CBCP CERTIFICATION EXAM REVIEW WITH 200 REAL
EXAM QUESTIONS AND CORRECT VERIFIED ANSWERS/
ALREADY GRADED A+ (MOST RECENT!!) — 189 Questions
Section 1: Program Management (Questions 1-20)
1 A multinational corporation is restructuring its business continuity program to align with ISO 22301:2019. The
program manager proposes a governance model where the program steering committee includes representatives
from legal, IT, operations, and finance. Which of the following best describes the primary advantage of this
cross-functional governance structure?
A) It ensures that the program budget is allocated proportionally to each department's risk exposure.
B) It facilitates integration of continuity requirements into existing management systems and strategic planning.
C) It reduces the need for a dedicated business continuity team by distributing responsibilities.
D) It allows for faster decision-making by concentrating authority in a single executive sponsor.
Answer: B
Rationale: A cross-functional steering committee ensures that continuity is embedded across the organization,
aligning with ISO 22301's requirement for top management involvement and integration with business processes.
Option A is too narrow (budget allocation is just one aspect); C is incorrect because a dedicated team is still
needed; D contradicts the committee's distributed nature.
2 An organization has a mature business continuity program that has been operating for five years. The program
manager is reviewing the annual budget and notes that the cost of maintaining the program has increased by
15% year-over-year, primarily due to increased training and exercise requirements. Which of the following
strategies would best optimize program costs while maintaining effectiveness?
A) Reduce the frequency of exercises to biennial and replace full-scale exercises with tabletop discussions.
B) Implement a tiered training program that focuses resources on critical roles and uses e-learning for general
awareness.
C) Outsource all training and exercise activities to a third-party vendor to achieve economies of scale.
D) Eliminate training for non-essential personnel and rely on just-in-time training during actual incidents.
Answer: B
Rationale: A tiered training program optimizes costs by allocating intensive resources to critical roles while using
cost-effective e-learning for general awareness, maintaining competency without overspending. Option A may
reduce effectiveness; C may not address specific organizational needs; D is risky as just-in-time training is
insufficient for preparedness.
3 A program manager is developing key performance indicators (KPIs) for a business continuity program. Which
of the following sets of KPIs best provides a balanced assessment of program performance across preparedness,
response, and improvement?
A) Number of plans completed, percentage of staff trained, and number of exercises conducted.
B) Average recovery time objective (RTO) attainment, exercise evaluation scores, and number of corrective
actions closed.
C) Budget variance, number of audit findings, and time since last exercise.
,D) Percentage of critical processes with documented plans, employee satisfaction survey results, and vendor
compliance rates.
Answer: B
Rationale: RTO attainment measures response effectiveness, exercise scores assess preparedness, and corrective
actions closed indicates improvement. Option A focuses only on completion metrics, not quality; C is
financial/compliance-focused; D mixes operational and subjective measures without direct performance indicators.
4 During a program review, it is discovered that several business units have developed continuity plans that are
inconsistent with the corporate template and have not been approved by the program office. The program
manager needs to enforce standardization. Which approach aligns with best practices in program management?
A) Mandate that all plans must use the corporate template and require approval before the next audit cycle.
B) Establish a plan review and approval process with clear escalation for non-compliance, and provide training
on the template.
C) Allow business units to maintain their own formats as long as they meet minimum content requirements.
D) Revoke the authority of business units to create plans and centralize all planning in the program office.
Answer: B
Rationale: Best practice involves a combination of enforcement (approval process) and enablement (training) to
achieve compliance without alienating stakeholders. Option A lacks training; C may perpetuate inconsistency; D is
overly centralizing and impractical for large organizations.
5 An organization's business continuity program has been in place for three years, but senior leadership perceives
it as a compliance burden rather than a strategic asset. The program manager wants to shift this perception.
Which of the following initiatives would be most effective in demonstrating the program's strategic value?
A) Publish a quarterly newsletter highlighting regulatory compliance achievements and audit results.
B) Conduct a business impact analysis (BIA) that quantifies the financial impact of disruptions and presents it to
the executive committee.
C) Reduce the program budget to show cost efficiency and align with lean management principles.
D) Invite external auditors to certify the program against ISO 22301 to boost credibility.
Answer: B
Rationale: Quantifying financial impacts directly links continuity to business outcomes, making the case for
strategic investment. Option A reinforces compliance focus; C may undermine program effectiveness; D adds
external validation but does not inherently demonstrate strategic value.
6 A program manager is designing a continuous improvement process for the business continuity program. Which
of the following approaches best aligns with the Plan-Do-Check-Act (PDCA) cycle as defined in ISO 22301?
A) Plan: Set objectives; Do: Implement plans; Check: Conduct exercises; Act: Update plans based on lessons
learned.
B) Plan: Allocate budget; Do: Train staff; Check: Audit compliance; Act: Report to management.
C) Plan: Identify risks; Do: Develop plans; Check: Review plans annually; Act: Archive outdated plans.
D) Plan: Establish governance; Do: Perform BIA; Check: Measure RTOs; Act: Reassign resources.
Answer: A
Rationale: Option A correctly maps PDCA: Plan (objectives), Do (implementation), Check (exercises to measure
performance), Act (corrective actions). Other options mix elements or omit key steps like corrective action.
7 An organization's business continuity program has a maturity level of 2 (Repeatable) on the CMMI-based
maturity model. The program manager aims to reach level 3 (Defined). Which of the following changes is most
critical to achieve this transition?
,A) Standardize processes across the organization with documented procedures and templates.
B) Increase the frequency of exercises from annual to semi-annual.
C) Implement a centralized incident management software system.
D) Establish a program steering committee with executive sponsorship.
Answer: A
Rationale: Moving from Repeatable to Defined requires standardization and documentation of processes so they are
consistent across the organization. Options B and C are improvements but not the defining characteristic; D is more
relevant to earlier maturity levels.
8 A program manager is evaluating whether to integrate the business continuity program with the organization's
enterprise risk management (ERM) framework. Which of the following is a potential disadvantage of full
integration?
A) Continuity planning may become overly focused on high-probability risks, neglecting low-probability,
high-impact events.
B) It may lead to duplication of efforts and conflicting priorities between risk and continuity teams.
C) Integration typically increases the overall cost of both programs due to additional coordination requirements.
D) It reduces the visibility of continuity program achievements within the broader risk context.
Answer: A
Rationale: Integration with ERM can bias resources toward risks with higher probability, potentially underfunding
preparedness for rare but catastrophic events. Option B is less likely if integration is managed well; C is not
necessarily true; D is not a disadvantage.
9 A program manager is tasked with developing a business continuity program for a newly acquired subsidiary.
The subsidiary has no existing program. Which of the following sequences of activities best represents a
structured approach to program initiation?
A) Conduct BIA !’ Develop plans !’ Train staff !’ Exercise !’ Review and update.
B) Establish governance !’ Perform risk assessment !’ Conduct BIA !’ Develop strategy !’ Create plans !’
Implement and test.
C) Train staff !’ Develop plans !’ Conduct BIA !’ Exercise !’ Update governance.
D) Perform risk assessment !’ Establish governance !’ Train staff !’ Develop plans !’ Conduct BIA.
Answer: B
Rationale: A logical sequence starts with governance to provide oversight, then risk assessment and BIA to inform
strategy, followed by plan development and testing. Option A omits governance and risk assessment; C and D have
incorrect ordering.
10 A program manager notices that the business continuity program's exercise results have been consistently
scoring below targets for two consecutive years. The root cause analysis indicates that plans are not being
updated after exercises. Which of the following corrective actions would most effectively address this issue?
A) Increase the frequency of exercises to monthly to ensure plans are tested more often.
B) Implement a formal lessons learned process with assigned owners and deadlines for plan updates.
C) Replace the exercise coordinator with a more experienced individual.
D) Develop a new set of exercise scenarios that are more challenging.
Answer: B
Rationale: A formal lessons learned process with accountability ensures that exercise findings translate into plan
updates, closing the loop. Option A does not address the root cause; C may help but is not systematic; D could
exacerbate the problem.
, 11 In the context of program management for business continuity, which of the following best describes the
primary purpose of a Program Management Office (PMO) when overseeing multiple business continuity
programs across different business units?
A) To centralize decision-making and enforce standardized recovery time objectives (RTOs) across all units
B) To provide governance, resource coordination, and consistent methodologies while allowing unit-level
flexibility
C) To assume full operational responsibility for all business continuity activities within each unit
D) To audit unit-level plans and report non-compliance to executive leadership for corrective action
Answer: B
Rationale: The PMO's role is to provide governance, coordinate resources, and ensure consistent methodologies
across programs, not to impose rigid standards or take over operations. It balances standardization with unit-level
flexibility to adapt to specific needs.
12 A large enterprise is restructuring its business continuity program from a decentralized model to a centralized
program management approach. Which of the following is the most significant risk during this transition?
A) Increased costs due to duplication of efforts across business units
B) Resistance from business unit leaders who lose autonomy and perceive loss of control
C) Inability to maintain compliance with regulatory requirements due to inconsistent implementation
D) Loss of institutional knowledge as key personnel leave during the transition
Answer: B
Rationale: Centralizing program management often meets resistance from unit leaders accustomed to autonomy,
which can hinder cooperation and implementation. While other risks exist, cultural resistance is the most
significant barrier in such transitions.
13 When developing a business continuity program charter, which element is most critical to ensure the program's
sustainability and alignment with organizational strategy?
A) Detailed budget allocations for each business unit
B) Explicit linkage to the organization's risk appetite and strategic objectives
C) Comprehensive list of all critical processes and their recovery priorities
D) Specific performance metrics for program effectiveness
Answer: B
Rationale: A charter must align the program with the organization's risk appetite and strategic objectives to secure
executive support and long-term viability. Budgets and metrics are operational details, and process lists are tactical,
not strategic.
14 In program management, a 'program' differs from a 'project' primarily because a program:
A) Has a defined end date and deliverables
B) Is a temporary endeavor focused on a specific outcome
C) Involves ongoing coordination of multiple related projects and operational activities
D) Is managed by a single project manager with a dedicated team
Answer: C
Rationale: A program is a group of related projects and operational activities managed in a coordinated way to
achieve benefits not available from managing them individually. Unlike projects, programs are ongoing and
involve continuous coordination.