ISO 22301 Lead Implementer

Ten sample exam questions

One per competency domain, exactly as they appear in the simulator.

1. Domain 1 - Fundamental Principles and Concepts of Business C

   Which standard provides the concepts and vocabulary for security and resilience used across the ISO 22300 family?

   1. ISO 22301
   2. ISO 22313
   3. ISO 22300
   4. ISO 22320

2. Domain 2 - Business Continuity Management System Requirement

   An organisation plans to relocate its data centre and expand its customer base, and wants these BCMS changes carried out in a planned manner that preserves the integrity of the BCMS. Which clause applies?

   1. Clause 4.1 - context of the organisation
   2. Clause 6.3 - planning of changes to the BCMS
   3. Clause 8.6 - evaluation of business continuity documentation
   4. Clause 10.2 - continual improvement

3. Domain 3 - Planning of a BCMS Implementation

   Approximately how long does a BCMS implementation project typically last, from the first planning process to the conclusion of the first cycle of audits and monitoring?

   1. 2 to 3 years
   2. 6 to 12 months
   3. 1 to 3 months
   4. 3 to 5 years

4. Domain 4 - Implementation of a BCMS

   During risk identification, an analyst notes that one prioritised activity runs on a single server with no redundancy. This is best described as:

   1. An inherent consequence that by nature cannot be reduced
   2. A supporting asset whose target risk is already acceptable
   3. A vulnerability representing a single point of failure
   4. A residual risk that has already been reduced by existing controls

5. Domain 5 - Monitoring and Measurement of a BCMS

   What does an internal BCMS audit primarily determine?

   1. The effectiveness and adequacy of the BCMS
   2. The effectiveness of administrative practices only
   3. The market relevance of the business continuity policy
   4. The accounting compliance of the organisation's financial statements

6. Domain 6 - Continual Improvement of a BCMS

   An organisation is looking for sources of improvement opportunities for its BCMS. Which of the following is a recognised source?

   1. A general lengthening of the recovery time objective for every prioritised activity in scope
   2. A deliberate reduction in the number of interested parties who are consulted about the BCMS
   3. Changes in context, internal structure, means of production or delivery, methodology and technology
   4. The removal of existing performance measures so that fewer results have to be reported

7. Domain 7 - Preparing for a BCMS Certification Audit

   Before an organisation's recertification audit, significant changes to legislation have affected its BCMS. What may the certification body do as a result?

   1. Include a stage 1 audit as part of the recertification because of the significant changes
   2. Automatically withdraw the certificate until the new legislation is met
   3. Skip the on-site audit because the current certificate is still valid
   4. Replace the recertification audit with a single ordinary surveillance visit on a permanent basis, without ever re-examining the effectiveness of the whole management system

8. Domain 1 - Fundamental Principles and Concepts of Business C

   Which standard provides guidelines for public warning?

   1. ISO 22322
   2. ISO 22398
   3. ISO 22316
   4. ISO 22320

9. Domain 2 - Business Continuity Management System Requirement

   An organisation is deciding where in ISO 22301 to find requirements on staff competence, communication and documented information. Which clause covers these support topics?

   1. Clause 9 (internal audit and management review)
   2. Clause 7 (Support)
   3. Clause 4 (context, interested parties and scope)
   4. Clause 10 (nonconformity and corrective action)

10. Domain 3 - Planning of a BCMS Implementation

    A draft set of business continuity objectives has been prepared. What does the material require regarding their approval and status?

    1. They must be validated and approved by top management and documented
    2. They must be approved by the certification body before any use
    3. They must be approved solely by the external certification body's lead auditor
    4. They need no approval because they are only informal targets

Answer these same ten questions in the simulator and see the explanation of every option, including the wrong ones. It opens with no sign-up →

About the official exam: its format, duration and number of questions are set by the certification body and may change, so confirm them in its documentation before you sit it. This material trains the standard, not one body's exam, so it is just as useful if you certify elsewhere.