CISA Information Systems Operations and Business Resilience — 20 Questions

Question 1

An IS auditor is reviewing the ITIL incident management process. Which THREE are the correct priority levels and their typical definitions?

Accepted Answer

P1: Critical impact, immediate response required.. In ITIL incident management, Priority 1 (P1) is defined as critical impact requiring immediate response. Priority 2 (P2) is defined as high impact requiring urgent response. Priority 3 (P3) is defined as moderate impact with standard response time. Therefore, options A, D, and E are correct. Option B is incorrect because P4 is low impact, not critical. Option C is incorrect because P2 is high impact, not low.

Answer

P4: Critical impact, requires escalation to senior management.

Answer

P2: Low impact, can be resolved within normal service hours.

Question 2

An organization is implementing a new incident management process aligned with ITIL. The IT team discovers a critical system is down, affecting all users. According to ITIL, what severity level should be assigned to this incident?

Accepted Answer

P1. A P1 (Priority 1) incident is the highest severity, typically involving a critical system outage that affects all users or major business operations.

Answer

P3

Answer

P2

Answer

P4

Question 3

During a change advisory board (CAB) meeting, a proposed change to the database server is discussed. The change involves implementing a security patch that requires a reboot. The change is categorized as 'normal' and has been risk-assessed as low impact. What is the most likely role of the CAB in this scenario?

Accepted Answer

Review and approve the change. The CAB reviews and approves changes based on risk and impact. For a low-risk normal change, the CAB typically authorizes the change, possibly with standard procedures.

Answer

Implement the change directly

Answer

Reject the change as unnecessary

Answer

Defer the change to the next release cycle

Question 4

An organization's backup strategy includes daily incremental backups and weekly full backups. During a disaster recovery test, the restoration of a critical server fails because a required incremental backup is corrupt. Which control should the organization implement to verify the integrity of backups?

Accepted Answer

Perform periodic restore verification tests. Regular restore verification tests confirm that backups can be successfully restored. This is a key control to ensure backup integrity.

Answer

Implement backup encryption

Answer

Use a different backup software

Answer

Increase the frequency of full backups

Question 5

In business continuity planning, a company identifies a critical business process with a maximum tolerable downtime (MTD) of 4 hours. What is the primary purpose of this metric?

Accepted Answer

To determine the recovery time objective (RTO). MTD defines the maximum time a process can be unavailable without causing severe business impact. It sets the recovery time objective (RTO) target.

Answer

To define the backup frequency

Answer

To calculate the mean time between failures (MTBF)

Answer

To establish service level agreements (SLAs)

Question 6

An IT auditor is reviewing the change management process for a financial institution. The auditor finds that emergency changes are frequently approved by the change manager without CAB review. Which risk is most associated with this practice?

Accepted Answer

Increase in unauthorized changes. Emergency changes bypass normal review, increasing the risk of unauthorized or poorly tested changes that could disrupt operations or introduce security vulnerabilities.

Answer

Excessive documentation overhead

Answer

Delayed incident resolution

Answer

Inadequate backup procedures

Question 7

A company outsources its IT help desk to a third-party vendor. The service level agreement (SLA) specifies that all P1 incidents must be resolved within 2 hours. During an audit, the auditor finds that the vendor’s average resolution time for P1 incidents is 3 hours. What is the most appropriate recommendation?

Accepted Answer

Issue a non-compliance notice and require a remediation plan. The correct action is to monitor SLA compliance and enforce penalties or require corrective action. This ensures the vendor meets contractual obligations.

Answer

Terminate the contract immediately

Answer

Renegotiate the SLA to 3 hours

Answer

Accept the performance as within acceptable variance

Question 8

During a business impact analysis (BIA), a department manager states that their process can be disrupted for up to 8 hours, but data loss cannot exceed 15 minutes. Which two metrics are defined by these statements?

Accepted Answer

Recovery time objective (RTO) and recovery point objective (RPO). The maximum downtime is the recovery time objective (RTO), and the maximum data loss is the recovery point objective (RPO).

Answer

Mean time to repair (MTTR) and mean time between failures (MTBF)

Answer

Service level objective (SLO) and service level agreement (SLA)

Answer

Maximum tolerable downtime (MTD) and working recovery time (WRT)

Question 9

An organization uses automated job scheduling for nightly batch processing. One job fails due to a missing dependency file. What is the most effective control to prevent recurrence?

Accepted Answer

Define dependencies within the job scheduler. Implementing dependency management in the job scheduler ensures that jobs only run when prerequisites are met, preventing such failures.

Answer

Use a different scheduling tool

Answer

Increase the frequency of job reruns

Answer

Assign manual operators to monitor jobs

Question 10

An organization is implementing a disaster recovery plan. The DR team wants to test the plan with minimal risk and without impacting production operations. Which type of test is most appropriate?

Accepted Answer

Walkthrough. A walkthrough test involves reviewing the plan step by step in a meeting, with no actual failover or impact on production, making it low-risk.

Answer

Full interruption test

Answer

Simulation

Answer

Parallel test

Question 11

A company uses a RAID 5 array for its file server. One disk fails, and the system continues to operate. However, during the rebuild process, a second disk fails. What is the likely consequence?

Accepted Answer

Data loss occurs. RAID 5 can tolerate a single disk failure. If a second disk fails during rebuild, the array is broken and data loss occurs.

Answer

Performance degrades but data remains intact

Answer

Data is still available from parity

Answer

The system automatically switches to a hot spare

Question 12

An auditor is reviewing IT asset management processes. The auditor finds that several servers running an older operating system are still in production, even though the vendor has ended support. What is the primary risk associated with this finding?

Accepted Answer

Lack of vendor support and security patches. Unsupported software no longer receives security patches, making the systems vulnerable to exploitation.

Answer

Non-compliance with software licensing

Answer

Incompatibility with new hardware

Answer

Increased licensing costs

Question 13

A company's availability monitoring shows that a critical application has an average MTBF of 720 hours and an average MTTR of 4 hours. What is the availability percentage?

Accepted Answer

99.45%. Availability = MTBF / (MTBF + MTTR) = 720 / (720 + 4) = 720 / 724 ≈ 0.994475, or 99.45%.

Answer

99.72%

Answer

99.17%

Answer

99.95%

Question 14

An organization is developing a business continuity strategy for its key customer-facing application. The BIA determined an RTO of 2 hours and an RPO of 30 minutes. Which TWO strategies are most appropriate to meet these objectives?

Accepted Answer

Implement a hot standby site. A hot standby site provides near-real-time failover, which supports a 2-hour RTO. Synchronous data replication ensures data loss is minimal, supporting a 30-minute RPO.

Answer

Adopt a manual workaround process

Answer

Store backup tape at an offsite location

Answer

Perform daily full backups to tape

Question 15

During a vendor audit, an IS auditor discovers that a cloud service provider uses subcontractors to manage data storage. The contract does not mention subcontracting. Which THREE risks should the auditor highlight to management?

Accepted Answer

Vendor concentration risk from subcontractor dependency. Vendor concentration risk arises if the subcontractor is a single point of failure. Fourth-party risk means the organization has no direct control. Exit strategy concerns include difficulty in transitioning if the subcontractor fails.

Answer

Improved service level performance

Answer

Increased licensing costs

Question 16

An organization is implementing a new release management process. Which TWO activities are essential components of a successful release?

Accepted Answer

Release planning. Release planning defines the scope and schedule; testing ensures the release meets quality standards. Deployment is part of release, but planning and testing are foundational.

Answer

Service desk operations

Answer

Capacity management

Answer

Incident management

Question 17

An organization has defined an SLA that requires critical incidents to be resolved within 4 hours. A P1 incident is reported at 10:00 AM. At what time must the incident be resolved to meet the SLA?

Accepted Answer

2:00 PM. P1 incidents are critical and require immediate resolution. With a 4-hour SLA from the time of reporting (10:00 AM), the resolution must occur by 2:00 PM.

Answer

4:00 PM

Answer

6:00 PM

Answer

12:00 PM

Question 18

During a recent audit, the IT auditor found that the problem management process does not include a known error database (KEDB). Which of the following is the MOST significant risk associated with this finding?

Accepted Answer

Increased time to resolve incidents. Without a known error database (KEDB), incident resolution relies on ad-hoc troubleshooting rather than leveraging documented root causes and workarounds. This directly increases the mean time to resolve (MTTR) incidents because support teams cannot quickly identify and apply previously identified fixes, leading to longer outages and reduced operational efficiency.

Answer

Higher likelihood of unauthorized changes

Answer

Increased backup failure rates

Answer

Inaccurate SLA reporting

Question 19

An organization uses a standard change model for low-risk, pre-approved changes. Which of the following is an example of a standard change?

Accepted Answer

Applying a routine security patch to the firewall. Standard changes are pre-approved, low-risk, and follow a defined procedure. Applying a routine security patch that has been tested and approved falls under this category.

Answer

Upgrading the core router to a new model

Answer

Changing the backup schedule from daily to weekly

Answer

Migrating the entire email system to the cloud

Question 20

An IS auditor is reviewing the change management process and notices that several emergency changes were implemented without post-implementation review. What is the PRIMARY concern?

Accepted Answer

Changes may not be properly documented. Emergency changes bypass normal controls, so post-implementation review is critical to ensure the change was effective and did not introduce risks. Without it, undocumented or unauthorized changes may persist.

Answer

The change may have caused an outage

Answer

The change may have exceeded budget

Answer

The change may have been unauthorized