CISA Information Systems Operations and Business Resilience Practice Test 3 — 15 Questions

Question 1

An organization classifies IT incidents based on severity. A critical financial application is unavailable, impacting all users. According to ITIL best practices, which severity level should this incident be assigned?

Accepted Answer

P1. P1 incidents are the highest severity, typically involving a critical service outage affecting all users with significant business impact.

Answer

P2

Answer

P3

Answer

P4

Question 2

During a change management board (CAB) meeting, a proposed change to the network firewall configuration is discussed. The change is considered low risk and pre-approved. Which type of change does this represent?

Accepted Answer

Standard change. Standard changes are pre-approved, low-risk, and follow a defined procedure, often requiring only a CAB notification.

Answer

Emergency change

Answer

Major change

Answer

Normal change

Question 3

An IT auditor is reviewing the problem management process. The IT team maintains a repository of known errors with documented workarounds. Which component of problem management is this?

Accepted Answer

Known error database. A known error database (KEDB) is used to store known errors and workarounds to expedite incident resolution.

Answer

Service request

Answer

Root cause analysis

Answer

Problem record

Question 4

An organization uses automated job scheduling for batch processing. A critical payroll job fails due to a dependency on a prior job that did not complete. The job scheduler is configured to handle dependencies. What should the auditor verify regarding rerun procedures?

Accepted Answer

The rerun procedure specifies the correct restart point. The auditor should ensure that the rerun procedure specifies the correct restart point to avoid data corruption or reprocessing errors.

Answer

The job failure alert is sent to the IT manager

Answer

The job scheduler logs the dependency failure

Answer

The job automatically retries after the dependency completes

Question 5

A company performs daily full backups of its database and weekly incremental backups. The backup retention policy requires keeping full backups for 30 days and incremental backups for 7 days. An auditor reviews the backup schedule. Which backup type provides the fastest restore?

Accepted Answer

Full backup. A full backup contains all data and requires only one restore operation, making it faster than restoring from incremental or differential backups.

Answer

Log backup

Answer

Incremental backup

Answer

Differential backup

Question 6

An organization's backup strategy includes taking full backups weekly and transactional log backups every 15 minutes. The auditor wants to verify that backup encryption is implemented for offsite storage. Which control is most relevant?

Accepted Answer

Backup encryption at rest. Backup encryption at rest ensures that data stored offsite is protected from unauthorized access, which is a key control for offsite backups.

Answer

Backup compression

Answer

Offsite transport log

Answer

Backup verification logs

Question 7

An IT auditor is reviewing capacity management. The server team monitors CPU utilization and disk space. They receive alerts when thresholds are exceeded. Which practice is most effective for proactive capacity planning?

Accepted Answer

Analyzing historical utilization trends. Analyzing historical utilization trends allows IT to predict future capacity needs and plan upgrades before issues occur.

Answer

Performing weekly manual checks

Answer

Increasing server resources quarterly

Answer

Setting threshold alerts at 90% utilization

Question 8

An organization's availability management team reports that a critical server has an MTBF of 720 hours and an MTTR of 4 hours. What is the availability percentage for this server?

Accepted Answer

99.45%. Availability = MTBF / (MTBF + MTTR) = 720 / (720 + 4) = 720/724 ≈ 0.9945, or 99.45%.

Answer

99.56%

Answer

99.72%

Answer

99.89%

Question 9

During a business impact analysis (BIA), the auditor identifies a critical process with a maximum tolerable downtime (MTD) of 4 hours. The IT department proposes a recovery time objective (RTO) of 2 hours and a recovery point objective (RPO) of 1 hour. Which statement is correct?

Accepted Answer

The RTO is acceptable as it is less than the MTD. The RTO must be less than or equal to the MTD. Here, RTO (2 hours) is less than MTD (4 hours), so the recovery target is acceptable.

Answer

The MTD should be reduced to match the RTO

Answer

The RPO is too high because it exceeds the MTD

Answer

The RTO should be equal to the MTD

Question 10

An organization is selecting a disaster recovery (DR) site. The primary data center is located in a region prone to earthquakes. The DR site should be at a sufficient distance to avoid the same disaster. Which type of alternate site provides the best balance of cost and recovery time for a medium-sized organization?

Accepted Answer

Warm site. A warm site is partially configured with some hardware, software, and data synchronization, offering a balance between cost and recovery time. For a medium-sized organization, it provides faster recovery than a cold site while being significantly less expensive than a hot site, making it suitable for a region prone to earthquakes where the DR site must be geographically distant.

Answer

Hot site

Answer

Mobile site

Answer

Cold site

Question 11

An IT auditor is reviewing the business continuity plan (BCP) testing schedule. The organization conducts a test where participants discuss their roles and responses to a scenario without any actual system activation. Which type of test is this?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based test where participants walk through a scenario without executing procedures or activating systems.

Answer

Parallel test

Answer

Walkthrough

Answer

Simulation

Question 12

An organization outsources its help desk to a third-party vendor. The contract includes a service level agreement (SLA) with response times. The auditor wants to ensure that the organization can monitor vendor performance. Which clause is most important?

Accepted Answer

Right-to-audit clause. The right-to-audit clause allows the organization to audit the vendor's processes and performance, ensuring SLA compliance.

Answer

Exit strategy clause

Answer

Indemnification clause

Answer

Confidentiality clause

Question 13

An IT auditor is reviewing the asset management process for hardware lifecycle. Which two controls should the auditor verify to ensure secure disposition of decommissioned servers?

Accepted Answer

Secure sanitization of storage media. Secure sanitization of storage media (Option C) is critical because decommissioned servers often contain sensitive data that must be irrecoverably erased to prevent unauthorized access. A formal disposal policy with authorization (Option D) ensures that decommissioning follows a documented, approved process, including verification of sanitization and chain of custody. Together, these controls address both the technical and procedural aspects of secure disposition.

Answer

Hardware warranty tracking

Answer

Performance benchmarking

Answer

Asset tagging during procurement

Question 14

An organization is implementing a cloud resource management strategy to optimize costs and prevent waste. Which three practices should the auditor recommend?

Accepted Answer

Detect and remove orphaned resources. Option B is correct because orphaned resources (e.g., unattached EBS volumes, unused Elastic IPs, stale load balancers) continue to incur costs without providing any business value. Detecting and removing them directly eliminates waste, which is a core principle of cloud cost optimization. This practice aligns with the AWS Well-Architected Framework's Cost Optimization pillar, specifically the 'Stop Spending Money on Undifferentiated Heavy Lifting' design principle.

Answer

Consolidate all resources into a single region

Answer

Use only Reserved Instances for all workloads

Question 15

An organization is performing software asset management (SAM) to ensure license compliance. Which two activities should the auditor verify?

Accepted Answer

Reconciling installed software with purchase records. Regular license compliance audits ensure proper licensing. Reconciliation of installed software with purchased licenses identifies gaps or over-licensing.

Answer

Performing vulnerability scans

Answer

Monitoring network bandwidth usage

Answer

Tracking hardware depreciation