CBCI Certificate of the Business Continuity Institute (CBCI) Free Practice Exam Questions (2026 Updated)

The CBCI 7.0 course defines that the BCMS scope must be regularly reviewed and updated in response to significant changes in the organization’s internal or external context. Such changes could include shifts in business operations, legal requirements, market conditions, or organizational structure that affect Business Continuity requirements. This ensures that the BCMS remains relevant and effective. While fresh perspectives and personnel engagement are important, scope reviews are driven by contextual changes.

A BCMS depends on clearly defined organizational roles, responsibilities, and authorities so that continuity tasks are not “assumed” or left to chance. In CBCI 7.0’s BCMS establishment practice, assigning roles and responsibilities ensures every required BCMS activity (e.g., analysis participation, strategy ownership, plan maintenance, exercising, and review) is allocated to named people who are competent and understand what is expected of them. This aligns with ISO 22301’s leadership requirement that responsibilities and authorities for relevant roles are established and communicated, so the management system can be implemented and maintained effectively.

Option B best reflects that intent: allocate essential tasks to identified and competent individuals.

Option A is incorrect because governance does not remove top management accountability; leadership remains responsible for direction and ensuring the BCMS is supported. Option C is too narrow (roles exist for the organization’s capability, not just to “help the BC professional”). Option D may be a benefit of training, but it is not the primary purpose of role assignment—role assignment is about clear accountability and dependable execution across the BCMS.

When selecting solutions, resource or activity owners focus on factors such as advantages, disadvantages, costs, and implementation timelines, which directly affect feasibility and operational impact. The CBCI 7.0 course clarifies that while validation exercises are important for testing solutions, the choice and evaluation of solutions themselves typically do not consider the type of exercises planned for later validation phases. Exercise planning is a separate activity handled by the validation team, not the solution selectors.

Business as usual (BAU) plans are designed to restore normal operational conditions after a disruption, often returning systems and processes to pre-incident states. The CBCI 7.0 course underlines that these plans must consider new vulnerabilities that may arise as a result of the disruption’s impact on resources or operational environments. Incidents can introduce changes such as weakened controls, damaged infrastructure, or altered workflows, which must be addressed to prevent recurrence or new risks. While BAU plans should be prepared in advance, the focus is not just on resource availability or reversing recovery sequences but on understanding the dynamic context post-disruption. This approach ensures resilience not only in restoration but in strengthening the organization against future incidents.

A Product and Services BIA is used to understand what the organization delivers, the impacts over time if those deliveries are disrupted, and therefore what must be prioritised for continuity and recovery. To do that, it is appropriate to consider contractual requirements and penalties (A), because contractual failure is a common driver of “unacceptable impact” and can influence recovery priorities. It is also appropriate to consider the organization’s objectives and strategic direction (B), because continuity priorities should support what leadership is trying to achieve and protect. Finally, lessons learned from past disruptions and exercises (D) can improve the accuracy of impact assumptions and highlight real-world vulnerabilities that affect products/services.

By contrast, annual training and performance management arrangements (C) are part of competence/culture enablement and governance activities, not the core inputs needed to analyse product/service impacts and prioritisation within a Product & Services BIA. The BIA is primarily an impact-and-priority technique; training/performance processes may support BC capability, but they do not determine product/service impact over time.

The CBCI 7.0 course stresses that the initial step in fostering a Business Continuity culture is estimating the gap between the current level of personnel engagement and the desired state of embracement. This assessment identifies areas where awareness, commitment, or understanding are lacking, providing a baseline to tailor targeted initiatives. This gap analysis enables prioritization of interventions, whether training, communication, or leadership engagement, to bridge the cultural divide effectively. While BIAs and communication strategies support broader continuity efforts, assessing cultural gaps is a necessary precursor to driving meaningful behavioural change.

Embedding Business Continuity into induction and setting objectives for personnel clearly indicates a mature Business Continuity culture. The CBCI 7.0 course details that a strong culture is characterized by widespread awareness, commitment, and integration of Business Continuity principles into everyday activities. Including continuity in induction familiarizes new staff with the organization's resilience expectations, while individual objectives reinforce personal accountability. This cultural embedding supports sustainable continuity practices and improves the likelihood of effective responses during disruptions. It reflects a proactive organizational mindset rather than isolated activities or roles.

Within CBCI 7.0 (aligned to the BCI GPG 7.0 model), Solutions Design is where strategies are selected that best meet the organization’s continuity requirements while remaining viable and proportionate. Crucially, the outcomes of analysis (BIA/RA and any resulting gap picture) are used to highlight “gaps for top management to address or accept.” If top management decides not to fully close certain gaps, the BC professional should treat this as a governance decision (risk/impact acceptance) and then work constructively to refine options that improve resilience within the constraints set by management. Recommending adjusted strategies and solutions (option B) supports continual improvement without ignoring leadership’s decision, and it keeps momentum by delivering partial risk reduction and capability uplift where feasible.

Option A may be appropriate if the decision appears uninformed, but it does not directly move the BCMS forward. Option C is only one possible input to adjustment (cost is not the only constraint). Option D misplaces the timing—validation tests what exists; it is not the stage to “re-pitch” unapproved solutions.

In GPG 7.0, PP5 – Enabling Solutions is explicitly about implementing the agreed solutions from PP4 and ensuring they are usable when needed by developing the response structure and business continuity plans. The guidance stresses that enabling solutions means not only deploying technical or operational measures (e.g., extra data centres, back-up suppliers, alternative locations, training back-up staff) but also ensuring these solutions are supported by the response organization and response plans so they work as designed during an incident.

Therefore, the most correct implementation activity is ensuring alignment with response structure and plans (option C). If solutions are implemented without being embedded into the organization’s response model, roles, procedures, and plan set, they may exist on paper or in technology but fail operationally when activated.

Option A is not a core implementation control. Option B undermines standardization and controlled design by encouraging uncontrolled variation. Option D may be useful in some environments, but “printed versions for all personnel” is not universally required and is less central than ensuring the solution is integrated into the response structure and plans.

In CBCI 7.0, Enabling Solutions (PP5) focuses on implementing the agreed solutions produced in Solutions Design (PP4) and ensuring those solutions can be deployed through the response structure and BC plans. The GPG 7.0 Lite explains that once solutions have been specified and approved (PP4), they must be implemented before they can be deployed, and then supported by response structures and plans. Crucially, validation later confirms that implemented solutions work according to the agreed specifications. That means implementation must align to what was designed and approved—otherwise the organization risks implementing something that does not meet recovery requirements (e.g., RTOs, minimum capacity, dependency assumptions) and will likely fail validation or real incident use. Options A and B misunderstand governance: internal audit doesn’t “approve schedules” as a prerequisite, and the BC professional does not implement everything alone. Option D can undermine control; changes should be managed through governance/change control, not ad-hoc adjustment.

Under CBCI 7.0, response structure development sits in Enabling Solutions (PP5) because it makes the BCMS operational: it defines who responds, how they coordinate, and how decisions and recovery actions are managed during disruption. The core purpose is to ensure the organization has the right teams and role-holders in place to respond to incidents regardless of cause—since BC response structures are typically “all-hazards,” designed to manage disruption impacts whether triggered by technology failure, supplier outage, facility loss, cyber incident, or other events. (ready.gov)

Option C (visual reference) can be a helpful output (e.g., org charts), but it is not the purpose. Option D (alignment with existing chains of command) is often desirable to reduce confusion, but again it is a design principle rather than the fundamental purpose. Option A (awareness) is part of culture/communications work (PP2), not the main reason a response structure exists. Therefore, B best matches the BCMS intent: ensure teams and roles exist to respond effectively to incidents and coordinate recovery.

BC risk mitigation is prioritised so that effort and investment reduce risk where it matters most—i.e., where risk exceeds the organization’s tolerance. In the BCI approach, the Risk Assessment is used to analyse relevant risks to prioritised activities and identify concentrations of risk or points of failure. Those findings then inform Solutions Design decisions, where mitigations are selected to reduce exposure so recovery requirements can be met. If a risk is already acceptable, it may be monitored but does not necessarily require mitigation, because resources should be directed to the risks that threaten priority delivery and could prevent meeting targets like RTO and minimum acceptable capacity.

Option B (“all threats”) is unrealistic and not risk-based; it spreads resources too thin and often results in controls that don’t materially improve resilience. Option D (“selected risks”) is too vague unless “selected” is defined by a risk evaluation step; the correct focus is specifically unacceptable risk—risks that, if realised, would create impacts beyond what the organization will tolerate. Therefore, the best answer is C.

Maintenance refers to the ongoing process of keeping Business Continuity arrangements current and effective in light of organizational or contextual changes. The CBCI 7.0 course clarifies that maintenance involves regular reviews, updates, testing, and adjustments to plans and processes, ensuring readiness and relevance. While review and audit are important, maintenance is the active continuous process that adapts the BCMS to evolving needs.

The purpose of consolidating BIA outputs is to give top management a clear, decision-ready view of what must be protected and recovered first. In CBCI 7.0’s Analysis (PP3), BIAs identify impacts over time and establish priorities and continuity requirements; consolidation brings this together so leaders can approve priorities and ensure strategies/solutions are designed to meet them.

Therefore, the most relevant consolidated information for top management is the ordered priority of products and services, and the associated priority of the activities (and processes where used) that enable those products and services to be delivered (Option C). This is what allows leadership to make informed choices on investment, trade-offs, recovery objectives, and governance decisions (including acceptance of residual gaps).

Options A and B may be useful context but are not the core consolidated BIA output for executive decision-making. Option D is primarily risk assessment territory (likelihood/probability by threat), whereas the BIA is impact-and-priority led; probability is handled in risk assessment after priorities are known, not as the main consolidated BIA deliverable.

Exercises focus on validating the practical elements of Business Continuity arrangements, including the availability of key information, usability of procedures, and reliability of systems and equipment under simulated conditions. The CBCI 7.0 course clearly distinguishes that the business impact analysis (BIA) process itself is a planning and analysis activity, not a response function, and therefore is not subject to validation through exercises. BIAs are validated through reviews and audits rather than operational testing. Exercises are designed to test response and recovery capabilities, communication flows, and system robustness in real-time or simulated disruptions. Validating the BIA design requires analytical review, stakeholder engagement, and continuous improvement processes, which occur separately from exercises. This differentiation ensures that exercises focus on operational readiness rather than procedural design.

An internal audit is designed to provide independent, objective assurance by evaluating the effectiveness of governance, risk management, and control processes. In a BCMS context, internal audit can assess whether BCMS processes (policy control, BIA/RA governance, plan management, exercising cadence, document control, corrective action tracking) are being followed and are effective as management controls. Importantly, internal audit’s focus is typically on whether processes are adequate and working as intended—not on guaranteeing that the chosen continuity solutions are “the best possible” in an absolute sense. That matches the question’s description: independent assurance on processes without necessarily confirming the adopted solutions are “correct.”

Performance appraisal is an HR tool, not independent assurance. Post-incident review captures learning from a real event and may include subjective performance insights, but it is not primarily an independent assurance mechanism. Quality assurance checks adherence to standards, but it is often not independent in the same formal way as internal audit. Therefore, A is the best answer.

The CBCI 7.0 course details that using pre-defined impact thresholds is an effective and consistent method for prioritizing products, services, and activities during a BIA. These thresholds establish clear criteria for impact levels across various categories, such as financial loss, reputational damage, and regulatory consequences. By applying standardized thresholds, organizations can objectively assess and compare the criticality of different business functions, ensuring that prioritization aligns with organizational risk appetite and strategic objectives. This approach promotes consistency, transparency, and repeatability in BIA processes. While risk matrices and gap analyses are useful tools in risk management, pre-defined impact thresholds directly guide priority-setting within BIAs.

In CBCI 7.0 (aligned to BCI GPG 7.0), supplier prioritisation is driven by business continuity requirements, not convenience. The GPG Lite 7.0 defines priority suppliers as those that support prioritised activities and would have the greatest impact if they fail to deliver required resources—thereby affecting the organization’s ability to deliver its products or services. When developing solutions, this means focusing first on suppliers that the organization needs earliest to meet recovery requirements, which typically aligns to shorter RTOs for the activities/products they support. If an activity must be resumed quickly, the supplier inputs that enable that activity must also be available quickly; otherwise, the RTO cannot be met even if internal teams are ready.

Options C and D are not reliable criteria: proximity and prior contracting may help logistics, but they do not tell you whether supplier failure would jeopardize priority delivery within required timeframes. Option A (longer RTO) would delay attention away from the most time-critical dependencies. Prioritising suppliers supporting short-RTO activities is therefore the most CBCI-consistent approach.

The CBCI 7.0 course explains that defining the BCMS scope is a dynamic process, which means that the parameters set are not necessarily permanent and may be reviewed and revised as organizational needs, risks, and priorities evolve. While the scope provides clarity on which parts of the organization, products, services, and activities are included, it must remain flexible to adapt to change. Permanent or fixed parameters risk locking the BCMS into outdated or incomplete coverage, reducing effectiveness. Efficient use of time and resources is a benefit of appropriate scoping, but permanence is not a characteristic of good scope definition.