CBCI Exam Questions & Answers

In BC validation and exercising, ''injects'' are simulated messages used to drive decisions and actions. Using a clear code word (e.g., ''For exercise'' / ''Exercise only'') is essential to prevent simulated information being mistaken for a real incident notification---especially when exercise communications travel through normal channels (phone, radio, email, chat). This protects people, avoids unnecessary escalation, and prevents operational disruption caused by staff believing a real emergency is underway. Exercise guidance commonly defines ''For Exercise'' as a preamble meaning the message relates to the exercise only and ''is not to be confused with real activity,'' and recommends prefixing simulated calls/messages accordingly.

Therefore, option A is correct.

Option B (confidentiality) is not the main purpose of the code word; confidentiality is handled through exercise ground rules and distribution controls. Option C is not what the code word signifies. Option D is the opposite of the intent---while participants should act realistically within the exercise play, the code word ensures everyone understands the scenario is simulated, preventing real-world misinterpretation and unintended consequences.

In CBCI 7.0, exercising sits within Validation (PP6) and is used to confirm that plans, procedures, and response structures can achieve the objectives set by the BC policy and BCMS requirements. An exercise programme must therefore be designed around the scenario and the capabilities being validated---meaning the correct participants are those who would actually perform roles during that type of disruption (strategic decision-makers, incident/crisis team roles, operational recovery leads, communications, IT/service owners, and key support functions), plus any dependent parties as needed.

That is exactly what option D states: include everyone with a role in a team relevant to the scenario being exercised. Including all employees (A) is unnecessary and often counterproductive; awareness activities can target all staff, but exercises should be role-based and objective-led. Including only the response team (B) excludes essential recovery and support roles that are frequently critical to product/service restoration. Including only BC professionals (C) turns an organizational capability test into a specialist discussion and fails to validate real execution.

In CBCI 7.0 (aligned with BCI GPG 7.0), Embracing Business Continuity (PP2) is a shift away from ''mandating and enforcing compliance'' toward building understanding, ownership, and sustained engagement across the organization. A practical technique for improving culture is therefore relationship-driven: building trust with stakeholders, aligning on why BC matters, and helping people work toward shared outcomes (protecting purpose, products/services, and those who depend on them).

Option A matches this intent because culture change happens through influence, collaboration, and common goals---not through policing. By contrast, option C (more audits) often reinforces compliance behaviour rather than genuine ownership (and PP2 explicitly warns against relying on compliance enforcement as the core cultural lever). Option D (''mandatory'' exercises for all) is neither targeted nor practical; exercises should involve those with roles relevant to the scenario. Option B (BIA workshops) is useful for analysis but is not, by itself, the primary culture-improvement technique described by PP2.

The CBCI 7.0 course clarifies that conducting a gap analysis is the initial step in developing recovery strategies and solutions. The gap analysis compares current Business Continuity capabilities with the requirements identified in the BIA and risk assessments, highlighting deficiencies that must be addressed. This systematic evaluation informs strategy development by identifying where improvements or new solutions are necessary. While policy development and stakeholder consultation are important subsequent steps, gap analysis provides the evidence base required for informed decision-making. Training personnel comes later as part of implementation.

The CBCI 7.0 course stipulates that appointing deputies or alternates for each BCMS role is a governance best practice ensuring continuity of responsibility and decision-making. Deputies are subject matter experts equipped to act on behalf of the primary role holder during absences, maintaining operational integrity and responsiveness. Relying on the Business Continuity professional or Incident Response Team to cover absent roles without formal deputization risks delays and gaps. Putting responsibilities on hold is unacceptable as it compromises continuity efforts.