EC-Council · EDRP
Validates the ability to develop and implement business continuity and disaster recovery plans, covering business impact analysis, risk assessment, recovery strategy development, emergency response procedures, recovery site management, and disaster recovery plan testing and maintenance.
Practice Questions
623
≈ 4 practice exams
Duration
240 minutes
Passing Score
70%
Difficulty
ProfessionalLast Updated
Feb 2026
Use this EDRP practice exam to prepare for EC-Council Certified Disaster Recovery Professional (EDRP) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 623 questions for EC-Council EDRP, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
The EC-Council Certified Disaster Recovery Professional (EDRP), exam code 312-76, is a professional-level certification that validates a candidate's ability to plan, strategize, implement, and maintain comprehensive business continuity and disaster recovery (BC/DR) programs. The credential covers the full lifecycle of disaster preparedness: from conducting business impact analyses and risk assessments to designing recovery strategies, managing recovery sites, and testing and maintaining disaster recovery plans. It addresses data backup and recovery, virtualization-based recovery, centralized and decentralized system restoration, and telecommunications continuity.
The EDRP v3 curriculum aligns with major industry compliance frameworks including ISO 22301, ISO 22313, ISO 27001, ISO/IEC 27005, ISO 31000, ISO 31010, NFPA 1600, INCITS 483-2012, and the NIST NICE Framework. The program includes cloud-based virtual labs that allow candidates to practice BC/DR techniques in simulated enterprise environments. Recognized under DoD 8570/8140, the EDRP is accepted by U.S. government and military employers as a qualifying credential for information assurance and continuity roles.
The EDRP is designed for IT and information security professionals who are responsible for—or transitioning into—business continuity and disaster recovery roles. Ideal candidates include network and systems administrators, firewall and security administrators, risk assessment professionals, IT infrastructure managers, and cybersecurity analysts who need to formalize their BC/DR knowledge with a vendor-neutral, globally recognized credential.
The certification is also well-suited for IT managers and project managers who oversee organizational resilience programs, as well as professionals in regulated industries such as financial services, healthcare, and government who must demonstrate compliance with continuity standards. Candidates with at least a foundational understanding of IT infrastructure and information security will benefit most, though no strict prior certification is required.
There are no mandatory formal prerequisites to sit for the EDRP exam. However, EC-Council recommends that candidates have some practical experience in the IT BC/DR domain before attempting the certification. A working knowledge of IT infrastructure, basic information security concepts, and familiarity with organizational processes is strongly advised.
Candidates who have completed an official EC-Council course at an Accredited Training Center (ATC), an Academia Partner institution, or through the EC-Council iClass platform are automatically eligible to sit for the exam. Those who have not completed an official EC-Council course must submit an Exam Eligibility Application along with a non-refundable $100 USD fee and demonstrate a minimum of two years of work experience in the information security domain before being approved to test.
The EDRP exam (code 312-76) consists of 150 multiple-choice questions and must be completed within 4 hours. The passing score is 70%. The exam is delivered at authorized ECC Exam Centers and is also available at Pearson VUE testing centers worldwide. The certification is valid for three years, after which recertification is required through EC-Council Continuing Education (ECE) credits.
The exam tests knowledge across all core BC/DR domains rather than being divided into weighted sections with published percentages. Candidates are assessed on practical understanding of disaster recovery planning methodologies, risk and business impact analysis techniques, recovery strategies, and emergency response procedures. No unscored or survey questions have been officially disclosed by EC-Council.
EDRP-certified professionals are positioned for roles such as Disaster Recovery Specialist, Business Continuity Planner, IT Risk Manager, IT Infrastructure Manager, and Cybersecurity Analyst. Salaries for disaster recovery professionals in the United States typically range from approximately $75,000 to $125,000 annually, with median figures around $95,000 depending on experience, organization size, and location. The certification is recognized under DoD 8570/8140, making it particularly valuable for professionals seeking federal government, defense contractor, or military positions.
The global disaster recovery solutions market was valued at $10.93 billion in 2024 and is projected to reach $24.56 billion by 2029—a CAGR of roughly 17.5%—reflecting strong and growing employer demand for credentialed BC/DR professionals. Compared to alternatives such as the DRII CBCP (Certified Business Continuity Professional) or ISACA's CRISC, the EDRP is distinguished by its technical depth in IT systems recovery, its virtual lab component, and its alignment with EC-Council's broader cybersecurity certification ecosystem, making it a strong complement to credentials like CEH or CISSP for security-focused professionals.
5 sample questions with answers and explanations. The full bank has 623 questions, enough for 4 full-length practice exams.
Preview — answers shown1. An organization implements Continuous Data Protection for their document management system to defend against ransomware attacks and provide granular recovery options. The CDP solution records every write operation with timestamps and maintains a journal of all changes. Three weeks after implementation, ransomware encrypts files at 2:47 PM on Tuesday. The security team identifies that the initial infection occurred at 11:23 AM the same day based on log analysis. What is the primary advantage of CDP that enables optimal recovery in this scenario? (Select one!)
Explanation
The primary advantage of Continuous Data Protection in ransomware scenarios is the ability to recover to any specific point in time by selecting a timestamp before the infection occurred. Since the infection began at 11:23 AM, the team can restore to 11:22 AM, recovering all data while excluding the malware. Traditional backup methods with daily or hourly snapshots would require accepting either data loss (restoring to the previous night's backup) or risking malware inclusion (restoring a backup that includes encrypted files). While CDP does eliminate backup windows, this addresses operational convenience rather than ransomware recovery. Near-zero RPO is a characteristic of CDP but the key advantage in this scenario is point-in-time recovery to a pre-infection state. CDP typically requires more storage capacity than traditional backups due to journaling all changes, making this option incorrect.
2. Following a datacenter power failure, the network recovery team must restore IT infrastructure in the correct sequence to ensure dependent systems come online properly. The recovery plan specifies that authentication services, DNS resolution, and IP address assignment must be operational before application servers are restored. Which sequence represents the correct network disaster recovery restoration order? (Select one!)
Explanation
Correct network recovery follows a specific dependency-based sequence: power and physical infrastructure first (UPS, generators, cabling), then core network switches and routing for connectivity, followed by network security appliances (firewalls, IDS/IPS), then critical network servers providing essential services (DHCP, DNS, NTP, directory services), backend servers (databases, middleware), front-end applications (web servers), and finally user access systems. This order ensures each layer has required dependencies operational before activation. Starting with firewalls before power infrastructure is impossible since firewalls require power. Restoring core switches before power infrastructure violates physical dependencies. Beginning with end-user systems ignores the foundational infrastructure and services required for those systems to function.
3. A risk analyst performs quantitative risk assessment for a primary file server valued at $75,000. Historical data indicates hardware failures occur once every 8 years. Each failure impacts 40 percent of the server value. What is the Annual Loss Expectancy for this risk? (Select one!)
Explanation
Annual Loss Expectancy equals Single Loss Expectancy times Annual Rate of Occurrence. SLE equals asset value times exposure factor: $75,000 times 0.40 equals $30,000. ARO equals 1 divided by 8 years equals 0.125 per year. ALE equals $30,000 times 0.125 equals $9,375 per year. This represents the expected average loss per year. Dividing asset value by occurrence rate is incorrect methodology. SLE alone without ARO is not ALE. Total asset value ignores exposure factor and probability.
4. A database server cluster requires fault tolerance capable of surviving two simultaneous disk failures while maintaining good read and write performance using distributed parity. What is the minimum number of disks required and which RAID level satisfies these requirements? (Select one!)
Explanation
RAID 6 employs striping with double distributed parity, enabling survival of two simultaneous disk failures while requiring a minimum of 4 disks. This configuration matches all stated requirements including dual-disk fault tolerance and distributed parity implementation. RAID 1 provides mirroring with tolerance for only a single disk failure, insufficient for the two-disk requirement. RAID 5 uses distributed parity but tolerates only one disk failure rather than the required two. RAID 10 achieves fault tolerance through mirroring rather than distributed parity as specified in the requirements.
5. An organization implements VMware vSphere Replication for disaster recovery between their primary datacenter and a recovery site 200 miles away. The replication uses hypervisor-based replication at the virtual machine level without requiring shared storage between sites. The disaster recovery manager needs to configure the RPO for mission-critical application servers. Which RPO value represents the minimum replication interval supported by vSphere Replication? (Select one!)
Explanation
VMware vSphere Replication supports configurable RPO from 5 minutes to 24 hours, with 5 minutes being the minimum replication interval. vSphere Replication uses asynchronous replication and captures changes at the hypervisor level using vSCSI filters without requiring storage array integration. This makes vSphere Replication storage-independent and suitable for heterogeneous environments. Real-time near-zero RPO would require synchronous replication solutions like VMware vSAN stretched clusters or storage array-based synchronous replication, not vSphere Replication. The 30-second option does not exist as a configurable interval in vSphere Replication. While 1 hour is a valid configurable RPO in vSphere Replication, it is not the minimum interval. Organizations configure RPO based on business requirements balancing data loss tolerance against replication bandwidth and storage performance impact. For mission-critical applications requiring sub-5-minute RPO, alternative solutions like Site Recovery Manager with array-based replication or synchronous replication technologies would be necessary.
Certified Cybersecurity Technician (CCT)
CCT · 630 questions
Certified DevSecOps Engineer (ECDE)
ECDE · 609 questions
Digital Forensics Essentials (DFE)
DFE · 626 questions
Certified Application Security Engineer .NET (CASE-.NET)
CASE-.NET · 625 questions
EC-Council Certified Incident Handler (ECIH)
ECIH · 590 questions
EC-Council Certified Encryption Specialist (ECES)
ECES · 627 questions
$17.99
One-time access to this exam