CISSP Security Operations Practice Question
Which of the following BEST describes the difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?
⚠ Common exam trap
Many candidates confuse the scope of BCP and DRP, mistakenly thinking BCP is only for business processes and DRP only for IT, when in fact BCP is the overarching plan that includes DRP as a component for IT recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BCP ensures business functions continue, DRP restores IT operations
D is correct because the Business Continuity Plan (BCP) focuses on maintaining critical business functions during and after a disruption, ensuring minimal impact on operations, while the Disaster Recovery Plan (DRP) is a subset of BCP that specifically addresses the restoration of IT infrastructure, systems, and data after a disaster. The BCP encompasses broader organizational resilience, including manual workarounds and alternate sites, whereas the DRP targets technical recovery procedures such as system rebuilds, data restoration from backups, and failover to redundant systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
BCP deals with natural disasters, DRP deals with cyberattacks
Why it's wrong here
This statement incorrectly limits the scope of Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP) to specific threat categories. Both BCP and DRP are designed to address a wide array of disruptive events, encompassing natural disasters, cyberattacks, human error, infrastructure failures, and pandemics. Their effectiveness lies in their ability to provide resilience regardless of the incident's origin, focusing on impact rather than solely on the cause of the disruption.
- ✗
BCP is for IT systems, DRP is for business processes
Why it's wrong here
This option reverses the fundamental scopes of Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP). BCP is an overarching program focused on maintaining critical business processes and functions during and after a disruption, ensuring the organization can continue its mission. Conversely, DRP specifically targets the recovery and restoration of an organization's information technology (IT) systems, infrastructure, and data, which are essential enablers for those business processes.
- ✗
BCP is a subset of DRP
Why it's wrong here
Stating that Business Continuity Planning (BCP) is a subset of Disaster Recovery Planning (DRP) fundamentally misunderstands their hierarchical relationship. BCP is the comprehensive strategic framework that ensures the entire organization's continued operation during and after a significant disruption, encompassing all aspects including people, facilities, and processes. DRP, focused specifically on the recovery of IT infrastructure and data, is typically a critical component or subset *of* the broader BCP program, providing the technological foundation for business continuity.
- ✓
BCP ensures business functions continue, DRP restores IT operations
Why this is correct
This statement accurately distinguishes between the primary objectives of Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP). BCP is the strategic, holistic program designed to ensure that an organization's essential business functions can continue operating at an acceptable level during and immediately after a disruptive event. DRP, on the other hand, is the tactical plan focused specifically on the systematic recovery and restoration of the organization's critical information technology systems, applications, and data to an operational state.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.