Free Practice Questions for GAQM CBCP-002 Exam

Risks are diverse and arise from both external and internal sources. This is true because risks are uncertainties that can have positive or negative effects on an organization’s objectives. Risks can arise from various sources that are either outside or inside the organization’s control. External sources of risk include natural disasters, cyberattacks, market fluctuations, customer preferences, competition, regulation, or political instability. Internal sources of risk include human error, fraud, system failure, process inefficiency, organizational culture, or strategic decisions. Verified References: https://www.investopedia.com/terms/b/businessrisk.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

In Business Continuity Planning (BCP), confidentiality and security of sensitive information are critical considerations when releasing details publicly. According to standard practices outlined in Business Continuity Professional guidelines, such as those from the Disaster Recovery Institute International (DRI) and ISO 22301, certain elements of a BCP should remain confidential to protect the organization and its stakeholders.

Process flows: These describe how critical processes are maintained or recovered during a disruption. While detailed process flows may be sensitive internally, a high-level overview can often be shared publicly to demonstrate preparedness without compromising operational security. Thus, they are not inherently prohibited from public release.

Contact lists: These contain personal and operational details such as names, phone numbers, and roles of key personnel involved in the BCP. Releasing contact lists publicly poses significant risks, including privacy violations, potential targeting by malicious actors, and operational vulnerabilities. Best practices dictate that contact lists should remain confidential and restricted to authorized personnel only.

BIA results: The Business Impact Analysis (BIA) identifies critical functions, recovery time objectives (RTOs), and potential impacts of disruptions. While detailed BIA results are sensitive, summary-level findings (e.g., critical processes identified without specific vulnerabilities) can sometimes be shared to show due diligence. However, this is not strictly prohibited in public releases if anonymized or generalized.

All of the above: Since process flows and BIA results can be released in a controlled, summarized form, this option is incorrect. The key element that should unequivocally not be released is the contact list due to its sensitive nature.

Therefore, the correct answer isB. Contact lists, as it aligns with the principle of protecting sensitive personal and operational data in public disclosures.

References:

DRI International Professional Practices for Business Continuity Management (2023), Section 6: Business Continuity Plan Development – Emphasizes safeguarding sensitive data like contact details.

ISO 22301:2019, Clause 8.4 – Highlights confidentiality in BCP documentation and communication.

Business impact analysis (BIA) is the process of identifying and prioritizing the organization’s functions and processes based on their importance to the organization’s objectives, and assessing the potential impacts of a disruption to those functions and processes over time. The BIA helps to determine the recovery time objectives (RTOs), recovery point objectives (RPOs), and resource requirements for each function and process, as well as the interdependencies and dependencies among them. The BIA provides the basis for developing recovery strategies and plans. Verified References: https://www.ready.gov/business-impact-analysis https://drii.org/resources/professionalpractices/EN

A disaster can also be declared for an illness pandemic where a significant portion of employees are sick. This is true because an illness pandemic is a type of natural disaster that can affect an organization’s ability to continue its normal operations. An illness pandemic can cause absenteeism, reduced productivity, increased costs, supply chain disruptions, customer dissatisfaction, or regulatory compliance issues. Therefore, an organization may need to declare a disaster and activate its business continuity and disaster recovery plan if an illness pandemic impacts its critical functions and processes beyond an acceptable level. VerifiedReferences: https://www.ready.gov/business-continuity-plan https://www.csoonline.com/article/515730/business-continuity-and-disaster-recovery-planning-the-basics.html

Damage assessment is the process of evaluating the extent and severity of the damage caused by a disruption to an organization’s facilities, equipment, systems, data, records, or personnel. It includes identifying the affected business functions and processes, estimating the time it will take to restore them to normal or acceptable levels of operation, and evaluating whether the recovery time exceeds the maximum tolerable downtime (MTD) for each function or process. If so, a disaster should be declared and the business continuity plan should be activated. Having the insurance company declare the total extent of the damages is not part of the damage assessment process, as it may take longer than the MTD and may not reflect the operational impact of the damage. Verified References: https://www.fema.gov/pdf/emergency/nims/Damage_Assessment.pdf https://drii.org/resources/professionalpractices/EN

In pre-crisis management, CM activities are focused on prevention and preparedness activities. This is true because pre-crisis management is the phase before a crisis occurs, where the organization tries to anticipate and avoid potential crises or reduce their likelihood and impact. Pre-crisis management involves activities such as risk assessment, business impact analysis,business continuity planning, contingency planning, crisis communication planning, training and awareness, testing and exercising, monitoring and reviewing. Verified References: https://www.cisco.com/c/en/us/solutions/hybrid-work/what-is-business-continuity.html https://phoenixnap.com/blog/what-is-business-continuity-management

A disaster lasting longer than seventy-two (72) hours requires implementation of a business continuity and disaster recovery plan. A business continuity and disaster recovery plan is a comprehensive document that outlines how an organization will respond to and recover from adisaster that disrupts its normal operations. It covers both the IT aspects (disaster recovery) and the business aspects (business continuity) of restoring the critical functions and processes within an acceptable time frame. A disaster lasting longer than seventy-two (72) hours is likely to have significant impacts on the organization’s performance, reputation, assets, and stakeholders, and therefore requires a coordinated and structured approach to ensure its survival and resilience. Verified References: https://www.ready.gov/business-continuity-plan https://www.csoonline.com/article/515730/business-continuity-and-disaster-recovery-planning-the-basics.html

Business risk is the risk of loss or damage to an organization’s performance, reputation, assets, or stakeholders due to internal or external factors that affect its ability to achieve its objectives. Business risk can arise from various sources, such as market conditions, customer preferences, competition, technology, regulation, compliance, operations, finance, human resources, or natural disasters. Business risk can have a direct or indirect impact on an organization’s profitability, growth, sustainability, or continuity. Verified References: https://www.investopedia.com/terms/b/businessrisk.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

A Business Continuity Plan (BCP) is designed to ensure an organization can maintain or resume critical functions during and after a disruption. According to Business Continuity Professional standards, such as those from DRI International and ISO 22301, the BCP typically encompasses three core components that address different phases of response and recovery:

A. Emergency response: This component focuses on the immediate actions taken during a disruption (e.g., evacuation, safety measures, and initial coordination). It is a foundational part of the BCP, ensuring personnel and asset safety as a prerequisite to continuity and recovery efforts.

B. Incident management: While incident management (handling and resolving incidents) is critical in broader crisis management frameworks, it is often considered a distinct process under an Incident Response Plan (IRP) rather than a core BCP component. It overlaps with BCP but is not universally listed as one of the three primary elements.

C. Problem management: This is an IT service management process (e.g., under ITIL) focused on identifying and resolving the root causes of incidents. It is not a standard component of a BCP, which prioritizes continuity and recovery over long-term problem resolution.

D. Business recovery: This involves restoring critical business functions and processes after a disruption, ensuring the organization can resume normal operations. It is a central pillar of the BCP, addressing recovery time objectives (RTOs) and operational continuity.

E. Disaster recovery: This focuses on recovering IT systems, data, and infrastructure following a disaster. Often integrated into the BCP, it ensures technological continuity, making it a key component alongside business recovery and emergency response.

The verified answer isA. Emergency response, D. Business recovery, E. Disaster recovery, as these three components collectively cover the lifecycle of a BCP—immediate response, business function restoration, and IT recovery—per established standards. While incident management is related, it is typically supplementary rather than a core BCP element when narrowed to three components.

References:

DRI International Professional Practices for Business Continuity Management (2023), Section 6: Business Continuity Plan Development – Identifies emergency response, business recovery, and disaster recovery as key BCP components.

ISO 22301:2019, Clause 8.4 – Outlines planning for response (emergency), continuity (business recovery), and IT recovery (disaster recovery) as integral to BCP.