Sample questions
Bt Crisis Communication ManagementDifficulty 1
During an active security incident, an organization designates a single spokesperson to speak externally, instead of letting any engineer answer questions from journalists or customers directly. What is the main benefit of this practice?
- aIt keeps external messaging consistent and accurate, avoiding contradictory statements from different people.✓
- bIt guarantees the incident will be resolved faster, since a spokesperson can fix technical problems personally.
- cIt removes any legal obligation to notify affected customers, since only one person is allowed to speak.
- dIt means engineers no longer need to report incident details internally to anyone.
Explanation:A single designated spokesperson prevents the confusion and reputational damage that comes from multiple people giving different, possibly conflicting, accounts of the same incident to the outside world. It does not speed up technical resolution or remove notification obligations.
Bt Crisis Communication ManagementDifficulty 1
Early in an incident, before the root cause or full scope is known, a team issues a short 'holding statement' acknowledging that something is being investigated. What is the purpose of a holding statement?
- aTo publicly name the exact vulnerability and attacker technique before the investigation is complete, treating maximum technical transparency as more urgent than protecting the ongoing investigation.
- bTo promise a fixed resolution date that the team has not yet confirmed is achievable.
- cTo replace the need for any further communication once it is published.
- dTo acknowledge awareness of the issue and show the situation is being actively handled, without speculating on unconfirmed details.✓
Explanation:A holding statement is a short, factual acknowledgment that buys time for investigation while showing stakeholders the situation is being taken seriously. It deliberately avoids unconfirmed technical detail or promises the team cannot yet back up.
Bt Crisis Communication ManagementDifficulty 2
Before any external statement about a data-related incident goes out, it is routed through legal counsel for review. Why is this step generally required?
- aLegal counsel is responsible for actually writing all the technical remediation steps in the statement, effectively replacing the engineering team's role in describing the fix.
- bLegal counsel checks that wording does not create unintended liability and that it meets applicable notification obligations.✓
- cLegal review exists only to slow down communication and has no real bearing on the content.
- dLegal counsel decides which engineer will fix the underlying vulnerability.
Explanation:Legal review exists because wording choices can create liability (admissions of fault, inaccurate claims) or fail to meet notification requirements. It is a substantive content check, not a technical remediation task or a delay for its own sake.
Bt Crisis Communication ManagementDifficulty 2
During an active incident, an employee posts on their personal social media account: 'looks like we got hacked, pretty bad, more details soon.' What risk does this create for the organization's crisis communication effort?
- aIt creates an uncontrolled, unofficial disclosure that can spread inaccurate details and undercut the coordinated official message.✓
- bIt guarantees the incident will be resolved sooner, since more people are now aware of it.
- cNone, since personal accounts are never associated with the employer by anyone reading them.
- dIt fulfills the organization's legal notification obligation to affected customers automatically, making any further official notice process unnecessary.
Explanation:An unofficial, uncoordinated post can leak premature or inaccurate detail, get amplified before the organization has verified facts, and conflict with the eventual official statement — undermining message consistency, which is exactly what a crisis communication plan tries to protect.
Bt Crisis Communication ManagementDifficulty 1
A company notifies its board of directors about an ongoing incident with more technical detail (specific systems, exploit method) than it initially includes in a public customer notice, which focuses on impact and recommended actions. Why does this difference in content make sense?
- aBecause board members always need less information than customers about any topic.
- bBecause each audience needs information tailored to what they must decide or do, and customers generally do not need internal technical detail to act.✓
- cBecause customers are legally forbidden from ever receiving any technical information about an incident, under every jurisdiction and regulatory regime without exception.
- dBecause the board notice should always be published publicly at the same time as the customer notice.
Explanation:Effective incident communication is tailored per audience: the board needs enough detail to oversee risk and decisions, while customers primarily need to understand impact and what action (if any) to take. Neither audience needs the same level or type of detail as the other by default.
Bt Crisis Communication ManagementDifficulty 2
A team maintains a public status page during an incident. Why is it important that every update posted there be verified before publishing, rather than posted as soon as someone has a guess?
- aVerifying updates before posting is required only for incidents involving payment data, never for any other kind of incident.
- bStatus pages are only ever read by internal engineers, so accuracy has no external consequence.
- cOnce posted, a status page update can never legally be corrected or updated again.
- dAn inaccurate public update that later has to be retracted damages trust more than a slightly delayed, accurate one.✓
Explanation:A public status page is often the primary source stakeholders check; an update that turns out wrong and must be walked back erodes credibility more than a brief delay while facts are confirmed. This applies broadly, not just to payment-related incidents.