10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The CBCA exam has 100 questions and runs 2 hours 30 minutes.
These 10 free CBCA questions are organized by exam domain, so you can see how each part of the Certified Business Continuity Auditor blueprint is tested. Reveal the answer and explanation under each question.
Before fieldwork, an auditor discloses that she still approves the recovery procedures she has been assigned to assess. A second auditor is qualified, available for the scheduled work, and has no responsibility for those procedures. Which approach removes the self-review problem while keeping the scheduled fieldwork?
Correct answer: D - Assign the assessment and its conclusions to the second auditor.
A transport company combines quality, information-security, and business-continuity management reviews. Top management participates at planned intervals, and the retained records satisfy the required BCMS review inputs and outputs, including decisions and follow-up actions. A draft audit finding cites only the absence of a separate continuity review meeting. How should this draft finding be handled?
Correct answer: A - Remove it; a separate meeting is not required when BCMS review requirements are met.
A laboratory's business continuity management system covers sample receipt through delivery of verified reports. Its cloud provider supplies a valid ISO 22301 certificate covering 'payroll and human-resources hosting.' The laboratory-information service is explicitly outside that certified scope. The laboratory has relied on this certificate as its sole continuity assurance for that service. What does the certificate establish for this audit?
Correct answer: A - It leaves continuity capability for the laboratory-information service unverified.
The management-review dashboard reports '98% continuity readiness' because 49 of 50 improvement actions are complete. The remaining action concerns the only distribution site's inability to meet its recovery time objective. Most completed actions involved document updates and staff briefings. Before this dashboard supports resource decisions, what needs to change?
Correct answer: C - Report action completion separately from achievement of the required recovery capability.
After verified flood defences reduce the likelihood of a packaging-plant outage, the risk owner extends the plant's recovery target from six hours to 36 hours. The BIA still identifies unacceptable supply impacts after ten hours without production, regardless of the outage's cause. Customer commitments and acceptable-impact criteria have not changed. Which part of the decision lacks support?
Correct answer: B - Concluding that lower outage likelihood permits a longer interruption despite unchanged business-impact limits.
An insurer's four-hour recovery time objective runs from an outage to usable claims processing. Recovery begins immediately: network restoration takes 30 minutes, then application restoration (75 minutes) and database restoration (135 minutes) run in parallel. Business validation takes another 45 minutes after both finish; claims cannot be processed before validation ends. All other required resources are available. What recovery result should the auditor record?
Correct answer: B - 210 minutes; usable claims processing resumes within the four-hour objective.
Transactions continue until a database outage at 11:50. The newest usable recovery set contains committed transactions through 11:26, although its backup job finished at 11:43. No later transaction log or other copy is recoverable. The approved recovery point objective allows at most 15 minutes of data loss. Which statement correctly evaluates the recovery point?
Correct answer: B - Twenty-four minutes of data loss; the recovery point objective was missed.
A contact centre needs recovery within four hours, no more than 15 minutes of data loss, and sustained capacity of at least 180 completed calls per hour. Normal capacity is 400 calls per hour. All proposals have verified staffing, access, and data integrity. Procurement policy requires the lowest annual cost among arrangements meeting the approved continuity requirements. Which proposal meets that selection rule?
Correct answer: A - 3-hour recovery; 10-minute data loss; 200 calls/hour; $60,000 annually.
Engineers forecast a three-hour outage at a service centre. The continuity plan permits a tested manual procedure when an outage is expected to exceed one hour. The named deputy may activate it after five minutes of unsuccessful attempts to reach the duty manager. Eight minutes of contact attempts have failed, and the manual procedure is ready to use. The deputy asks whether an executive must approve activation. The plan authorizes the deputy to:
Correct answer: D - Activate the manual procedure now under the delegated authority.
Night-shift deputies pass a written continuity test and correctly explain the activation trigger and their authority. In a practical assessment, however, they cannot send an alert through the fallback notification service. Their credentials work and the current instructions are available. Before competence for this duty can be demonstrated, what further evidence is needed?
Correct answer: C - Observed correct alert transmission by the deputies using the available instructions.
The CBCA exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more CBCA questions with explanations.
Continue in the free practice test →
View plans