qualified alternate source or contingency arrangement tested against required lead times
• BAn annual thank-you letter to maintain goodwill
• CLonger payment terms to improve cash flow
• DA verbal promise from the supplier that disruption is unlikely

What should escalation criteria achieve in a response structure?

• AShow when local incident handling should become coordinated crisis or continuity manageme…
• BEnsure every issue is escalated to the chief executive immediately
• CEliminate the need for any team leader judgment
• DDelay decision-making until all facts are known

A remote-working continuity strategy is weak when it does what?

• AAssumes all staff can work from home without checking capacity, access, and task suitabil…
• BConfirms that remote access capacity has been tested
• CDefines minimum staffing and supervision arrangements
• DIdentifies which activities can and cannot be performed remotely

Why should role interfaces between incident, crisis, and recovery teams be clearly defined?

• ATo avoid duplicated decisions, missed handoffs, and gaps as an event evolves
• BTo ensure each message must be approved by every team
• CTo remove the need for deputies or alternates
• DTo make exercises shorter by reducing the number of participants

After several possible continuity strategies have been identified, what should the organization compare next?

• ACapability, assumptions, implementation effort, and residual risk against the stated requ…
• BWhich option has the lowest price with no other analysis
• CWhich option the current vendor prefers to sell
• DWhich option produces the longest written document

What most makes a business continuity plan usable under stress?

• AClear activation criteria, roles, actions, and current contact and dependency information
• BLengthy background text on every historical incident
• CA complex layout that requires special software to open
• DA requirement to read the entire document before taking any action

Who should be able to invoke a business continuity plan?

• APre-authorized role holders with clear criteria and escalation paths
• BAny employee who notices something unusual
• COnly the external auditor
• DWhichever supplier first calls the organization

What should the first external crisis communication after a disruption usually do?

• AAcknowledge known facts, protect credibility, and avoid speculation while more informatio…
• BProvide estimated recovery times even when they are not evidence-based
• CAssign blame to whichever third party seems most likely responsible
• DWait silently until every detail is confirmed

What is the best evidence that an alternate work area is truly ready for use?

• ARequired equipment, access, connectivity, and support resources have been provisioned and…
• BThe lease agreement has been signed
• CThe site brochure lists all the available rooms
• DA manager visited the location once during the year

Manual workaround instructions should focus mainly on what?

• ACritical outputs, minimum data needed, control points, and how to re-enter normal process…
• BEvery nonessential feature of the original process
• CThe interior layout of the main office
• DMarketing campaign content for the next quarter

Why should incident response and BC plan invocation be integrated?

• ABecause technical containment and business recovery decisions influence each other early…
• BBecause integration removes the need for escalation criteria
• CBecause integration means no incident log is required
• DBecause business continuity should replace crisis management entirely

How should continuity contact lists be maintained?

• AAs controlled information with named owners, review triggers, and accessible copies
• BOnly after a major exercise has exposed a problem
• CIn a single manager's email inbox with no backup location
• DBy recreating them from memory during a disruption

What is a common failure when implementing recovery solutions?

• ABuying tools or space without ensuring people, data, procedures, access rights, and suppl…
• BCapturing too many lessons learned after exercises
• CApproving the budget before final invoicing
• DScheduling awareness sessions for new role holders

What is a tabletop exercise best used for?

• ADiscussing roles, decisions, assumptions, and coordination in a facilitated scenario
• BProving the full technical failover performance of every production system
• CReplacing all plan reviews and updates for the year
• DMeasuring public relations sentiment on social media

How does a simulation exercise differ from a tabletop exercise?

• AIt introduces dynamic inputs and expects participants to act and communicate as the event…
• BIt has no objectives because realism is enough
• CIt never includes observers or evaluators
• DIt replaces the need for plan maintenance afterward

After an exercise, what is the highest-priority output?

• AActionable observations with owners, due dates, and follow-up tracking
• BA celebratory email thanking everyone for participating
• CA new organization chart unrelated to the scenario
• DThe catering invoice for the event

What does internal audit provide that continuity exercises do not?

• AIndependent assurance that governance and controls are designed and operating as intended
• BOperational command over the organization's crisis team
• CGuaranteed capacity at the alternate recovery site
• DDirect control of the organization's media response

Which BCM metric is most useful to senior management?

• AA measure showing readiness or gap closure against critical requirements and agreed actio…
• BThe total number of intranet page views for the BCM policy
• CThe number of coffee briefings held in the last quarter
• DThe number of decorative posters displayed in offices