CBCP Certified Business Continuity Professional

What is the primary purpose of a business continuity policy approved by senior management?

• ATo replace department recovery procedures
• BTo establish executive direction, authority, and expectations for the continuity program
• CTo document every step of each technical recovery script
• DTo serve as the organization’s vendor contract template

A continuity manager is drafting a program charter. Which element is most important to include?

• AA detailed media script for public statements
• BThe program’s scope, roles, objectives, and governance structure
• CA list of all employee vacation balances
• DA line-by-line server backup log

A department head keeps delaying BIA interviews because continuity work is not in the annual budget. Which action best reflects strong program sponsorship?

• ACancel the interviews until next fiscal year
• BAsk the help desk to complete the BIA instead
• CHave the executive sponsor reinforce priorities and resource expectations with the depart…
• DRemove the department from the continuity program permanently

Which metric would be most useful for reporting continuity-program health to senior leadership?

• AThe color of emergency flip charts in each office
• BThe percentage of critical processes with current BIAs, approved strategies, and updated…
• CThe number of desktop wallpapers using the company logo
• DThe average length of employee email signatures

A company outsources payroll processing to a third party. Which governance approach best integrates that dependency into the continuity program?

• AExclude payroll because it is no longer an internal process
• BAssume the vendor’s cyber insurance eliminates continuity risk
• CTreat the vendor as a critical dependency, define recovery requirements in contracts, and…
• DRely only on the vendor’s marketing brochure as proof of recoverability

What is the first step in a sound risk assessment process?

• AChoose alternate recovery sites
• BIdentify relevant threats, vulnerabilities, and assets in scope
• CPublish the final crisis communication plan
• DPurchase additional insurance coverage

In risk analysis, likelihood primarily refers to:

• AHow expensive the response team is
• BHow often or how probably a threat scenario may occur
• CHow many pages are in the continuity plan
• DHow many executives attend the annual review meeting

A data center flood risk remains moderate even after new barriers and pumps are installed. How should the remaining exposure be documented?

• ADelete it from the risk register because controls were added
• BClassify it as residual risk and track ownership and treatment decisions
• CMove it to the training log because it is no longer a risk issue
• DIgnore it unless the flood actually happens

A manufacturing site faces a high-impact but low-likelihood chemical release scenario. Which treatment option is most directly aimed at reducing consequences if the event occurs?

• AAvoidance by shutting down the entire company permanently
• BRisk reduction through containment, response procedures, and trained emergency teams
• CAcceptance without documentation
• DChanging the company logo on emergency signage

An organization wants one risk-assessment method that can compare cyber, facility, and supplier disruptions across business units. What is the best approach?

• ALet each unit invent its own scoring scale with no shared definitions
• BUse a consistent methodology with common impact criteria, scoring definitions, and docume…
• CScore only technology risks because they are easiest to quantify
• DBase all ratings only on the most recent incident that occurred

What is the main purpose of a business impact analysis (BIA)?

• ATo estimate the probability of every possible hazard
• BTo determine how disruption affects business activities and what recovery requirements ar…
• CTo replace all emergency procedures with one plan
• DTo calculate insurance premiums for the next policy year

Which pairing is correct?

• ARTO = acceptable data loss; RPO = target time to resume
• BRTO = target time to restore an activity; RPO = acceptable point of data restoration
• CRTO = maximum media exposure; RPO = emergency team size
• DRTO = training interval; RPO = audit frequency

A BIA interview identifies payroll as dependent on timekeeping, HR approvals, bank interfaces, and a third-party processor. This information is best classified as:

• AA crisis communication script
• BUpstream and downstream dependencies that affect recovery planning
• COnly a facilities-safety issue
• DA training attendance problem

Which BIA output is most useful for recovery-strategy design?

• AThe cafeteria menu for each office
• BRequired staffing, applications, facilities, records, and third-party services for critic…
• CThe number of social media followers for the company page
• DA copy of the annual holiday schedule

Senior leaders disagree with the BIA’s proposed maximum tolerable downtime for customer settlement because it seems too long. What should happen next?

• ALeave the number unchanged because analysts own all BIA conclusions
• BShorten it immediately without discussion to satisfy management
• CValidate the assumption with process owners and decision-makers, document rationale, and…
• DDelete the activity from the BIA because it is controversial

If a headquarters office becomes unavailable for several days, which strategy most directly addresses workspace continuity for office staff?

• AA warm or alternate work area strategy combined with remote-work capability
• BA new customer-loyalty campaign
• CA revised code-of-conduct document
• DA reduction in annual audit scope

A call center cannot access its primary CRM platform during an outage, but agents can still handle urgent requests through paper forms and secure spreadsheets. This is an example of:

• AA manual workaround strategy
• BA residual-risk acceptance statement
• CA media-holding statement
• DA mutual-aid agreement

Which strategy best reduces the chance of losing critical records needed to resume operations?

• AStore the only copy in an unlocked file cabinet
• BMaintain protected copies of vital records with secure backup, access controls, and alter…
• CPrint all records every day regardless of need
• DAllow each department to keep records wherever convenient without standards

A company’s only warehouse carrier has no recovery commitments in its contract. Which strategy weakness is most evident?

• AToo many spokespersons have been trained
• BThe supplier continuity strategy is underdeveloped
• CThe BIA collected too much data
• DThe crisis communication plan is too short

A continuity team proposes hot-site capability for every department, but most activities can tolerate two to three days of outage. What should drive the final strategy decision?

• AChoosing the most expensive option to show commitment
• BMatching strategies to validated recovery requirements, risks, and cost-benefit tradeoffs
• CMaking every process recover at the same speed regardless of business need
• DCopying a competitor’s design without analysis

During the first minutes of a severe facility incident, what should be the top priority?

• AUpdating the annual budget forecast
• BProtecting life safety and following emergency response procedures
• CCompleting the after-action report
• DCalling every customer before assessing the situation

Which factor should most strongly influence whether an event is escalated from a local incident to enterprise-level response?

• AWhether the incident occurred on a Monday
• BIts actual or potential impact on critical operations, stakeholders, and decision-making…
• CWhether the office coffee machine is affected
• DHow long the incident commander has worked at the company

In an incident command structure, what is the primary role of the incident commander?

• ATo approve all employee time sheets
• BTo direct overall response priorities, coordination, and decision-making
• CTo maintain the corporate social media account full time
• DTo perform every technical recovery task personally

Which item is most important in an early situation report to executives?

• AA complete transcript of every phone call made so far
• BConfirmed facts, current impacts, actions underway, known constraints, and next decision…
• CThe personal opinions of each responder
• DA final root-cause report with legal conclusions

A regional outage affects multiple facilities for several days, and local teams are competing for generators, satellite phones, and transportation. What is the best continuity practice?

• ALet each site independently fight for resources without coordination
• BPause all response work until normal procurement resumes
• CUse centralized resource tracking and prioritization based on criticality and life-safety…
• DGive resources to the loudest manager first

What should a continuity plan clearly define before recovery teams begin work?

• AThe preferred color palette for status dashboards
• BActivation criteria, authority, and how the plan is invoked
• CThe company’s annual marketing slogan
• DEvery employee’s personal travel preferences

Which document-control practice best supports reliable plan use during a disruption?

• AAllowing every department to keep unnumbered local copies without updates
• BMaintaining version history, ownership, review dates, and distribution controls
• CDeleting prior plan versions without approval records
• DRelying on verbal updates instead of document revisions

Which section belongs in a recovery plan rather than in a high-level policy?

• AExecutive commitment to continuity
• BStep-by-step procedures for restoring payroll processing after activation
• CThe program’s governance principles
• DManagement’s statement of authority

Why should contact data and notification procedures be maintained as part of continuity plans?

• ABecause phone numbers never change and require no upkeep
• BBecause outdated contacts can delay activation, coordination, and escalation when time ma…
• COnly to satisfy building-security badge requirements
• DSo employees can plan social events more easily

A continuity plan is stored only on the corporate network, which becomes unavailable during a ransomware event. What is the best design improvement?

• AKeep the plan exactly where it is because centralization is enough
• BLimit plan access to a single desktop in the main office
• CProvide protected but resilient offline or alternate access methods for authorized users
• DPrint one copy and lock it in a cabinet with no key holders listed

What distinguishes awareness from role-based continuity training?

• AAwareness is broad and introductory, while role-based training teaches people how to perf…
• BAwareness is always more technical than role-based training
• CAwareness is required only for executives
• DThere is no practical difference between them

When should continuity expectations typically be introduced to new employees?

• AOnly after they have worked for five years
• BAs part of onboarding and reinforced through periodic refreshers
• COnly if they volunteer for the crisis team
• DOnly after a real incident occurs

Which practice best measures whether continuity training is effective?

• AAssuming training worked because attendance was mandatory
• BUsing attendance, knowledge checks, role-performance observations, and follow-up gap trac…
• CCounting how many slides were shown
• DMeasuring only how quickly the instructor finished

An annual continuity-awareness campaign would be most useful if it:

• AFocuses only on technical backup settings
• BReminds employees how to report incidents, access guidance, and understand their role dur…
• CIs sent only to employees who failed a past quiz
• DReplaces all continuity plans

A company depends on contract security staff and outsourced customer-support teams during incidents. What training approach is best?

• AExclude them because only employees need continuity training
• BProvide role-appropriate training and coordination expectations to critical third parties
• CTrain them only after a disruption occurs
• DAssume their internal employer has already covered every required topic

What is the primary purpose of a tabletop exercise?

• ATo physically fail over all production systems
• BTo discuss a scenario, validate decisions, and reveal gaps in plans and coordination
• CTo replace the BIA process entirely
• DTo negotiate insurance renewals

What makes an exercise objective well written?

• AIt is as broad and vague as possible
• BIt is linked to a specific capability, scenario, and expected outcome that can be evaluat…
• CIt guarantees that no issues will be found
• DIt focuses only on making participants feel comfortable

After an exercise reveals outdated call trees and unclear authority levels, what should happen next?

• AClose the exercise with no follow-up because the gaps are already known
• BDocument findings, assign corrective actions, set due dates, and track completion
• CErase the notes to avoid creating an audit trail
• DRun the same exercise again immediately without changes

A program audit would most likely examine whether the continuity program:

• AUses attractive slide templates
• BConforms to policy, standards, governance requirements, and documented processes
• CHas reduced every risk to zero
• DCan guarantee no future disruption will occur

A company acquires a new subsidiary, changes its ERP platform, and closes two offices. What should happen to continuity documentation?

• ANothing until the next scheduled three-year review
• BOnly the crisis communication templates need revision
• CPlans, BIAs, strategies, and contact data should be updated through formal maintenance an…
• DDelete old plans and wait for a future incident to reveal what is missing

When a cyberattack affects customer-facing systems, which stakeholder group usually needs early communication planning?

• AOnly the office decorating committee
• BCustomers, employees, executives, regulators, and key service providers
• COnly the facilities maintenance contractor
• DOnly the internal audit department

Why should organizations pre-designate trained spokespersons for crisis situations?

• ASo any employee can speak to the media without guidance
• BTo help ensure accurate, consistent, and authorized external communications under pressure
• CTo eliminate the need for internal updates
• DTo replace legal and executive review completely

What is the best reason to create message templates before a crisis occurs?

• ATemplates eliminate the need to verify facts
• BTemplates speed communication while still allowing event-specific updates and approvals
• CTemplates are only useful for annual training calendars
• DTemplates should never be revised once written

Which communication design is most resilient during a widespread outage?

• ADepending on a single email system only
• BUsing redundant channels such as email, SMS, collaboration tools, hotlines, and prearrang…
• CTurning off all outbound communications until the incident ends
• DRequiring every message to be hand delivered

False information about a plant shutdown begins spreading rapidly on social media during an actual incident. What is the best response?

• AIgnore it entirely because rumors usually disappear on their own
• BRelease only internal messages and hope the public never notices
• CMonitor the misinformation, correct it through approved channels, and align messaging acr…
• DLet individual managers post personal clarifications from their own accounts

What is the main benefit of a mutual-aid agreement or memorandum of understanding (MOU)?

• AIt guarantees no disruption will ever happen
• BIt establishes expectations for support, resources, and coordination before an emergency…
• CIt replaces all internal continuity planning
• DIt serves only as a public relations document