EC-Council • EDRP
Validates the ability to develop and implement business continuity and disaster recovery plans, covering business impact analysis, risk assessment, recovery strategy development, emergency response procedures, recovery site management, and disaster recovery plan testing and maintenance.
Questions
623
Duration
240 minutes
Passing Score
70%
Difficulty
ProfessionalLast Updated
Feb 2026
The EC-Council Certified Disaster Recovery Professional (EDRP), exam code 312-76, is a professional-level certification that validates a candidate's ability to plan, strategize, implement, and maintain comprehensive business continuity and disaster recovery (BC/DR) programs. The credential covers the full lifecycle of disaster preparedness: from conducting business impact analyses and risk assessments to designing recovery strategies, managing recovery sites, and testing and maintaining disaster recovery plans. It addresses data backup and recovery, virtualization-based recovery, centralized and decentralized system restoration, and telecommunications continuity.
The EDRP v3 curriculum aligns with major industry compliance frameworks including ISO 22301, ISO 22313, ISO 27001, ISO/IEC 27005, ISO 31000, ISO 31010, NFPA 1600, INCITS 483-2012, and the NIST NICE Framework. The program includes cloud-based virtual labs that allow candidates to practice BC/DR techniques in simulated enterprise environments. Recognized under DoD 8570/8140, the EDRP is accepted by U.S. government and military employers as a qualifying credential for information assurance and continuity roles.
The EDRP is designed for IT and information security professionals who are responsible for—or transitioning into—business continuity and disaster recovery roles. Ideal candidates include network and systems administrators, firewall and security administrators, risk assessment professionals, IT infrastructure managers, and cybersecurity analysts who need to formalize their BC/DR knowledge with a vendor-neutral, globally recognized credential.
The certification is also well-suited for IT managers and project managers who oversee organizational resilience programs, as well as professionals in regulated industries such as financial services, healthcare, and government who must demonstrate compliance with continuity standards. Candidates with at least a foundational understanding of IT infrastructure and information security will benefit most, though no strict prior certification is required.
There are no mandatory formal prerequisites to sit for the EDRP exam. However, EC-Council recommends that candidates have some practical experience in the IT BC/DR domain before attempting the certification. A working knowledge of IT infrastructure, basic information security concepts, and familiarity with organizational processes is strongly advised.
Candidates who have completed an official EC-Council course at an Accredited Training Center (ATC), an Academia Partner institution, or through the EC-Council iClass platform are automatically eligible to sit for the exam. Those who have not completed an official EC-Council course must submit an Exam Eligibility Application along with a non-refundable $100 USD fee and demonstrate a minimum of two years of work experience in the information security domain before being approved to test.
The EDRP exam (code 312-76) consists of 150 multiple-choice questions and must be completed within 4 hours. The passing score is 70%. The exam is delivered at authorized ECC Exam Centers and is also available at Pearson VUE testing centers worldwide. The certification is valid for three years, after which recertification is required through EC-Council Continuing Education (ECE) credits.
The exam tests knowledge across all core BC/DR domains rather than being divided into weighted sections with published percentages. Candidates are assessed on practical understanding of disaster recovery planning methodologies, risk and business impact analysis techniques, recovery strategies, and emergency response procedures. No unscored or survey questions have been officially disclosed by EC-Council.
EDRP-certified professionals are positioned for roles such as Disaster Recovery Specialist, Business Continuity Planner, IT Risk Manager, IT Infrastructure Manager, and Cybersecurity Analyst. Salaries for disaster recovery professionals in the United States typically range from approximately $75,000 to $125,000 annually, with median figures around $95,000 depending on experience, organization size, and location. The certification is recognized under DoD 8570/8140, making it particularly valuable for professionals seeking federal government, defense contractor, or military positions.
The global disaster recovery solutions market was valued at $10.93 billion in 2024 and is projected to reach $24.56 billion by 2029—a CAGR of roughly 17.5%—reflecting strong and growing employer demand for credentialed BC/DR professionals. Compared to alternatives such as the DRII CBCP (Certified Business Continuity Professional) or ISACA's CRISC, the EDRP is distinguished by its technical depth in IT systems recovery, its virtual lab component, and its alignment with EC-Council's broader cybersecurity certification ecosystem, making it a strong complement to credentials like CEH or CISSP for security-focused professionals.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 623 questions.
1. An organization implementing ISO 22301:2019 business continuity management system conducts its annual management review. According to the PDCA cycle framework, which ISO 22301 clause governs this performance evaluation activity? (Select one!)
Explanation
Clause 9 Performance Evaluation falls within the Check phase of the PDCA cycle and specifically covers measuring business continuity performance, assessing BCMS conformity with the standard, and conducting management reviews. Clause 6 Planning is in the Plan phase and focuses on establishing objectives, not evaluating them. Clause 8 Operation is in the Do phase for implementing procedures. Clause 10 Improvement is in the Act phase for corrective actions based on evaluation findings, but the actual evaluation occurs in Clause 9.
2. A project manager facilitates risk identification workshops for disaster recovery planning at a pharmaceutical manufacturing facility. Which three techniques are appropriate for identifying potential threats to business operations? (Select three!)
Multiple correct answersExplanation
Risk identification techniques include historical data analysis examining past incidents to identify likely recurring threats, scenario analysis developing potential disaster situations across threat categories, and expert interviews leveraging specialized knowledge to identify domain-specific risks. These methods discover and document threats. Annual Loss Expectancy is a quantitative risk analysis calculation performed after identification, not an identification technique. Qualitative risk matrix is a risk prioritization tool used after risks are identified, not an identification method. Recovery Time Objective is a recovery metric determined during Business Impact Analysis, not a threat identification technique. The distinction between identification methods and subsequent analysis or prioritization activities is critical.
3. A cloud architect implements disaster recovery for Azure virtual machines hosting a customer relationship management system. The organization requires recovery to a specific point in time with application-consistent state and the lowest possible RTO. Which Azure Site Recovery recovery point option should the architect configure? (Select one!)
Explanation
Latest processed recovery point provides the lowest RTO because Azure Site Recovery has already processed this recovery point, eliminating processing delays during failover. The question prioritizes RTO (fastest recovery) over RPO. Latest recovery point provides lowest RPO but requires processing time during failover, increasing RTO. Latest app-consistent recovery point ensures application consistency but introduces processing delays compared to latest processed. Custom recovery point allows selecting specific timestamps but adds selection and processing overhead, increasing RTO beyond latest processed.
4. A manufacturing company implements VMware vSphere Replication to protect virtual machines running production control systems. The disaster recovery administrator configures replication with a 15-minute RPO target and storage-independent replication that works with any storage array type. The solution must not require storage snapshots during the replication process to avoid performance impact on production systems. Which VMware technology component captures write operations to replicate changes without using snapshots? (Select one!)
Explanation
vSphere Replication uses a vSCSI filter driver installed at the hypervisor level to capture write operations for replication without requiring storage snapshots. This approach provides storage-independent replication working with any storage type, supports configurable RPO from 5 minutes to 24 hours, and avoids performance impact from snapshot operations. The vSCSI filter intercepts I/O operations and replicates changes to the target site. Storage vMotion provides live migration of virtual machine disks between datastores but is not a replication technology. vSphere High Availability provides automated VM restart on surviving hosts after failures but does not replicate data. vSphere Fault Tolerance provides continuous availability through lockstep VM execution on separate hosts but uses different technology than vSphere Replication.
5. A system administrator implements a backup strategy with a complete backup every Saturday night. Monday through Friday backups capture only files changed since Saturday's full backup. Throughout the week, each daily backup increases in size. The backup system does not reset file modification markers during weekday operations. Which backup methodology is used for the weekday backups? (Select one!)
Explanation
Differential backup captures all changes since the last full backup and does not clear the archive bit, causing cumulative growth throughout the backup cycle. This matches the described behavior where daily backups progressively increase in size. Incremental backup clears the archive bit after each operation, resulting in small, consistent backup sizes that capture only changes since the previous backup of any type. Full backup would capture all data regardless of modification status and would not show progressive size growth. Continuous Data Protection operates continuously in real-time rather than on a scheduled daily basis.
One-time access to this exam