BCP Testing, Maintenance, and Training EDRP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which activity is part of the overall BCP testing process?

   • AFocusing solely on IT systems and ignoring business processes
   • BDeleting the test results after the exercise to avoid confusion
   • CDefining test objectives and success criteria before the test
   • DEnsuring that all employees are trained only after a real disaster occurs
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A utility company must validate that its SCADA system can be recovered within the RTO of 4 hours. The company has never tested this system. Management is risk-averse and wants to avoid any chance of a real outage. Which test type should the company use first?

   • AFull interruption test
   • BSimulation test in a lab environment
   • CTabletop exercise only
   • DWalk-through drill of the recovery runbook
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which practice supports continuous improvement of the BCP?

   • AConducting tests only when required by auditors
   • BConducting after-action reviews following each test and exercise
   • CLimiting feedback to only the most senior managers
   • DAvoiding any changes to the BCP to maintain stability
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A BCP coordinator updates the recovery procedures in the BCP document. The coordinator saves the updated file with a new version number and replaces the old file on the shared drive. Later, an auditor asks to see the previous version to verify what changed. What should the coordinator have done differently?

   • AEmailed the updated file to all stakeholders without archiving the old version
   • BKept the previous version in an archive folder with a version history log
   • CDeleted the old version to avoid confusion
   • DPrinted the old version and stored it in a filing cabinet
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A multinational bank conducts an annual full interruption test of its trading platform. This year, the test revealed that the recovery procedure fails because a critical dependency on a third-party market data feed is not covered in the BCP. The third-party contract expires in three months. The bank's risk committee wants to reduce the likelihood of this failure recurring. Which action is the most comprehensive?

   • AWait for the next annual test to see if the issue recurs
   • BAdd the market data feed dependency to the BCP and negotiate a contract renewal with the vendor
   • CRemove the trading platform from the BCP because it is too complex
   • DSchedule a tabletop exercise to discuss the dependency
   Reveal Solution Discussion Select an answer first