Business Continuity Management (BCM) EDRP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A logistics company is integrating risk assessment into its BCM program. The risk team has identified that a key supplier is located in a region prone to earthquakes. The company wants to understand how this risk could affect its critical business functions and what mitigation strategies should be prioritized. Which approach best integrates this risk information into BCM?

   • AImmediately switch to a different supplier in a lower-risk region without further analysis
   • BIncorporate the supplier risk into the BIA by analyzing the impact of losing that supplier on critical functions and documenting alternative sourcing options
   • CWait for an earthquake to occur before developing any continuity plans
   • DAdd the earthquake risk to the company's general risk register and take no further BCM action
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A utility company is integrating its BCM program with its enterprise risk management (ERM) framework. The ERM team has identified that a cyber-attack on the SCADA system is a top risk. The BCM team has completed a BIA that shows the SCADA system has an RTO of 1 hour. However, the ERM team has not shared the detailed risk assessment with the BCM team. What is the most important reason for the BCM team to obtain the risk assessment?

   • ATo understand the likelihood and impact of the cyber-attack and prioritize SCADA recovery strategies accordingly.
   • BTo replace the BIA with the risk assessment to avoid duplication of effort.
   • CTo transfer the SCADA recovery responsibility to the ERM team.
   • DTo ensure the BCM plan includes all possible cyber-attack scenarios.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A regional bank is updating its BCM program. The continuity manager has been asked to identify which business functions must be restored within 4 hours of a disruption and which can wait up to 72 hours. The manager also needs to document the dependencies each function has on internal IT systems and external vendors. Which BCM activity should the manager perform first to obtain this information?

   • APerform a risk assessment to identify threats and vulnerabilities
   • BDevelop the business continuity plan with recovery procedures for each department
   • CExecute a full-scale exercise to test the current recovery capabilities
   • DConduct a Business Impact Analysis (BIA) to determine recovery time objectives and dependencies
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A bank is developing a business continuity plan for its online banking platform. The BIA identified that the platform is critical and must be restored within 1 hour. The risk assessment identified a high likelihood of distributed denial-of-service (DDoS) attacks. Which element is essential to include in the BCP?

   • AProcedures for activating a DDoS mitigation service and fallback to a secondary internet provider.
   • BA detailed history of past DDoS attacks and their impact.
   • CA policy stating that the platform will be restored within 24 hours.
   • DA list of all customers and their account balances.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of establishing a BCM steering committee?

   • ATo perform day-to-day maintenance of business continuity plans
   • BTo conduct technical recovery of IT systems
   • CTo handle all crisis communication during an actual disaster
   • DTo provide cross-functional guidance, prioritization, and oversight for the BCM program
   Reveal Solution Discussion Select an answer first