CISA Information Systems Operations and Business Resilience Practice Test 2 — 15 Questions

Question 1

An organization has defined an SLA that requires critical incidents to be resolved within 4 hours. A P1 incident is reported at 10:00 AM. At what time must the incident be resolved to meet the SLA?

Accepted Answer

2:00 PM. P1 incidents are critical and require immediate resolution. With a 4-hour SLA from the time of reporting (10:00 AM), the resolution must occur by 2:00 PM.

Answer

4:00 PM

Answer

6:00 PM

Answer

12:00 PM

Question 2

During a recent audit, the IT auditor found that the problem management process does not include a known error database (KEDB). Which of the following is the MOST significant risk associated with this finding?

Accepted Answer

Increased time to resolve incidents. Without a known error database (KEDB), incident resolution relies on ad-hoc troubleshooting rather than leveraging documented root causes and workarounds. This directly increases the mean time to resolve (MTTR) incidents because support teams cannot quickly identify and apply previously identified fixes, leading to longer outages and reduced operational efficiency.

Answer

Higher likelihood of unauthorized changes

Answer

Increased backup failure rates

Answer

Inaccurate SLA reporting

Question 3

An organization uses a standard change model for low-risk, pre-approved changes. Which of the following is an example of a standard change?

Accepted Answer

Applying a routine security patch to the firewall. Standard changes are pre-approved, low-risk, and follow a defined procedure. Applying a routine security patch that has been tested and approved falls under this category.

Answer

Upgrading the core router to a new model

Answer

Changing the backup schedule from daily to weekly

Answer

Migrating the entire email system to the cloud

Question 4

An IS auditor is reviewing the change management process and notices that several emergency changes were implemented without post-implementation review. What is the PRIMARY concern?

Accepted Answer

Changes may not be properly documented. Emergency changes bypass normal controls, so post-implementation review is critical to ensure the change was effective and did not introduce risks. Without it, undocumented or unauthorized changes may persist.

Answer

The change may have caused an outage

Answer

The change may have exceeded budget

Answer

The change may have been unauthorized

Question 5

An organization's backup strategy includes full backups every Sunday and incremental backups on other days. On Wednesday, a failure occurs. Which backups are needed to restore the data?

Accepted Answer

Sunday's full backup and Monday through Wednesday incremental backups. To restore from incremental backups, you need the last full backup (Sunday) and all incremental backups from Monday through Wednesday.

Answer

Sunday's full backup only

Answer

Sunday's full backup and Wednesday's incremental backup

Answer

Wednesday's incremental backup only

Question 6

Which of the following backup types copies only data that has changed since the last full backup?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of how many incremental backups have been performed. This means each differential backup contains all changes accumulated since the most recent full backup, making it larger than an incremental backup but faster to restore (requiring only the full backup plus the latest differential).

Answer

Mirror backup

Answer

Full backup

Answer

Incremental backup

Question 7

An IT auditor is evaluating the capacity management process. Which of the following findings would be of MOST concern?

Accepted Answer

Resource utilization trends are not monitored. The most concerning finding is that capacity planning is reactive, leading to performance degradation and potential outages before thresholds are raised. This indicates a lack of proactive management.

Answer

Alert thresholds are set at 80% utilization

Answer

Capacity thresholds are reviewed annually

Answer

Capacity reports are generated monthly

Question 8

A system has a Mean Time Between Failures (MTBF) of 200 hours and a Mean Time To Repair (MTTR) of 20 hours. What is the availability of the system?

Accepted Answer

90.9%. Availability = MTBF / (MTBF + MTTR) = 200 / (200 + 20) = 200 / 220 ≈ 0.909 = 90.9%.

Answer

95.0%

Answer

91.0%

Answer

90.0%

Question 9

An organization is conducting a Business Impact Analysis (BIA). Which of the following metrics defines the maximum acceptable outage time for a critical business process?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) is the total time a process can be disrupted without causing significant business damage.

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Answer

Work Recovery Time (WRT)

Question 10

During a disaster recovery test, the IS auditor observes that the alternate site uses a warm site configuration. Which of the following is a characteristic of a warm site?

Accepted Answer

It has equipment but requires data restoration. A warm site has partially configured infrastructure (e.g., servers, network) but requires additional setup, such as loading data and applications, before full operation.

Answer

It is a mobile recovery unit

Answer

It has infrastructure but no processing equipment

Answer

It is a fully operational duplicate of the primary site

Question 11

Which type of disaster recovery test involves a full switch-over from the primary site to the alternate site, resulting in actual disruption of normal operations?

Accepted Answer

Full interruption test. A full interruption test (also called full-scale test) involves actual failover, shutting down primary operations and running completely from the alternate site.

Answer

Tabletop test

Answer

Parallel test

Answer

Simulation test

Question 12

An organization outsources its IT help desk to a third-party vendor. Which clause is MOST important for the IS auditor to verify in the contract to ensure the organization can assess the vendor's controls?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the organization to review the vendor's processes and controls, ensuring compliance with contractual and regulatory requirements.

Answer

Service level agreement (SLA) metrics

Answer

Subcontracting restrictions

Answer

Exit strategy provisions

Question 13

Which TWO of the following are key considerations when managing software licenses in an organization? (Select TWO).

Accepted Answer

Implementing automated license optimization tools. Software Asset Management (SAM) ensures license compliance and cost optimization. Regular compliance audits prevent legal and financial penalties. License optimization helps avoid over-purchasing or under-licensing.

Answer

Storing all software installation media in a secure location

Answer

Maintaining a hardware inventory for asset tracking

Answer

Ensuring all software is patched to the latest version

Question 14

An IS auditor is reviewing the end-of-life (EOL) software policy. Which THREE risks are associated with running unsupported software? (Select THREE).

Accepted Answer

Regulatory non-compliance. Unsupported software no longer receives security patches, increasing vulnerability risk. It also may cause compatibility issues with other systems. Additionally, it may lead to non-compliance with regulations that require supported software.

Answer

Reduced need for data backups

Answer

Higher software licensing costs

Question 15

Which TWO of the following are important controls for managing cloud resources to prevent cost overruns? (Select TWO).

Accepted Answer

Automated resource tagging. Resource tagging helps allocate costs and track usage. Detecting orphaned resources (e.g., unused instances) prevents unnecessary charges. These are key cloud cost management controls.

Answer

Conducting vulnerability scans on cloud instances

Answer

Using multi-factor authentication for cloud access

Answer

Implementing encryption for data at rest