CBCI Certificate of the Business Continuity Institute (CBCI) Free Practice Exam Questions (2026 Updated)

The RTO represents the maximum acceptable time to restore activities following disruption, and it must always be shorter than the Maximum Tolerable Period of Disruption (MTPD), which is the absolute limit before unacceptable impacts occur. The CBCI 7.0 course explains that this ensures recovery efforts occur within tolerable timeframes, preventing critical losses. The RPO concerns data restoration points and is not a time period comparison. The MBCO relates to minimum acceptable outputs and is not a time-based measure.

In GPG-aligned CBCI 7.0 practice, the BIA estimates impacts over time and identifies what must be recovered, in what order, and with what minimum capability. A key BIA output is a clear view of the resources and dependencies needed to deliver the organization’s prioritised activities—including people/skills, information and data, technology, premises, finance, suppliers, and key internal/external interdependencies. This is foundational because strategies and solutions (PP4) and the enabling plans (PP5) must be based on what the BIA proves is required to restore delivery.

Therefore, option A is correct: those requirement categories are analysed specifically to identify the dependencies that enable prioritised activities to continue or resume.

Option B (general business plan) is broader strategic planning, not the specific continuity dependency mapping output from a BIA. Option C relates to culture development (PP2), not BIA dependency capture. Option D (response structure) uses BIA outputs, but the direct purpose of gathering people/data/finance/supplier requirements during BIA is to map the resources and dependencies for prioritised activities.

Exercising business continuity plans involves balancing the need to simulate realistic scenarios while minimizing unintended disruption to normal operations. The CBCI 7.0 course instructs that exercise planners must anticipate and control any business as usual impacts through careful planning, monitoring, and mitigation during the exercise. Ignoring risks or dismissing business as usual commitments undermines organizational operations and can reduce support for continuity activities. Managing disruption effectively ensures exercises achieve their objectives without unnecessary operational costs.

The CBCI 7.0 course defines embracing Business Continuity as a cultural commitment by personnel who recognize the importance of Business Continuity in protecting organizational interests. It goes beyond policy mandates or role compliance and reflects genuine belief and ownership. Embracing Business Continuity is integrated with the broader organizational culture rather than existing separately. This deep commitment improves resilience and the effectiveness of continuity efforts at all levels.

The CBCI 7.0 course stresses that governance arrangements are key to securing ongoing commitment and support across all levels and functions within an organization. Effective governance structures facilitate leadership involvement, resource allocation, decision-making, and accountability, which are crucial for embedding Business Continuity. While project risk registers and research are valuable tools, and authority is necessary, governance’s primary function is to maintain organization-wide engagement and alignment, ensuring the BCMS is sustained and evolves with business needs.

Aligning supplier capabilities with the organization’s RTOs is essential to maintain continuity of critical supply chain functions. The CBCI 7.0 course specifies that suppliers must be able to recover and deliver their products or services within timeframes that meet the organization’s recovery requirements to avoid operational disruption. While quality in business as usual and procurement review are important, they do not guarantee supplier resilience. Prioritizing existing suppliers solely on relationship basis without evaluating continuity capability risks supply failures. Ensuring RTO alignment is a critical criterion in supplier strategy development.

A Business Continuity policy acts as a foundational document that communicates the organization’s commitment to Business Continuity and sets out its scope, objectives, and principles. The CBCI 7.0 course stresses that the policy fosters a shared understanding across the organization about the importance of the BCMS and ensures that personnel recognize its relevance to their roles. It does not specify operational details or mandate actions but guides governance and culture. The policy supports alignment of efforts and continuous improvement of the BCMS.

The CBCI 7.0 course stipulates that appointing deputies or alternates for each BCMS role is a governance best practice ensuring continuity of responsibility and decision-making. Deputies are subject matter experts equipped to act on behalf of the primary role holder during absences, maintaining operational integrity and responsiveness. Relying on the Business Continuity professional or Incident Response Team to cover absent roles without formal deputization risks delays and gaps. Putting responsibilities on hold is unacceptable as it compromises continuity efforts.

During an incident, immediate people-related requirements prioritize life safety, welfare, and accountability. In BC response structures, People/HR (often called People & Culture) typically focuses first on confirming who is affected, ensuring personnel are safe, supporting access to medical/physical care, and establishing reliable communications with staff and (where appropriate) family members. These actions reduce harm and enable leadership to make accurate decisions about escalation and support. This aligns with crisis/incident management good practice where “accounting for people” and welfare support are immediate priorities before broader recovery work is initiated. (ready.gov)

Option C—assigning recovery responsibilities to staff away from the site—is important for recovery enablement, but it is not an immediate care/wellbeing requirement. It belongs more to operational recovery coordination and plan activation once the immediate safety picture is understood. Options A, B, and D are directly tied to immediate welfare: confirm personnel status, contact and support staff/families, and enable access to care. Therefore, C is the correct “NOT immediate requirement” for the People and Culture Management team when the focus is specifically care and wellbeing.

CBCI 7.0 expects visible leadership commitment because BCMS success depends on senior sponsorship, resourcing, and consistent messaging. When top management embraces BC, they actively support awareness, training, and engagement so BC becomes understood beyond the small group formally involved in the BCMS. The BCI’s PP2 guidance highlights that embracing business continuity is a process of education and awareness—reminding staff what is at stake and who depends on the organization’s products and services. Leaders who embrace BC amplify this through promoting awareness and training across the workforce.

Option A contradicts good practice: a BCMS should be aligned to organizational purpose and objectives, not independent. Option C is the opposite of the expected outcome. Option D describes weak governance—reviews only “if time permits” and slow follow-up—whereas leadership embrace typically strengthens governance cadence and improvement discipline. Therefore, B is the correct outcome.

A response structure exists to ensure the organization has a documented mechanism for responding to an incident regardless of cause, with clear command, control, escalation, and communications. A “critical requirement” for such a structure is having clearly understood procedures for activation and control—i.e., how teams are stood up, who has authority, how decisions are made, and how the response is coordinated once activated. This is explicitly called out as a key requirement for an effective response structure.

Option B (monitoring/early recognition) is also important, but it is one component. The question asks for a critical requirement when creating the structure; activation and control procedures are foundational because without them, even a well-designed structure cannot be reliably mobilised or governed during disruption.

Option A (BIA summary) informs priorities, but it is not a defining requirement of the response structure mechanism itself. Option D relates to analysis/review after an incident, which supports improvement, but it is not the core requirement needed to operate the response structure during an incident. Therefore, C is the best answer.