CISA Information Systems Operations and Business Resilience Practice Test 1 — 15 Questions

Question 1

An organization is implementing a new incident management process aligned with ITIL. The IT team discovers a critical system is down, affecting all users. According to ITIL, what severity level should be assigned to this incident?

Accepted Answer

P1. A P1 (Priority 1) incident is the highest severity, typically involving a critical system outage that affects all users or major business operations.

Answer

P3

Answer

P2

Answer

P4

Question 2

During a change advisory board (CAB) meeting, a proposed change to the database server is discussed. The change involves implementing a security patch that requires a reboot. The change is categorized as 'normal' and has been risk-assessed as low impact. What is the most likely role of the CAB in this scenario?

Accepted Answer

Review and approve the change. The CAB reviews and approves changes based on risk and impact. For a low-risk normal change, the CAB typically authorizes the change, possibly with standard procedures.

Answer

Implement the change directly

Answer

Reject the change as unnecessary

Answer

Defer the change to the next release cycle

Question 3

An organization's backup strategy includes daily incremental backups and weekly full backups. During a disaster recovery test, the restoration of a critical server fails because a required incremental backup is corrupt. Which control should the organization implement to verify the integrity of backups?

Accepted Answer

Perform periodic restore verification tests. Regular restore verification tests confirm that backups can be successfully restored. This is a key control to ensure backup integrity.

Answer

Implement backup encryption

Answer

Use a different backup software

Answer

Increase the frequency of full backups

Question 4

In business continuity planning, a company identifies a critical business process with a maximum tolerable downtime (MTD) of 4 hours. What is the primary purpose of this metric?

Accepted Answer

To determine the recovery time objective (RTO). MTD defines the maximum time a process can be unavailable without causing severe business impact. It sets the recovery time objective (RTO) target.

Answer

To define the backup frequency

Answer

To calculate the mean time between failures (MTBF)

Answer

To establish service level agreements (SLAs)

Question 5

An IT auditor is reviewing the change management process for a financial institution. The auditor finds that emergency changes are frequently approved by the change manager without CAB review. Which risk is most associated with this practice?

Accepted Answer

Increase in unauthorized changes. Emergency changes bypass normal review, increasing the risk of unauthorized or poorly tested changes that could disrupt operations or introduce security vulnerabilities.

Answer

Excessive documentation overhead

Answer

Delayed incident resolution

Answer

Inadequate backup procedures

Question 6

A company outsources its IT help desk to a third-party vendor. The service level agreement (SLA) specifies that all P1 incidents must be resolved within 2 hours. During an audit, the auditor finds that the vendor’s average resolution time for P1 incidents is 3 hours. What is the most appropriate recommendation?

Accepted Answer

Issue a non-compliance notice and require a remediation plan. The correct action is to monitor SLA compliance and enforce penalties or require corrective action. This ensures the vendor meets contractual obligations.

Answer

Terminate the contract immediately

Answer

Renegotiate the SLA to 3 hours

Answer

Accept the performance as within acceptable variance

Question 7

During a business impact analysis (BIA), a department manager states that their process can be disrupted for up to 8 hours, but data loss cannot exceed 15 minutes. Which two metrics are defined by these statements?

Accepted Answer

Recovery time objective (RTO) and recovery point objective (RPO). The maximum downtime is the recovery time objective (RTO), and the maximum data loss is the recovery point objective (RPO).

Answer

Mean time to repair (MTTR) and mean time between failures (MTBF)

Answer

Service level objective (SLO) and service level agreement (SLA)

Answer

Maximum tolerable downtime (MTD) and working recovery time (WRT)

Question 8

An organization uses automated job scheduling for nightly batch processing. One job fails due to a missing dependency file. What is the most effective control to prevent recurrence?

Accepted Answer

Define dependencies within the job scheduler. Implementing dependency management in the job scheduler ensures that jobs only run when prerequisites are met, preventing such failures.

Answer

Use a different scheduling tool

Answer

Increase the frequency of job reruns

Answer

Assign manual operators to monitor jobs

Question 9

An organization is implementing a disaster recovery plan. The DR team wants to test the plan with minimal risk and without impacting production operations. Which type of test is most appropriate?

Accepted Answer

Walkthrough. A walkthrough test involves reviewing the plan step by step in a meeting, with no actual failover or impact on production, making it low-risk.

Answer

Full interruption test

Answer

Simulation

Answer

Parallel test

Question 10

A company uses a RAID 5 array for its file server. One disk fails, and the system continues to operate. However, during the rebuild process, a second disk fails. What is the likely consequence?

Accepted Answer

Data loss occurs. RAID 5 can tolerate a single disk failure. If a second disk fails during rebuild, the array is broken and data loss occurs.

Answer

Performance degrades but data remains intact

Answer

Data is still available from parity

Answer

The system automatically switches to a hot spare

Question 11

An auditor is reviewing IT asset management processes. The auditor finds that several servers running an older operating system are still in production, even though the vendor has ended support. What is the primary risk associated with this finding?

Accepted Answer

Lack of vendor support and security patches. Unsupported software no longer receives security patches, making the systems vulnerable to exploitation.

Answer

Non-compliance with software licensing

Answer

Incompatibility with new hardware

Answer

Increased licensing costs

Question 12

A company's availability monitoring shows that a critical application has an average MTBF of 720 hours and an average MTTR of 4 hours. What is the availability percentage?

Accepted Answer

99.45%. Availability = MTBF / (MTBF + MTTR) = 720 / (720 + 4) = 720 / 724 ≈ 0.994475, or 99.45%.

Answer

99.72%

Answer

99.17%

Answer

99.95%

Question 13

An organization is developing a business continuity strategy for its key customer-facing application. The BIA determined an RTO of 2 hours and an RPO of 30 minutes. Which TWO strategies are most appropriate to meet these objectives?

Accepted Answer

Implement a hot standby site. A hot standby site provides near-real-time failover, which supports a 2-hour RTO. Synchronous data replication ensures data loss is minimal, supporting a 30-minute RPO.

Answer

Adopt a manual workaround process

Answer

Store backup tape at an offsite location

Answer

Perform daily full backups to tape

Question 14

During a vendor audit, an IS auditor discovers that a cloud service provider uses subcontractors to manage data storage. The contract does not mention subcontracting. Which THREE risks should the auditor highlight to management?

Accepted Answer

Vendor concentration risk from subcontractor dependency. Vendor concentration risk arises if the subcontractor is a single point of failure. Fourth-party risk means the organization has no direct control. Exit strategy concerns include difficulty in transitioning if the subcontractor fails.

Answer

Improved service level performance

Answer

Increased licensing costs

Question 15

An organization is implementing a new release management process. Which TWO activities are essential components of a successful release?

Accepted Answer

Release planning. Release planning defines the scope and schedule; testing ensures the release meets quality standards. Deployment is part of release, but planning and testing are foundational.

Answer

Service desk operations

Answer

Capacity management

Answer

Incident management