Business Impact Analysis (BIA) CRISC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a key objective of a Business Impact Analysis (BIA)?

   • ATo identify the dependencies that support critical business functions
   • BTo design the organization's marketing strategy for the next fiscal year
   • CTo calculate the exact cost of every IT asset in the organization
   • DTo determine the root cause of a past security breach
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of a Recovery Point Objective (RPO) for a critical database?

   • AA minimum of 2 hours of uptime per day
   • BA maximum of 4 hours of downtime
   • CA maximum of 30 minutes of data loss
   • DA maximum of 1 hour to restore the database
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common method for collecting data during a Business Impact Analysis (BIA)?

   • AReviewing the organization's marketing brochures
   • BPerforming a penetration test on the network
   • CConducting interviews with business unit managers
   • DAnalyzing social media sentiment
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A global bank has completed a BIA that identifies the foreign exchange (FX) trading platform as critical, with an RTO of 15 minutes and an RPO of zero. The risk assessment identifies a high likelihood of a distributed denial-of-service (DDoS) attack that could disrupt the platform. The bank's risk appetite allows for a maximum of 30 minutes of downtime for critical functions. What is the most appropriate risk treatment decision?

   • AImplement DDoS mitigation controls to reduce the likelihood of disruption.
   • BAccept the risk because the RTO is within the risk appetite.
   • CIncrease the RTO to 30 minutes to align with the risk appetite.
   • DTransfer the risk by purchasing cyber insurance.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What does the Recovery Time Objective (RTO) represent for a critical business function?

   • AThe maximum acceptable downtime before the function must be restored
   • BThe time required to conduct a BIA
   • CThe maximum amount of data that can be lost during a disruption
   • DThe total cost of recovering the function
   Reveal Solution Discussion Select an answer first