Business Continuity Management (BCM) EDRP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A bank has a BCM plan that has not been tested in three years. Management is concerned about the cost and disruption of a full-scale exercise. The regulator requires that the plan be validated at least annually. The bank wants to test the plan's key components without shutting down live operations. Which approach best satisfies the regulatory requirement and management's concern?

   • ASubmit the plan to the regulator for review instead of testing it
   • BConduct a series of tabletop and functional exercises throughout the year, each targeting specific components of the plan
   • CPerform a full-scale exercise during off-peak hours to minimize disruption
   • DDelay testing until the next major change to the plan
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A software company is starting its BCM program from scratch. The program manager has completed the analysis phase, including the BIA and risk assessment. According to the BCM lifecycle, what should be done next?

   • ABegin testing the BCM plans to validate the analysis.
   • BDesign recovery strategies and select solutions based on the BIA and risk assessment findings.
   • CImplement the BCM plans and train staff immediately.
   • DConduct a post-incident review to identify lessons learned.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A financial institution is conducting a risk assessment for its BCM program. The risk assessment has identified that a cyber-attack on the core banking system has a low likelihood but a very high impact. The BIA shows that the core banking system has an RTO of 2 hours and an RPO of 15 minutes. The institution currently has a backup system that can restore data with an RPO of 1 hour. What is the most appropriate risk treatment decision?

   • AReduce the RPO to 1 hour to match the current backup capability.
   • BInvest in a backup solution that can achieve an RPO of 15 minutes or less, despite the low likelihood, because the impact is very high.
   • CTransfer the risk by purchasing cyber insurance instead of upgrading the backup.
   • DAccept the risk because the likelihood is low and the current backup is sufficient.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A hospital has a newly written business continuity plan for its patient admission process. Management wants to validate that the plan's documented procedures work without causing disruption to live operations. The exercise should involve the actual admission staff and require them to follow the plan step by step in a simulated environment. Which type of exercise best meets this requirement?

   • AA tabletop exercise where staff discuss the plan around a table
   • BA plan review meeting to check the document for formatting errors
   • CA full-scale exercise that shuts down the live admission system
   • DA functional exercise in a simulated environment with admission staff executing the plan
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A multinational corporation is establishing a BCM program. The board has approved a BCM policy that mandates a single, standardized BCM framework for all business units. However, the European business unit operates under strict data residency regulations, while the Asian business unit has different operational hours and cultural practices. The BCM program manager must implement the policy. What is the best approach?

   • AAbandon the global framework and let each region develop its own BCM program independently.
   • BAdopt the standardized framework but allow regional adaptations for regulatory and operational requirements.
   • CApply the framework only to the European region and defer the Asian region until later.
   • DEnforce the standardized framework strictly in all regions to ensure uniformity.
   Reveal Solution Discussion Select an answer first