Ultimate Guide to Prepare Free GAQM CBCP-002 Exam Questions and Answer
Pass GAQM CBCP-002 Tests Engine pdf - All Free Dumps
NEW QUESTION # 19
In the event of a disaster that destroys the physical office site operations will be relocated to a temporary site.
- A. False
- B. True
Answer: B
Explanation:
In the event of a disaster that destroys the physical office site operations will be relocated to a temporary site.
This is true because one of the recovery strategies for a disaster is to have an alternate site where the critical functions and processes can be resumed until the primary site is restored or replaced. The alternate site can be a pre-arranged location, such as a rented office space, a hotel, or another branch of the same organization, or a mobile facility, such as a trailer or a container. The alternate site should have the necessary equipment, systems, data, and resources to support the continuity of the business. Verified References: https://www.ready.
gov/business-continuity-planhttps://www.csoonline.com/article/515730/business-continuity-and-disaster- recovery-planning-the-basics.html
NEW QUESTION # 20
Which of the following four are action approach crisis and post-crisis management? (Choose four R's)
- A. Rustic
- B. Readiness
- C. Response
- D. Recovery
- E. Reduction
- F. Rss Feed
Answer: B,C,D,E
Explanation:
The four R's are action approaches for crisis and post-crisis management. They are:
* Reduction: This approach aims to prevent or mitigate the occurrence or impact of a crisis by identifying and addressing the root causes, vulnerabilities, and risks.
* Readiness: This approach aims to prepare for a potential crisis by developing plans, policies, procedures, systems, teams, and resources that can enable a timely and effective response.
* Response: This approach aims to manage a crisis by activating the plans, policies, procedures, systems, teams, and resources that can contain, control, and resolve the situation.
* Recovery: This approach aims to restore normal operations after a crisis by implementing actions that can repair damages, restore functions and processes, resume services and products, recover losses, and learn lessons. Verified References: https://www.cisco.com/c/en/us/solutions/hybrid-work/what-is- business-continuity.html https://phoenixnap.com/blog/what-is-business-continuity-management
NEW QUESTION # 21
Which of the following are three components of business continuity plan? (Choose three)
- A. Incident management
- B. Emergency response
- C. Problem management
- D. Business recovery
- E. Disaster recovery
Answer: A,B,E
Explanation:
Explanation
The three components of a business continuity plan are emergency response, incident management, and disaster recovery. They are:
Emergency response: This component involves the immediate actions taken to protect the life, health, and safety of people and the environment in the event of a disruption. Emergency response may include activating alarms, evacuating premises, contacting emergency services, or providing first aid.
Incident management: This component involves the coordination and communication of the activities and resources required to manage and resolve a disruption. Incident management may include activating the business continuity team, declaring a disaster, assessing the impact, activating the recovery strategies, or communicating with stakeholders.
Disaster recovery: This component involves the restoration and recovery of the IT systems, data, and infrastructure that support the critical functions and processes of the organization. Disaster recovery may include activating the backup systems, restoring the data, repairing or replacing the equipment, or testing the functionality. Verified References: https://www.ready.gov/business-continuity-plan
https://www.csoonline.com/article/515730/business-continuity-and-disaster-recovery-planning-the-basics.
NEW QUESTION # 22
Which phase of the project is the time to maximize on the employees' new awareness and management support?
- A. Structure
- B. Timelines
- C. Milestones
- D. Benchmark
Answer: C
Explanation:
Milestones are important events in a project that mark the completion of a major deliverable or the achievement of a key goal. They are a good time to check in with employees and management to see how they are feeling about the project, and to get their feedback on how things are going. This is also a good time to reinforce the importance of the project and to get everyone re-committed to its success.
The other three options are not as good times to maximize on the employees' new awareness and management support. Timelines are important, but they are not as important as milestones in terms of getting people's attention. Benchmarks are useful for tracking progress, but they are not as good for getting people's buy-in.
Structure is important for organizing a project, but it is not as important as milestones for motivating people.
So, the answer to the question is that the milestones phase of the project is the time to maximize on the employees' new awareness and management support.
Here are some specific things that you can do at the milestones phase to maximize on employee awareness and management support:
* Hold a team meeting to celebrate the milestone and to discuss the next steps.
* Send out a communication to all employees and managers, highlighting the milestone and thanking everyone for their hard work.
* Meet with management to discuss the project's progress and to get their feedback.
* Use the milestone as an opportunity to reinforce the importance of the project and to get everyone re- committed to its success.
NEW QUESTION # 23
In the event of a disaster, notification shall be given to each employee by either the HR Department Manager or through the firm's emergency notice system.
- A. False
- B. True
Answer: B
Explanation:
In the event of a disaster, notification shall be given to each employee by either the HR Department Manager or through the firm's emergency notice system. This is true because communication is a vital component of any disaster recovery and business continuity plan. Employees need to be informed of the situation, their roles and responsibilities, and the actions they need to take to ensure their safety and the continuity of the business.
The HR Department Manager or the emergency notice system are the designated channels for communicating with employees during a disaster. Verified References: https://www.ready.gov/business-continuity- planhttps://www.csoonline.com/article/515730/business-continuity-and-disaster-recovery-planning-the-basics.
html
NEW QUESTION # 24
Which certification centre provides the physical infrastructure?
- A. Service
- B. Facility
Answer: B
Explanation:
A facility certification center is a center that provides the physical infrastructure for testing and certifying the functionality and performance of products, systems, or services. A facility certification center may have specialized equipment, tools, environments, or standards that can simulate real-world conditions or scenarios.
A facility certification center may also have qualified staff, experts, or auditors who can conduct the testing and certification process. Verified References: https://www.iso.org/publication/PUB100442.htmlhttps://www.
cisco.com/c/en/us/solutions/hybrid-work/what-is-business-continuity.html
NEW QUESTION # 25
Which risk group is associated with risk of physical assets failing/being damaged or enhanced?
- A. Operational
- B. Financial
- C. Strategic
- D. Technical
Answer: D
Explanation:
Technical risk is the type of risk that is associated with risk of physical assets failing/being damaged or enhanced. Technical risk is the uncertainty or variability of the performance or reliability of physical assets, such as equipment, systems, infrastructure, or data. Technical risk can result from factors such as design flaws, manufacturing defects, maintenance issues, obsolescence, human error, natural disasters, or cyberattacks. Technical risk can affect an organization's operational efficiency, quality, safety, security, or profitability. Verified References: https://www.investopedia.com/terms/t/technical-risk.asphttps://www.thebci.
org/training-qualifications/good-practice-guidelines.html
NEW QUESTION # 26
In pre-crisis management, CM activities are focused on prevention and preparedness activities.
- A. False
- B. True
Answer: B
Explanation:
Explanation
In pre-crisis management, CM activities are focused on prevention and preparedness activities. This is true because pre-crisis management is the phase before a crisis occurs, where theorganization tries to anticipate and avoid potential crises or reduce their likelihood and impact. Pre-crisis management involves activities such as risk assessment, business impact analysis, business continuity planning, contingency planning, crisis communication planning, training and awareness, testing and exercising, monitoring and reviewing. Verified References:
https://www.cisco.com/c/en/us/solutions/hybrid-work/what-is-business-continuity.htmlhttps://phoenixnap.com/b
NEW QUESTION # 27
Which system in place enables you to balance risk and entrepreneurial energy with appropriate internal control procedures to manage that risk?
- A. Quality Management System
- B. Corporate Governance
- C. Auditing Report
- D. Banking System
Answer: B
Explanation:
Explanation
Corporate governance is the system of rules, practices, and processes by which an organization is directed and controlled. It involves balancing the interests of various stakeholders, such as shareholders, management, customers, suppliers, regulators, and the community. It also enables an organization to balance risk and entrepreneurial energy with appropriate internal control procedures to manage that risk. Effective corporate governance can enhance performance, accountability, transparency, and trust. Verified References:
https://www.investopedia.com/terms/c/corporategovernance.asphttps://www.thebci.org/training-qualifications/go
NEW QUESTION # 28
Which of the following are the four T's of risk guidance produced by by the Office of Government Commerce? (choose four)
- A. Transfer
- B. Tolerate
- C. Title
- D. Terminate
- E. Treat
- F. Technique
Answer: A,B,D,E
Explanation:
The four T's of risk guidance produced by the Office of Government Commerce are transfer, tolerate, treat, and terminate. They are:
* Transfer: This strategy involves transferring or sharing some or all of the responsibility or impact of a risk to another party, such as an insurer, a supplier, or a partner.
* Tolerate: This strategy involves accepting or retaining a risk without taking any further action to reduce it, either because the risk level is acceptable or because the cost or effort of reducing it is not justified.
* Treat: This strategy involves taking steps to reduce the likelihood or impact of a risk to an acceptable level, such as implementing controls, mitigations, or contingency plans.
* Terminate: This strategy involves eliminating or avoiding a risk by discontinuing or changing the activity that causes it. Verified References:https://www.investopedia.com/terms/t/the-four-ts.asp
https://www.thebci.org/training-qualifications/good-practice-guidelines.html
NEW QUESTION # 29
Which of the following are three components of business continuity plan? (Choose three)
- A. Emergency response
- B. Incident management
- C. Problem management
- D. Disaster recovery
- E. Business recovery
Answer: A,D,E
Explanation:
A Business Continuity Plan (BCP) is designed to ensure an organization can maintain or resume critical functions during and after a disruption. According to Business Continuity Professional standards, such as those from DRI International and ISO 22301, the BCP typically encompasses three core components that address different phases of response and recovery:
* A. Emergency response: This component focuses on the immediate actions taken during a disruption (e.g., evacuation, safety measures, and initial coordination). It is a foundational part of the BCP, ensuring personnel and asset safety as a prerequisite to continuity and recovery efforts.
* B. Incident management: While incident management (handling and resolving incidents) is critical in broader crisis management frameworks, it is often considered a distinct process under an Incident Response Plan (IRP) rather than a core BCP component. It overlaps with BCP but is not universally listed as one of the three primary elements.
* C. Problem management: This is an IT service management process (e.g., under ITIL) focused on identifying and resolving the root causes of incidents. It is not a standard component of a BCP, which prioritizes continuity and recovery over long-term problem resolution.
* D. Business recovery: This involves restoring critical business functions and processes after a disruption, ensuring the organization can resume normal operations. It is a central pillar of the BCP, addressing recovery time objectives (RTOs) and operational continuity.
* E. Disaster recovery: This focuses on recovering IT systems, data, and infrastructure following a disaster. Often integrated into the BCP, it ensures technological continuity, making it a key component alongside business recovery and emergency response.
The verified answer isA. Emergency response, D. Business recovery, E. Disaster recovery, as these three components collectively cover the lifecycle of a BCP-immediate response, business function restoration, and IT recovery-per established standards. While incident management is related, it is typically supplementary rather than a core BCP element when narrowed to three components.
References:
* DRI International Professional Practices for Business Continuity Management (2023), Section 6:
Business Continuity Plan Development - Identifies emergency response, business recovery, and disaster recovery as key BCP components.
* ISO 22301:2019, Clause 8.4 - Outlines planning for response (emergency), continuity (business recovery), and IT recovery (disaster recovery) as integral to BCP.
NEW QUESTION # 30
Which statement is authorized at an appropriate level and should codify the company's attitude to a particular risk?
- A. Policy Statement
- B. QMS Document
- C. Process Document
- D. Privacy Statement
Answer: A
Explanation:
A policy statement is a statement that is authorized at an appropriate level and should codify the company's attitude to a particular risk. A policy statement is a document that defines the scope, objectives, principles, roles, and responsibilities of a business continuity management program. It should also express the organization's commitment to managing risks and ensuring continuity of its critical functions and processes.
A policy statement should be approved by senior management and communicated to all relevant stakeholders.
Verified References: https://www.iso.org/publication/PUB100442.htmlhttps://phoenixnap.com/blog/what-is- business-continuity-management
NEW QUESTION # 31
BIA stands for
- A. Business Impact Analysis
- B. Business Information Availability
- C. Business Improvement Activities
- D. Business Importance and Availability
Answer: A
Explanation:
Business impact analysis (BIA) is the process of identifying and prioritizing the organization's functions and processes based on their importance to the organization's objectives, and assessing the potential impacts of a disruption to those functions and processes over time. The BIA helps to determine the recovery time objectives (RTOs), recovery point objectives (RPOs), and resource requirements for each function and process, as well as the interdependencies and dependencies among them. The BIA provides the basis for developing recovery strategies and plans. Verified References: https://www.ready.gov/business-impact- analysishttps://drii.org/resources/professionalpractices/EN
NEW QUESTION # 32
When should the Business Continuity Planning be reviewed?
- A. Whenever the company gets audited
- B. Whenever the legal department declares it is time
- C. At least annually or whenever significant changes occur
- D. Whenever encountering a disaster
Answer: C
Explanation:
Business continuity planning is not a one-time activity, but a dynamic and ongoing process that needs to be reviewed and updated regularly to reflect changes in the internal and external environment. The frequency of review may vary depending on the nature and size of the organization, but it is generally recommended to conduct a review at least annually or whenever significant changes occur that may affect the continuity of the organization's functions and processes. Such changes may include organizational restructuring, new products or services, new technologies, new regulations, new threats or vulnerabilities, or lessons learned from incidents or exercises. Verified References: https://www.ready.gov/business-continuity-planhttps://drii.org
/resources/professionalpractices/EN
NEW QUESTION # 33
Which type of risks result from business decisions that are influenced by changes in markets, liquidity changes and credit risks?
- A. Financial
- B. Technical
- C. Operational
- D. Strategic
Answer: A
Explanation:
Explanation
Financial risks are the risks that result from business decisions that are influenced by changes in markets, liquidity, and credit. Financial risks are the uncertainties or variabilities of the financial performance or position of an organization due to factors such as interest rates, exchange rates, inflation, credit ratings, debt levels, or cash flows. Financial risks can affect an organization's profitability, solvency, liquidity, or valuation.
Verified References:
https://www.investopedia.com/terms/f/financialrisk.asphttps://www.thebci.org/training-qualifications/good-pract
NEW QUESTION # 34
In pre-crisis management, CM activities are focused on prevention and preparedness activities.
- A. False
- B. True
Answer: B
Explanation:
In pre-crisis management, CM activities are focused on prevention and preparedness activities. This is true because pre-crisis management is the phase before a crisis occurs, where the organization tries to anticipate and avoid potential crises or reduce their likelihood and impact. Pre-crisis management involves activities such as risk assessment, business impact analysis,business continuity planning, contingency planning, crisis communication planning, training and awareness, testing and exercising, monitoring and reviewing. Verified References: https://www.cisco.com/c/en/us/solutions/hybrid-work/what-is-business-continuity.
htmlhttps://phoenixnap.com/blog/what-is-business-continuity-management
NEW QUESTION # 35
Which type of continuity planning will enhance the functioning relationship with the organization's key suppliers, creating stronger assurances of continuous supply of information, material product and services?
- A. Multilateral
- B. Unilateral
- C. Bilateral
Answer: C
NEW QUESTION # 36
Which of the following should NOT be released in a publicly released BCP?
- A. Process flows
- B. All of the above
- C. Contact lists
- D. BIA results
Answer: B
Explanation:
Explanation
A publicly released BCP is a version of a business continuity plan that is intended for external audiences, such as customers, suppliers, partners, regulators, media, or the public. It should not contain sensitive or confidential information that may compromise the security or privacy of theorganization or its stakeholders.
Therefore, it should not include process flows that detail how each function or process is performed; contact lists that reveal personal or organizational information; BIA results that show criticality ratings or recovery time objectives; or any other information that may expose vulnerabilities or risks. Verified References:
https://www.ready.gov/business-continuity-planhttps://drii.org/resources/professionalpractices/EN
NEW QUESTION # 37
Damage assessment includes all but which of the following steps?
- A. Estimate the time it will take to restore critical business functions.
- B. Having the insurance company declare the total extent of the damages.
- C. Identifying the affected business functions.
- D. Evaluating the time to restore operations and if greater than the MTD, a disaster should be declared and BCP enacted
Answer: B
Explanation:
Damage assessment is the process of evaluating the extent and severity of the damage caused by a disruption to an organization's facilities, equipment, systems, data, records, or personnel. It includes identifying the affected business functions and processes, estimating the time it will take to restore them to normal or acceptable levels of operation, and evaluating whether the recovery time exceeds the maximum tolerable downtime (MTD) for each function or process. If so, a disaster should be declared and the business continuity plan should be activated. Having the insurance company declare the total extent of the damages is not part of the damage assessment process, as it may take longer than the MTD and may not reflect the operational impact of the damage. Verified References: https://www.fema.gov/pdf/emergency/nims/Damage_Assessment.
pdfhttps://drii.org/resources/professionalpractices/EN
NEW QUESTION # 38
Which risk group is associated with risk of physical assets failing/being damaged or enhanced?
- A. Operational
- B. Financial
- C. Strategic
- D. Technical
Answer: D
Explanation:
Explanation
Technical risk is the type of risk that is associated with risk of physical assets failing/being damaged or enhanced. Technical risk is the uncertainty or variability of the performance or reliability of physical assets, such as equipment, systems, infrastructure, or data. Technical risk can result from factors such as design flaws, manufacturing defects, maintenance issues, obsolescence, human error, natural disasters, or cyberattacks.
Technical risk can affect an organization's operational efficiency, quality, safety, security, or profitability.
Verified References:
https://www.investopedia.com/terms/t/technical-risk.asphttps://www.thebci.org/training-qualifications/good-prac
NEW QUESTION # 39
Risks are diverse and arise from both external and internal sources.
- A. False
- B. True
Answer: B
Explanation:
Risks are diverse and arise from both external and internal sources. This is true because risks are uncertainties that can have positive or negative effects on an organization's objectives. Risks can arise from various sources that are either outside or inside the organization's control. External sources of risk include natural disasters, cyberattacks, market fluctuations, customer preferences, competition, regulation, or political instability.
Internal sources of risk include human error, fraud, system failure, process inefficiency, organizational culture, or strategic decisions. Verified References: https://www.investopedia.com/terms/b/businessrisk.
asphttps://www.thebci.org/training-qualifications/good-practice-guidelines.html
NEW QUESTION # 40
......
Certified Business Continuity Professional (CBCP) Practice Tests 2025 | Pass CBCP-002 with confidence!: https://drive.google.com/open?id=1t1i4XED_TnTeR-r4kyGlJdMwK8PTVU2l
Online Exam Practice Tests with detailed explanations!: https://www.prep4king.com/CBCP-002-exam-prep-material.html
