Free PECB Lead Crisis Manager Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Lead Crisis Manager practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A public health crisis communicator reports that a behavior doubles a risk from a baseline of 1 in 100. Which statement gives both the baseline and the resulting absolute risk accurately?

   1. A.The risk changes from 1 in 100 to 2 in 100.Correct answer: A
   2. B.The risk changes from 1 in 100 to 1 in 200.
   3. C.The risk changes from 1 in 100 to 3 in 100.
   4. D.The risk changes from 1 in 100 to 1 in 25.

   Explanation: CDC advises presenting absolute numbers: "This behavior increases your risk from 1 in 100 to 2 in 100". Doubling 1 in 100 yields 2 in 100; the alternatives give a halved, tripled, or quadrupled risk.

   Reference: Understanding and Applying Risk Communication Principles — Use and Explain Numbers Clearly, Avoid using relative risk information

2. 2A crisis management team wants to test its coordination functions in a realistic, real-time environment while normally simulating resource movement. Which HSEEP exercise type is designed for this purpose?

   1. A.A tabletop exercise
   2. B.A functional exerciseCorrect answer: B
   3. C.A full-scale exercise
   4. D.A seminar exercise

   Explanation: FEMA describes a functional exercise as "designed to test and evaluate capabilities and functions while in a realistic, real-time environment; however, movement of resources is usually simulated." Tabletop exercises and seminars are discussion-based; full-scale exercises typically involve actual movement of resources.

   Reference: Homeland Security Exercise and Evaluation Program — p. 2-10, Table 2.8: Functional Exercise

3. 3After an organization implements controls against an identified disruption, the crisis manager measures the risk that actually remains. What does NIST call this quantity?

   1. A.Inherent risk
   2. B.Risk appetite
   3. C.Target residual risk
   4. D.Actual residual riskCorrect answer: D

   Explanation: NIST defines actual residual risk as "The risk remaining after management has taken action to alter its severity." Inherent risk is assessed without focused management action; target residual risk describes the risk the organization prefers to assume.

   Reference: NIST Computer Security Resource Center Glossary: Actual Residual Risk — Definitions, NISTIR 8286

4. 4A recovery team sets a limit on the amount of transaction data that may be lost when a disrupted service is restored. Which continuity objective expresses that limit?

   1. A.Recovery time objective
   2. B.Minimum business continuity objective
   3. C.Recovery point objectiveCorrect answer: C
   4. D.Maximum tolerable period of disruption

   Explanation: PECB states, "The RPO is the maximum acceptable amount of data that can be lost during a disruption period." RTO concerns the targeted restoration time, MTPD concerns maximum tolerable disruption, and MBCO specifies a minimum service level.

   Reference: Key Definitions Used in ISO 22301 and ISO 22313 — Recovery Point Objective (RPO)

5. 5An organization is defining documents for disruptions. Which plan primarily guides leaders' decisions and coordination during a crisis, according to PECB's continuity guidance?

   1. A.Crisis communication plan
   2. B.IT disaster recovery plan
   3. C.Crisis management planCorrect answer: C
   4. D.Business continuity plan

   Explanation: PECB states that the "CMP guides how leaders make decisions and coordinate during a crisis". Its material distinguishes this plan from the business continuity, IT recovery, and crisis communication plans.

   Reference: Mastering Business Continuity: ISO 22301 Strategies for Real-World Resilience — p. 14, What Business Continuity Is Not

6. 6A crisis exercise controller needs the chronological timeline of scripted events to inject during play so participants can demonstrate the exercise objectives. Which HSEEP document provides it?

   1. A.Exercise evaluation guide
   2. B.Master scenario events listCorrect answer: B
   3. C.After-action report and improvement plan
   4. D.Exercise evaluation plan

   Explanation: FEMA defines the MSEL as "a document or system that is a chronological timeline of expected actions and scripted events to be injected into exercise play by controllers". Evaluation guides support observation, evaluation plans structure evaluation, and after-action reports document exercise results and corrective actions.

   Reference: Homeland Security Exercise and Evaluation Program — Chapter 4, Master Scenario Events List

7. 7Using CISA's Security Planning Workbook method, a crisis planner rates threat severity 3, probability 2, vulnerability 4, and consequence 6. What total risk score results?

   1. A.26
   2. B.120Correct answer: B
   3. C.144
   4. D.15

   Explanation: CISA directs users to "Add these two numbers together" for the threat rating and then "multiply these three numbers (TxVxC)". Thus (3 + 2) × 4 × 6 = 120. The other results come from adding all values, multiplying all four values, or adding the consequence after the first multiplication.

   Reference: Security Planning Workbook — p. 25, Calculating Risks

8. 8To set recovery priorities, a manager analyzes how interruption affects business functions and identifies time-critical activities and resources required for recovery. Which analysis is being performed?

   1. A.Threat assessment
   2. B.Business impact analysisCorrect answer: B
   3. C.After-action review
   4. D.Vulnerability assessment

   Explanation: PECB defines business impact analysis as "The process of analysing the effect of a disruption on business functions, including the determination of time-critical activities and the resources required for continuity and recovery." That is the work described in the scenario.

   Reference: Mastering Business Continuity: ISO 22301 Strategies for Real-World Resilience — p. 12, Definitions and Terms

9. 9During an emergency, an audience accepts the first report it hears and judges a later, more accurate update against it. Which information-processing tendency in CDC's CERC guidance does this illustrate?

   1. A.Looking for additional information
   2. B.Believing the first messageCorrect answer: B
   3. C.Holding on to current beliefs
   4. D.Simplifying complex messages

   Explanation: CDC explains that "The first message to reach us may be the accepted message, even though more accurate information may follow." The scenario concerns the effect of an initial report, not confirmation seeking, established prior beliefs, or simplification.

   Reference: CERC: Psychology of a Crisis — p. 3, We believe the first message

10. 10A crisis response uses the Incident Command System. Its manager assigns each responder one supervisor to prevent conflicting tasking. Which ICS management principle is being applied?

    1. A.Unified command
    2. B.Unity of commandCorrect answer: B
    3. C.Chain of command
    4. D.Span of control

    Explanation: FEMA states, "Unity of command means that each individual involved in incident operations will be assigned – and will report – to only one supervisor." Unified command coordinates responsible agencies, chain of command establishes the hierarchy, and span of control concerns the number of subordinates.

    Reference: ICS Leadership and Management: Chain of Command and Unity of Command — Chain of Command and Unity of Command