CISA Information Systems Operations and Business Resilience Practice Test 10 — 15 Questions

Question 1

An IS auditor is reviewing the IT operations function of a mid-sized organization. Management asks which control would BEST ensure that capacity problems are detected before they affect users of critical production systems.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automated resource utilization monitoring with defined thresholds and alerting.. Early detection of capacity problems requires continuous, automated measurement of resource consumption against thresholds that trigger alerts, enabling staff to act before service levels degrade. Historical reports, annual benchmarking, and user complaints all detect problems after the fact or only intermittently. Automated threshold-based monitoring is the only option that operates proactively and consistently across critical production systems.

Answer

Annual benchmarking of server performance against vendor specifications.

Answer

Periodic review of historical performance reports by the operations manager.

Answer

A help desk procedure that logs user complaints about slow response times.

Question 2

An IS auditor is evaluating an organization's job scheduling practices for a critical batch process that updates the general ledger. The process runs nightly and must complete before the start of the business day. The auditor finds that the job scheduler uses a single service account with domain administrator privileges to run all jobs, and there are no alerts for job failures. Which of the following is the MOST significant risk arising from this configuration?

Accepted Answer

A failed job may go undetected, causing financial data to be incomplete or inaccurate.. The absence of job failure alerts is a critical control gap. For a nightly general ledger update, undetected failures can lead to incomplete financial data being used for reporting and decision-making. While the use of a domain administrator service account is a security concern, the immediate risk to data integrity and financial accuracy is more significant. Auditors should recommend implementing alerting and using least-privilege service accounts, but the most pressing risk is the potential for silent failures.

Answer

The job scheduler may not be able to run jobs if the service account password expires.

Answer

The batch process may not complete within the allotted time window due to resource contention.

Answer

The service account's domain administrator privileges could be exploited by a malicious insider.

Question 3

A hospital's data centre uses a generator and an uninterruptible power supply (UPS) to protect clinical systems. During a walkthrough, the IS auditor observes that the UPS batteries have never been load-tested and the generator is exercised monthly without transferring the load. Which conclusion is MOST appropriate?

Accepted Answer

The effectiveness of the power protection controls cannot be confirmed, and load testing of the UPS and generator should be performed.. The presence of a UPS and generator demonstrates design intent but not operating effectiveness. Battery capacity degrades silently, and a generator exercised without load transfer may fail at the automatic transfer switch or under full demand. The auditor should conclude that effectiveness is unconfirmed and recommend documented load testing of both the UPS batteries and the generator with actual load transfer, since these controls protect clinical systems where downtime affects patient safety.

Answer

The power protection controls are designed adequately, and monthly generator exercise satisfies the requirement for resilience testing.

Answer

The controls provide reasonable assurance because two independent power sources exist for the clinical systems.

Answer

The UPS and generator are compensating controls, so the absence of testing is not a reportable condition.

Question 4

An IS auditor is evaluating an organization's backup strategy for a critical database. The database is backed up nightly using a full backup, and transaction logs are backed up every 15 minutes. The auditor discovers that the transaction log backups are written to the same storage array as the database files. Which of the following is the MOST significant risk?

Accepted Answer

The transaction log backups may not be usable for point-in-time recovery if the storage array fails.. Storing transaction log backups on the same storage array as the database means a single failure could destroy both the primary data and the logs needed for point-in-time recovery. This creates an unacceptable risk of extended data loss and downtime. The most significant risk is the loss of recoverability, not backup performance, encryption, or RPO frequency, which are either not indicated or less critical in this scenario.

Answer

The recovery point objective (RPO) may not be met because transaction log backups are too infrequent.

Answer

The nightly full backup may not complete within the backup window due to contention with transaction log backups.

Answer

Transaction log backups may not be encrypted, exposing sensitive data if the storage array is compromised.

Question 5

An IS auditor is reviewing the backup strategy for a financial institution's core transaction processing system. The system processes high volumes of transactions continuously and requires a recovery point objective (RPO) of 5 minutes. The current strategy includes nightly full backups and hourly incremental backups. Which of the following should the auditor recommend as the MOST appropriate improvement?

Accepted Answer

Implement continuous data protection (CDP) with journaling to capture every transaction.. The core transaction system requires an RPO of 5 minutes, meaning no more than 5 minutes of data can be lost. Nightly full and hourly incremental backups leave up to 60 minutes of data at risk. Continuous data protection captures every change, enabling recovery to within seconds or minutes, thus meeting the RPO. Increasing incremental frequency to 15 minutes still exceeds the RPO, and other options are even less frequent. CDP is the only viable solution among the choices.

Answer

Perform full backups twice daily instead of nightly.

Answer

Increase the frequency of incremental backups to every 15 minutes.

Answer

Implement snapshot-based backups every 30 minutes.

Question 6

An IS auditor is reviewing the problem management process of a financial services firm. The auditor finds that incidents are frequently resolved by the service desk using documented workarounds, but no problem records are created, and root cause analysis is rarely performed. As a result, the same high-impact incident has recurred 14 times in three months. Which of the following is the MOST significant risk arising from this practice?

Accepted Answer

Recurring incidents will continue to disrupt critical business services and increase operational cost without permanent resolution.. Problem management exists to identify and eliminate root causes of recurring incidents. When workarounds are used without creating problem records, the organization treats symptoms rather than causes, so high-impact incidents recur and consume resources repeatedly. The most significant risk is therefore continued disruption and cost to critical business services, not secondary issues such as skill loss or data accuracy.

Answer

Service desk staff may become overly dependent on workarounds and lose technical troubleshooting skills.

Answer

Incident categorization and prioritization data will be unreliable, preventing accurate service level reporting.

Answer

The configuration management database will become inaccurate because workarounds are not reflected as changes.

Question 7

An IS auditor is reviewing the IT operations function of a mid-sized organization. Management asks which control would BEST ensure that capacity problems are detected before they affect users of critical production systems.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Loss of both the server and backups in the event of a site-wide disaster.. The most significant risk is that backups are stored in the same room as the server. A site-wide disaster such as a fire or flood could destroy both the production server and the backup tapes, making recovery impossible. Offsite storage is a basic requirement for backup media to ensure that a disaster at the primary site does not also destroy the recovery data. Other risks like tape degradation or backup frequency are less severe in this context.

Answer

The tape drive may fail, rendering backups unusable.

Answer

Daily backups may not capture transactions that occur after the backup window.

Answer

Backup tapes may degrade over time due to environmental conditions.

Question 8

An IS auditor is assessing an organization's capacity management process for a virtualized server environment. Management wants to confirm that the process will provide early warning before performance degrades. Which TWO practices are MOST important for the auditor to verify are in place? (Choose two.)

Accepted Answer

Capacity forecasts are reviewed and approved by business and IT stakeholders.. Effective capacity management depends on measuring resource consumption over time and comparing it with defined thresholds, then validating the resulting forecasts with the business. Trend analysis provides the early warning signal, while joint business and IT review ensures the forecasts reflect real demand and are acted upon. Together these practices shift the organization from reactive firefighting to planned, funded capacity adjustments before service levels are affected.

Answer

All virtual machines are configured with the maximum amount of memory allowed.

Answer

Performance alerts are generated only after users report slow response times.

Answer

Hardware is replaced only when it fails and causes an outage.

Question 9

An IS auditor is evaluating how an organization manages its backup and restoration process for a critical financial application. The backup job completes successfully each night and writes to a tape library. Management states that recovery capability has been proven because the backup job reports success. Which audit procedure would BEST test whether the backups are actually restorable?

Accepted Answer

Perform a periodic test restoration of selected data to a separate environment and reconcile the results.. Only an actual restoration test demonstrates that backup data can be read and used to recover the application. Job success logs, offsite storage, and schedule alignment all address supporting conditions but none proves recoverability. Periodic test restorations with reconciliation of results provide direct evidence and also validate the recovery procedures and dependencies that a real recovery would require.

Answer

Confirm that the backup window and retention schedule align with the recovery point objective.

Answer

Review the backup job logs to confirm that all scheduled jobs completed without errors.

Answer

Verify that backup tapes are stored in a secure offsite location with environmental controls.

Question 10

An IS auditor is reviewing problem management for a payment processor. Recurring incidents share the same root cause, but the problem record has remained open for eight months with no root cause identified because the vendor will not release diagnostic data. Change requests to apply a workaround have been raised and closed repeatedly. Which action should the IS auditor recommend FIRST?

Accepted Answer

Escalate the vendor relationship through contract governance to obtain the diagnostic data needed to determine root cause.. When root cause analysis is blocked by a vendor's refusal to supply diagnostic data, the controlling issue is contractual, not technical. The auditor should first recommend invoking contract governance and escalation to obtain the required information or a permanent fix. Reclassifying as a known error would misstate the record, blind changes without root cause are risky, and improving dashboard visibility does not remove the dependency that prevents resolution.

Answer

Implement a permanent change to the payment application to bypass the failing component.

Answer

Reclassify the recurring incidents as known errors and close the problem record to reflect the accepted risk.

Answer

Increase the priority of the problem record so that it appears on the operations dashboard for management visibility.

Question 11

An IS auditor is reviewing the IT operations function of a mid-sized organization. Management asks which control would BEST ensure that capacity problems are detected before they affect users of critical production systems.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insufficient CPU or memory resources to handle the month-end processing peak.. The lack of a formal capacity management process means the organization does not proactively monitor and plan for resource utilization. Month-end processing typically creates a predictable peak in workload. A slowdown during this period strongly suggests that the existing infrastructure lacks sufficient CPU or memory to handle the increased demand. The auditor should investigate historical performance data and business forecasts to confirm this capacity shortfall and recommend implementing a capacity management process.

Answer

The daily server health checks are not thorough enough to detect disk space issues.

Answer

A recent change to the month-end processing application introduced a performance bug.

Answer

Network bandwidth is saturated by month-end reporting downloads.

Question 12

An IS auditor is reviewing the problem management process. The auditor finds that problem tickets are only created after a major incident, and there is no proactive analysis of incident trends to identify underlying problems. Which of the following is the MOST likely consequence of this approach?

Accepted Answer

Recurring incidents will continue because their root causes are not identified and eliminated.. Proactive problem management analyzes incident trends to identify and resolve root causes before they cause major disruptions. Without it, recurring incidents persist because underlying problems are never addressed. The most likely consequence is therefore the continuation of recurring incidents, which can erode service quality and consume operational resources. The other options either describe unrelated impacts or positive outcomes that would not result from this weakness.

Answer

The incident management process will be unable to meet service level agreements for incident resolution.

Answer

Known errors will be documented and workarounds will be available for all incidents.

Answer

The change management process will be bypassed to implement fixes for recurring incidents.

Question 13

An IS auditor is reviewing an organization's disaster recovery plan (DRP) for its primary data center. The DRP specifies a reciprocal arrangement with a partner organization for backup processing. Which of the following is the MOST significant risk associated with this arrangement that the auditor should highlight?

Accepted Answer

The partner may not have sufficient capacity to handle the organization's workload during a simultaneous disaster.. A reciprocal disaster recovery arrangement depends on the partner's ability to provide processing capacity when needed. The most significant risk is that the partner may also be affected by the same disaster or may not have enough spare capacity to handle both organizations' workloads simultaneously. This can lead to failure of the DRP. Compatibility, legal enforceability, and security are important but secondary to the fundamental availability risk. The auditor should prioritize highlighting the capacity risk.

Answer

The partner may not have adequate security controls to protect the organization's data.

Answer

The partner may not have compatible hardware and software configurations.

Answer

The arrangement may not be legally enforceable without a formal contract.

Question 14

An IS auditor is examining the job scheduling controls for an organization's nightly batch processing on a mainframe. The auditor finds that operators can modify job schedules, add ad hoc jobs, and override job dependencies without supervisory approval or logging. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Restrict scheduling changes to a separate scheduler role and implement automated logging with supervisory approval for exceptions.. The finding shows that operators have excessive privileges over job scheduling without approval or logging, creating a segregation of duties and auditability gap. The most appropriate recommendation restricts scheduling modifications to a controlled role and enforces approval and automated logging for exceptions, which prevents unauthorized changes while preserving an immutable audit trail.

Answer

Implement a job scheduling tool that automatically reschedules failed jobs without operator intervention.

Answer

Require operators to document all schedule changes in a manual log reviewed monthly by the IT manager.

Answer

Increase the frequency of batch job monitoring by operations staff to detect unauthorized schedule changes.

Question 15

An IS auditor is evaluating the IT service continuity plan for a hospital's electronic health record (EHR) system. The auditor finds that the plan includes a recovery time objective (RTO) of 4 hours, but the hospital's clinical staff state that they can tolerate only 1 hour of downtime before patient safety is compromised. Which of the following should the auditor recommend FIRST?

Accepted Answer

Revise the RTO to align with the clinical requirement and reassess the recovery strategy.. The RTO in the plan is 4 hours, but clinical staff require no more than 1 hour of downtime. The auditor should first recommend revising the RTO to reflect the true business requirement, then reassess whether the recovery strategy can meet that RTO. Without this alignment, any subsequent technical improvements may be misdirected. The RTO is a business-driven metric and must be accurate before designing recovery solutions.

Answer

Conduct a full interruption test to validate the current recovery capabilities.

Answer

Implement a redundant server cluster at the primary site to improve availability.

Answer

Increase the frequency of data backups to reduce potential data loss.