CISA Information Systems Operations and Business Resilience Practice Test 2 — 15 Questions

Question 1

An IS auditor is reviewing a backup strategy that includes daily full backups and weekly offsite storage. The recovery time objective (RTO) for a critical application is 4 hours. Which of the following findings would be of GREATEST concern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Backup tapes are stored offsite and retrieved only once per month. If the backup media are stored offsite without a local copy, the time to retrieve and restore may exceed the RTO.

Answer

Backup logs are reviewed weekly

Answer

Incremental backups are not performed between full backups

Answer

Backups are encrypted with AES-256

Question 2

An organization has an availability requirement of 99.99% for its online transaction processing system. The system's MTBF is 720 hours. What is the maximum allowable MTTR to meet this requirement?

Accepted Answer

4.32 minutes. Availability = MTBF/(MTBF+MTTR). 0.9999 = 720/(720+MTTR) => MTTR = 720/0.9999 - 720 = 0.072 hours ≈ 4.32 minutes.

Answer

43.2 minutes

Answer

72 minutes

Answer

7.2 minutes

Question 3

An IS auditor is reviewing problem management processes. Which TWO of the following are key outputs of effective problem management? (Select two.)

Accepted Answer

Known error database. Option C (Known error database) is correct because effective problem management documents known errors and their workarounds in a KEDB, which supports faster incident resolution and prevents repeated diagnostic effort. Option E (Root cause analysis) is correct because problem management's core purpose is to identify and eliminate the underlying causes of incidents, and RCA is the primary technique and output that drives permanent fixes. Option A (Incident resolution times) is a metric of incident management, not a problem management output. Option B (Change requests) may result from problem management when a fix requires a change, but a change request is an output of change management, not a defining output of problem management. Option D (Service level reports) are outputs of service level management, not problem management.

Answer

Incident resolution times

Answer

Change requests

Answer

Service level reports

Question 4

An IS auditor is reviewing backup procedures for a critical database. Which THREE are key considerations for ensuring backup reliability and recoverability?

Accepted Answer

Ensuring backup retention periods meet the recovery point objective (RPO).. Option A is correct because the retention period directly determines how far back in time the organization can recover; if backups are retained for a shorter window than the RPO requires, the database cannot be restored to the needed recovery point. Option B is correct because a backup is only reliable if it can actually be restored, so periodic restore verification tests validate the integrity of the backup media, the backup software, and the recovery procedures before a real incident occurs. Option D is correct because keeping backups only at the primary site leaves them vulnerable to the same disaster (fire, flood, theft, ransomware) that destroys the production database, so offsite storage ensures a survivable copy exists. Option C is not among the marked correct answers: while encryption protects confidentiality of backup data, it is a security control rather than a core reliability/recoverability consideration, and it can even complicate recovery if keys are lost. Option E is also not marked correct: compression reduces storage cost and media usage but does not by itself improve backup reliability or the ability to recover the database.

Answer

Encrypting backup data to prevent unauthorized access.

Answer

Compressing backup data to reduce storage costs.

Question 5

An IS auditor is assessing the vendor management process. Which TWO are key controls for managing third-party risk?

Accepted Answer

Including right-to-audit clauses in contracts.. Option B is correct because right-to-audit clauses contractually grant the organization the authority to inspect, assess, and verify a vendor's security controls, compliance posture, and operational practices, which is a foundational control for ongoing third-party risk management. Option C is correct because regularly monitoring SLAs provides continuous assurance that the vendor is meeting agreed-upon performance, availability, and security commitments, enabling timely detection of service degradation or contractual noncompliance. Options A, D, and E, while relevant to vendor management, are not the key controls for managing third-party risk in this context: subcontractor disclosure supports transparency but does not by itself control risk, an exit strategy addresses contingency planning rather than ongoing risk management, and pre-contract due diligence is a point-in-time assessment rather than a continuous control.

Answer

Requiring vendors to disclose all subcontractors.

Answer

Developing an exit strategy for each vendor.

Answer

Performing vendor due diligence before contract signing.

Question 6

An IS auditor is evaluating the release management process for a software application. Which TWO are essential components of a successful release plan?

Accepted Answer

A testing strategy that includes unit, integration, and user acceptance testing.. Option A is correct because a successful release plan must define a testing strategy covering unit, integration, and user acceptance testing, ensuring the release is verified at component, interface, and business levels before production deployment. Option D is correct because a detailed rollback plan is essential to restore the previous known-good state if deployment fails, minimizing downtime and business impact. Option B is not essential to the release plan itself; automated deployment scripts are a helpful CI/CD practice but not a required component. Option C is not essential because a post-implementation review, while good practice, occurs after the release and is not part of the release plan's core components. Option E is not essential because stakeholder communication, though useful, is not one of the two fundamental components required for a successful release plan.

Answer

Automated deployment scripts to minimize manual errors.

Answer

A post-implementation review scheduled for 30 days after release.

Answer

A communication plan to notify all stakeholders of the release schedule.

Question 7

An organization uses a cloud service provider (CSP) for critical applications. The IS auditor is reviewing the contract for vendor concentration risk. Which TWO clauses are MOST relevant to mitigating this risk?

Accepted Answer

A clause requiring the CSP to disclose and obtain approval for any subcontractors.. Vendor concentration risk arises when critical applications depend on a single CSP or on subcontractors the organization cannot control, so Option A is correct because requiring the CSP to disclose and obtain approval for any subcontractors prevents hidden fourth-party dependencies and preserves the organization's ability to assess and limit concentration. Option D is also correct because an exit strategy clause defining transition assistance and data extraction procedures reduces lock-in and provides a viable path to migrate to another provider or back in-house if the CSP fails or becomes unviable, directly mitigating concentration exposure. Option B is not the best fit because SLAs with financial penalties address performance and availability, not the risk of over-reliance on one vendor. Option C is not the best fit because encryption at rest and in transit protects data confidentiality but does not reduce dependency on a single provider. Option E is not the best fit because a right-to-audit clause supports assurance and compliance verification, not the mitigation of concentration risk itself.

Answer

A service level agreement (SLA) with financial penalties for non-performance.

Answer

A data encryption clause requiring encryption at rest and in transit.

Answer

A right-to-audit clause allowing the organization to audit the CSP.

Question 8

An IS auditor is reviewing the backup strategy for a financial institution. The auditor finds that full backups are performed weekly, differential backups are performed nightly, and incremental backups are performed every four hours. A server fails at 2:00 PM on Thursday. The last weekly full backup was Sunday at 11:00 PM, and the last differential backup completed at 11:00 PM Wednesday. What is the MINIMUM set of backup tapes the IS auditor should recommend be available to restore the server to its most recent state?

Accepted Answer

The weekly full backup, the Wednesday differential backup, and all incremental backups since the Wednesday differential backup.. The correct restore strategy for a backup scheme using full, differential, and incremental backups requires the most recent full backup, the most recent differential backup, and all incremental backups taken after that differential. This chain ensures the server is restored to the latest possible state before the failure. The differential already includes all changes since the full, so incrementals before the differential are not needed, but those after it are necessary.

Answer

The weekly full backup and the Wednesday differential backup only.

Answer

The Wednesday differential backup and all incremental backups since then.

Answer

The weekly full backup and all incremental backups since the full backup.

Question 9

An IS auditor reviews the job scheduling environment for a bank's overnight batch cycle. The scheduler is configured so that the interest-accrual job and the general-ledger posting job both run at 02:00, and operators routinely rerun failed jobs without documenting the rerun or the input parameters used. Which finding should the IS auditor report as the GREATEST risk?

Accepted Answer

Job dependencies are not enforced by the scheduler, so downstream jobs may execute against incomplete input data.. Dependencies between dependent batch jobs must be enforced by the scheduler so that downstream processing never consumes incomplete input. When the accrual and posting jobs run concurrently with no predecessor-successor relationship, the ledger can post against partially calculated balances, directly corrupting financial records used for regulatory reporting. Undocumented reruns compound the problem by removing the audit trail, but the primary control failure is the missing job dependency.

Answer

Undocumented reruns prevent the auditor from reconstructing the batch timeline for capacity planning purposes.

Answer

Operators possess the ability to rerun production jobs, which violates segregation of duties between scheduling and execution.

Answer

Running two resource-intensive jobs simultaneously may cause batch overrun and delay the online start-of-day window.

Question 10

An IS auditor is reviewing an organization's IT operations to ensure effective job scheduling and monitoring. Which TWO of the following are essential controls for batch job scheduling? (Choose two.)

Accepted Answer

Procedures to ensure that only authorized personnel can modify job schedules.. The two essential controls for batch job scheduling are authorization of schedule changes and automated monitoring with alerts. Authorization ensures that only approved changes are made, preventing disruptions. Automated monitoring enables rapid detection and response to failures, maintaining operational continuity. Other options are either not essential or represent poor practices.

Answer

Daily manual review of all job logs by the database administrator.

Answer

Segregation of duties between job schedulers and job developers.

Answer

Use of a single service account for all batch jobs to simplify access management.

Question 11

During a change advisory board (CAB) meeting, a proposed change to the database server is discussed. The change involves implementing a security patch that requires a reboot. The change is categorized as 'normal' and has been risk-assessed as low impact. What is the most likely role of the CAB in this scenario?

Accepted Answer

Review and approve the change. The CAB's primary role is to review and approve (or reject) proposed changes by assessing risk, impact, and readiness. In this scenario, the change is a normal change that has been risk-assessed as low impact, so the CAB's most likely action is to review and approve it for implementation during the maintenance window. The CAB does not implement changes, nor does it arbitrarily reject or defer changes that are properly justified and assessed.

Answer

Implement the change directly

Answer

Reject the change as unnecessary

Answer

Defer the change to the next release cycle

Question 12

An organization's backup strategy includes daily incremental backups and weekly full backups. During a disaster recovery test, the restoration of a critical server fails because a required incremental backup is corrupt. Which control should the organization implement to verify the integrity of backups?

Accepted Answer

Perform periodic restore verification tests. Periodic restore verification tests are the only control that actually validates that backup data is readable, complete, and restorable—directly detecting corruption like the failed incremental backup. Backup integrity cannot be assumed; it must be proven by performing test restores. This control aligns with the principle that a backup is only as good as its last successful restore.

Answer

Implement backup encryption

Answer

Use a different backup software

Answer

Increase the frequency of full backups

Question 13

In business continuity planning, a company identifies a critical business process with a maximum tolerable downtime (MTD) of 4 hours. What is the primary purpose of this metric?

Accepted Answer

To determine the recovery time objective (RTO). The maximum tolerable downtime (MTD) defines the maximum time a business process can be unavailable before unacceptable consequences occur. The recovery time objective (RTO) is derived from the MTD — it is the target time within which the process must be restored, and it must be less than the MTD to provide a safety margin. Therefore, the primary purpose of the MTD is to determine the RTO for the process.

Answer

To define the backup frequency

Answer

To calculate the mean time between failures (MTBF)

Answer

To establish service level agreements (SLAs)

Question 14

An IT auditor is reviewing the change management process for a financial institution. The auditor finds that emergency changes are frequently approved by the change manager without CAB review. Which risk is most associated with this practice?

Accepted Answer

Increase in unauthorized changes. Emergency changes approved without CAB review bypass the normal oversight and segregation of duties, increasing the risk that unauthorized or malicious changes are introduced. The change manager alone may not have the authority or expertise to assess all risks, leading to potential fraud, errors, or security breaches. This is a classic control weakness in change management.

Answer

Excessive documentation overhead

Answer

Delayed incident resolution

Answer

Inadequate backup procedures

Question 15

A company outsources its IT help desk to a third-party vendor. The service level agreement (SLA) specifies that all P1 incidents must be resolved within 2 hours. During an audit, the auditor finds that the vendor’s average resolution time for P1 incidents is 3 hours. What is the most appropriate recommendation?

Accepted Answer

Issue a non-compliance notice and require a remediation plan. The vendor is contractually obligated to resolve P1 incidents within 2 hours, and the audit shows an average of 3 hours — a clear SLA breach. The auditor's role is to report the gap and recommend corrective action, not to unilaterally terminate or rewrite the contract. Issuing a non-compliance notice with a required remediation plan is the standard governance response that preserves the business relationship while enforcing accountability.

Answer

Terminate the contract immediately

Answer

Renegotiate the SLA to 3 hours

Answer

Accept the performance as within acceptable variance