CISA Information Systems Operations and Business Resilience — 100 Questions

Question 1

An organization is implementing a new incident management process aligned with ITIL. The IT team discovers a critical system is down, affecting all users. According to ITIL, what severity level should be assigned to this incident?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

P1. According to ITIL incident management, a critical system down affecting all users is a major incident with the highest severity, typically classified as P1 (Priority 1). P1 incidents have the greatest impact and urgency, requiring immediate escalation and dedicated resources to restore service as quickly as possible. The ITIL framework emphasizes that priority is derived from impact and urgency, and this scenario represents maximum impact and high urgency.

Answer

P3

Answer

P2

Answer

P4

Question 2

An IS auditor is reviewing the change management process and notices that several emergency changes were implemented without post-implementation review. What is the PRIMARY concern?

Accepted Answer

Changes may not be properly documented. The primary concern with emergency changes lacking post-implementation review is that the changes may not be properly documented, leaving no reliable record of what was changed, why, by whom, and with what approval. Post-implementation review is the control that closes the loop on emergency changes by verifying the change was authorized, tested, and recorded after the fact. Without it, the change log becomes incomplete and the organization loses auditability and the ability to reconstruct events.

Answer

The change may have caused an outage

Answer

The change may have exceeded budget

Answer

The change may have been unauthorized

Question 3

Which TWO of the following are important controls for managing cloud resources to prevent cost overruns? (Select TWO).

Accepted Answer

Automated resource tagging. Automated resource tagging (B) is a key cost-control because tags attach metadata such as owner, project, environment, or cost center to each resource, enabling accurate cost allocation, chargeback/showback reporting, and budget alerts that surface overspending before it escalates. Regular detection and removal of orphaned resources (E) directly prevents cost overruns because unattached EBS volumes, idle EC2 instances, unused Elastic IPs, and stale snapshots continue to be billed even when no longer serving a workload, so identifying and deleting them eliminates wasted spend. The other options address security rather than cost: vulnerability scans (A) find software weaknesses, multi-factor authentication (C) strengthens identity verification, and encryption at rest (D) protects stored data confidentiality, none of which directly govern or reduce cloud consumption charges.

Answer

Conducting vulnerability scans on cloud instances

Answer

Using multi-factor authentication for cloud access

Answer

Implementing encryption for data at rest

Question 4

An organization uses automated job scheduling for batch processing. A critical payroll job fails due to a dependency on a prior job that did not complete. The job scheduler is configured to handle dependencies. What should the auditor verify regarding rerun procedures?

Accepted Answer

The rerun procedure specifies the correct restart point. The auditor should verify that the rerun procedure specifies the correct restart point because a payroll job that fails mid-execution due to a missing dependency must be restarted from a defined checkpoint to avoid duplicate or partial processing. Without a documented restart point, reruns could reprocess already-completed transactions, corrupting payroll records or producing duplicate payments. This is the core control objective for batch job recovery: ensuring data integrity through controlled restart logic.

Answer

The job failure alert is sent to the IT manager

Answer

The job scheduler logs the dependency failure

Answer

The job automatically retries after the dependency completes

Question 5

A company performs daily full backups of its database and weekly incremental backups. The backup retention policy requires keeping full backups for 30 days and incremental backups for 7 days. An auditor reviews the backup schedule. Which backup type provides the fastest restore?

Accepted Answer

Full backup. A full backup contains all data and requires only one restore operation, making it faster than restoring from incremental or differential backups.

Answer

Log backup

Answer

Incremental backup

Answer

Differential backup

Question 6

An organization is implementing a cloud resource management strategy to optimize costs and prevent waste. Which three practices should the auditor recommend?

Accepted Answer

Detect and remove orphaned resources. Option B is correct because detecting and removing orphaned resources (unattached EBS volumes, unused Elastic IPs, idle load balancers, stale snapshots) eliminates waste from resources that no longer serve a workload but continue to incur charges. Option C is correct because automating shutdown of idle resources during off-hours (e.g., stopping non-production EC2/RDS instances via Lambda and EventBridge schedules) directly reduces compute and database costs for workloads that do not need 24/7 availability. Option E is correct because implementing resource tagging for cost allocation enables chargeback/showback, identifies which teams or projects drive spend, and surfaces untagged or misallocated resources so optimization decisions can be targeted. Option A does not belong because consolidating into a single region is a latency, resilience, and compliance decision, not a cost-optimization practice, and can increase data transfer and availability risk. Option D does not belong because using only Reserved Instances for all workloads ignores dynamic, short-lived, or unpredictable workloads better served by On-Demand, Spot, or Savings Plans, and over-committing to RIs can itself create waste.

Answer

Consolidate all resources into a single region

Answer

Use only Reserved Instances for all workloads

Question 7

During a change management review, an IS auditor discovers that a recent database upgrade was implemented without prior approval from the Change Advisory Board (CAB) because it was classified as a 'standard change.' However, the change involved migrating to a new database version that required application code modifications. What should concern the auditor most?

Accepted Answer

The change was implemented without CAB approval.. The core issue is that the change was misclassified as a 'standard change' to bypass CAB approval, but it required application code modifications, which means it was not pre-authorized and should have been treated as a normal or emergency change. Standard changes are low-risk, pre-approved, and typically involve no application code changes (e.g., applying a routine patch to a database that does not alter the schema or API). By bypassing CAB review, the organization lost the opportunity to assess risks, dependencies, and rollback procedures, which is a critical control failure in change management.

Answer

The change did not include a backout plan.

Answer

The change was implemented during business hours.

Answer

The change was implemented without testing.

Question 8

During a business impact analysis (BIA), the IS auditor identifies that the maximum tolerable downtime (MTD) for an online payment system is 2 hours, and the recovery point objective (RPO) is 15 minutes. The current disaster recovery solution uses nightly backups (12-hour RPO) and can restore the system in 4 hours. Which risk is most critical?

Accepted Answer

Data loss exceeds the RPO.. The current solution has a 12-hour RPO (nightly backups), but the business requires an RPO of 15 minutes. This means up to 11 hours and 45 minutes of transaction data could be lost, far exceeding the acceptable data loss threshold. While the recovery time of 4 hours also exceeds the MTD of 2 hours, the most critical risk is data loss because the gap between the actual RPO and the required RPO is proportionally larger and directly impacts transaction integrity and financial reconciliation.

Answer

The backup frequency is not aligned with the RPO.

Answer

The disaster recovery plan has not been tested.

Answer

Recovery time exceeds the MTD.

Question 9

An organization uses a cloud-based CRM system. The asset management team has implemented tagging to track resource costs by department. During an audit, the IS auditor finds that several orphaned resources (e.g., virtual machines, storage volumes) exist that are not tagged and have been running for months. The cloud service provider's cost allocation report shows these resources under a default account. What is the most significant risk associated with this finding?

Accepted Answer

Inaccurate cost allocation and potential budget overruns.. The most significant risk is inaccurate cost allocation and potential budget overruns because the orphaned resources are not tagged and are billed under a default account, preventing the organization from accurately attributing cloud costs to the responsible departments. This undermines the purpose of the tagging strategy implemented by the asset management team and can lead to unplanned expenses that are not tracked against any budget owner, directly impacting financial control and operational accountability.

Answer

Increased attack surface from forgotten resources.

Answer

Security misconfiguration due to lack of ownership.

Answer

Compliance violation with data residency requirements.

Question 10

An IS auditor is reviewing the capacity management process for a server hosting a critical application. The server's CPU utilization has been consistently above 90% for the past three months, and memory usage is at 85%. There are no threshold alerts configured. The capacity plan shows that additional resources are scheduled to be added in six months. What should the auditor most recommend?

Accepted Answer

Request immediate addition of resources to meet current demand.. The server is already in a critical state with sustained CPU above 90% and memory at 85%, and no threshold alerts exist. The capacity plan's six-month timeline is too late to address the current demand. The auditor should recommend immediate addition of resources to meet current demand to prevent an imminent outage. This is a reactive but necessary action given the risk.

Answer

Review the capacity plan and adjust the forecast.

Answer

Accept the risk as the server has not failed yet.

Answer

Implement threshold alerts to monitor the situation.

Question 11

An organization's IT service desk categorizes incidents based on severity levels. A P1 incident is defined as a critical system outage affecting all users. Which of the following is the MOST appropriate target for the initial response time for a P1 incident?

Accepted Answer

Within 15 minutes. A P1 incident is a critical system outage affecting all users, so the initial response time must be extremely short to minimize business impact. An initial response within 15 minutes is the most appropriate target because it ensures immediate attention from support staff, aligns with industry best practices for critical incidents, and is achievable for a well-staffed service desk. This rapid response is essential for initiating troubleshooting and communication, which are key to restoring service quickly.

Answer

Within 4 hours

Answer

Within 1 business day

Answer

Within 30 minutes

Question 12

An organization is selecting an alternate site for disaster recovery. The site must have sufficient equipment to resume operations within a few hours, and the organization is willing to share the site with another business. Which type of alternate site is MOST appropriate?

Accepted Answer

Warm site. A warm site is a partially equipped alternate facility that has hardware and infrastructure in place but lacks fully loaded, current production data and applications. It can typically resume operations within hours to a few days, which matches the 'few hours' requirement. Warm sites are also commonly shared or co-located with another business, making them the most cost-effective option that still meets the recovery time objective.

Answer

Mobile site

Answer

Cold site

Answer

Hot site

Question 13

Which of the following disaster recovery test types involves a full switch-over to the alternate site, resulting in actual disruption to normal operations?

Accepted Answer

Full interruption test. The full interruption test (also known as a cold-start test) involves an actual shutdown of primary systems and a complete switch-over to the alternate site, causing real disruption to normal operations. This validates the entire recovery capability under realistic conditions, including failover, data synchronization, and user reconnection, but carries the highest risk of data loss or extended downtime.

Answer

Simulation test

Answer

Parallel test

Answer

Tabletop test

Question 14

An organization is implementing a new incident management process aligned with ITIL. The IT team discovers a critical system is down, affecting all users. According to ITIL, what severity level should be assigned to this incident?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Immediately assign the incident to the appropriate support team for resolution.. In ITIL incident management, a P1 (Priority 1) incident is a major incident with severe business impact. The most appropriate initial action is to immediately assign it to the appropriate support team for resolution, following the incident model and escalation procedures. This ensures the fastest possible restoration of service, which is the primary goal of incident management.

Answer

Escalate the incident to problem management for root cause analysis.

Answer

Update the known error database with a workaround.

Answer

Log the incident and inform the user that it will be handled within the next business day.

Question 15

An organization performs daily full backups of its critical database. The recovery time objective (RTO) is 4 hours. During a disaster, it takes 6 hours to restore the database. What is the most likely cause?

Accepted Answer

Recovery procedures are not tested against the RTO.. If the restore takes longer than the RTO, the backup and recovery process does not meet the required timeline. This could be due to inadequate infrastructure or testing.

Answer

Offsite storage location is too far.

Answer

The backup type (full) is insufficient.

Answer

Backup retention period is too short.

Question 16

An IS auditor is reviewing a backup strategy that includes daily full backups and weekly offsite storage. The recovery time objective (RTO) for a critical application is 4 hours. Which of the following findings would be of GREATEST concern?

Accepted Answer

Backup tapes are stored offsite and retrieved only once per month. If the backup media are stored offsite without a local copy, the time to retrieve and restore may exceed the RTO.

Answer

Backup logs are reviewed weekly

Answer

Incremental backups are not performed between full backups

Answer

Backups are encrypted with AES-256

Question 17

An organization has an availability requirement of 99.99% for its online transaction processing system. The system's MTBF is 720 hours. What is the maximum allowable MTTR to meet this requirement?

Accepted Answer

4.32 minutes. Availability = MTBF/(MTBF+MTTR). 0.9999 = 720/(720+MTTR) => MTTR = 720/0.9999 - 720 = 0.072 hours ≈ 4.32 minutes.

Answer

43.2 minutes

Answer

72 minutes

Answer

7.2 minutes

Question 18

An IS auditor is reviewing problem management processes. Which TWO of the following are key outputs of effective problem management? (Select two.)

Accepted Answer

Known error database. Option C (Known error database) is correct because effective problem management documents known errors and their workarounds in a KEDB, which supports faster incident resolution and prevents repeated diagnostic effort. Option E (Root cause analysis) is correct because problem management's core purpose is to identify and eliminate the underlying causes of incidents, and RCA is the primary technique and output that drives permanent fixes. Option A (Incident resolution times) is a metric of incident management, not a problem management output. Option B (Change requests) may result from problem management when a fix requires a change, but a change request is an output of change management, not a defining output of problem management. Option D (Service level reports) are outputs of service level management, not problem management.

Answer

Incident resolution times

Answer

Change requests

Answer

Service level reports

Question 19

An IS auditor is reviewing backup procedures for a critical database. Which THREE are key considerations for ensuring backup reliability and recoverability?

Accepted Answer

Ensuring backup retention periods meet the recovery point objective (RPO).. Option A is correct because the retention period directly determines how far back in time the organization can recover; if backups are retained for a shorter window than the RPO requires, the database cannot be restored to the needed recovery point. Option B is correct because a backup is only reliable if it can actually be restored, so periodic restore verification tests validate the integrity of the backup media, the backup software, and the recovery procedures before a real incident occurs. Option D is correct because keeping backups only at the primary site leaves them vulnerable to the same disaster (fire, flood, theft, ransomware) that destroys the production database, so offsite storage ensures a survivable copy exists. Option C is not among the marked correct answers: while encryption protects confidentiality of backup data, it is a security control rather than a core reliability/recoverability consideration, and it can even complicate recovery if keys are lost. Option E is also not marked correct: compression reduces storage cost and media usage but does not by itself improve backup reliability or the ability to recover the database.

Answer

Encrypting backup data to prevent unauthorized access.

Answer

Compressing backup data to reduce storage costs.

Question 20

An IS auditor is assessing the vendor management process. Which TWO are key controls for managing third-party risk?

Accepted Answer

Including right-to-audit clauses in contracts.. Option B is correct because right-to-audit clauses contractually grant the organization the authority to inspect, assess, and verify a vendor's security controls, compliance posture, and operational practices, which is a foundational control for ongoing third-party risk management. Option C is correct because regularly monitoring SLAs provides continuous assurance that the vendor is meeting agreed-upon performance, availability, and security commitments, enabling timely detection of service degradation or contractual noncompliance. Options A, D, and E, while relevant to vendor management, are not the key controls for managing third-party risk in this context: subcontractor disclosure supports transparency but does not by itself control risk, an exit strategy addresses contingency planning rather than ongoing risk management, and pre-contract due diligence is a point-in-time assessment rather than a continuous control.

Answer

Requiring vendors to disclose all subcontractors.

Answer

Developing an exit strategy for each vendor.

Answer

Performing vendor due diligence before contract signing.