CISA Information Systems Operations and Business Resilience Practice Test 4 — 15 Questions

Question 1

A system has a Mean Time Between Failures (MTBF) of 200 hours and a Mean Time To Repair (MTTR) of 20 hours. What is the availability of the system?

Accepted Answer

90.9%. Availability is calculated as MTBF / (MTBF + MTTR). With MTBF = 200 hours and MTTR = 20 hours, availability = 200 / (200 + 20) = 200/220 = 0.90909..., which rounds to 90.9%. This formula reflects the proportion of total time the system is operational versus the total time including repair.

Answer

95.0%

Answer

91.0%

Answer

90.0%

Question 2

An organization is conducting a Business Impact Analysis (BIA). Which of the following metrics defines the maximum acceptable outage time for a critical business process?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) defines the maximum acceptable outage time for a critical business process. It represents the total time a business can tolerate the unavailability of a process before unacceptable consequences occur. MTD is a key output of the BIA and sets the upper limit for recovery objectives.

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Answer

Work Recovery Time (WRT)

Question 3

During a disaster recovery test, the IS auditor observes that the alternate site uses a warm site configuration. Which of the following is a characteristic of a warm site?

Accepted Answer

It has equipment but requires data restoration. A warm site is a partially equipped recovery facility that contains the hardware, network infrastructure, and peripherals needed to run operations, but it does not have current production data pre-loaded. After a disaster is declared, the organization must restore data from backups and apply recent transaction logs before the site can process live workloads. This makes warm sites a middle-ground option between a cold site (empty facility) and a hot site (fully mirrored, near-instant failover).

Answer

It is a mobile recovery unit

Answer

It has infrastructure but no processing equipment

Answer

It is a fully operational duplicate of the primary site

Question 4

Which type of disaster recovery test involves a full switch-over from the primary site to the alternate site, resulting in actual disruption of normal operations?

Accepted Answer

Full interruption test. A full interruption test (also called full-scale test) involves actual failover, shutting down primary operations and running completely from the alternate site.

Answer

Tabletop test

Answer

Parallel test

Answer

Simulation test

Question 5

An organization outsources its IT help desk to a third-party vendor. Which clause is MOST important for the IS auditor to verify in the contract to ensure the organization can assess the vendor's controls?

Accepted Answer

Right-to-audit clause. A right-to-audit clause in the contract explicitly grants the organization the right to audit the vendor's controls, processes, and compliance, which is essential for the IS auditor to assess the vendor's security posture. Without this clause, the organization may have no contractual authority to conduct audits or obtain audit reports, making it impossible to verify the effectiveness of controls.

Answer

Service level agreement (SLA) metrics

Answer

Subcontracting restrictions

Answer

Exit strategy provisions

Question 6

Which TWO of the following are key considerations when managing software licenses in an organization? (Select TWO).

Accepted Answer

Implementing automated license optimization tools. Option A is correct because automated license optimization tools (e.g., Software Asset Management/SAM platforms that reconcile entitlements against discovered installations) continuously track usage, identify unused or over-deployed licenses, and help reclaim or reassign seats, which directly reduces cost and compliance risk. Option B is correct because regular license compliance audits compare purchased entitlements against actual deployments and usage, producing the evidence needed to true-up agreements, avoid vendor penalties, and satisfy software audits. Option C is not a key license-management consideration; storing installation media securely is a media-handling/backup practice, not license entitlement management. Option D is not correct because a hardware inventory supports asset tracking and configuration management, but it does not by itself address license entitlements, usage rights, or compliance. Option E is not correct because patching to the latest version is vulnerability and configuration management, unrelated to tracking or optimizing software licenses.

Answer

Storing all software installation media in a secure location

Answer

Maintaining a hardware inventory for asset tracking

Answer

Ensuring all software is patched to the latest version

Question 7

An IS auditor is reviewing the end-of-life (EOL) software policy. Which THREE risks are associated with running unsupported software? (Select THREE).

Accepted Answer

Regulatory non-compliance. Option B (Regulatory non-compliance) is correct because running EOL software often violates frameworks and mandates such as PCI DSS, HIPAA, or ISO 27001, which require supported, patched components, exposing the organization to fines and audit findings. Option D (Compatibility issues with newer systems) is correct because unsupported software no longer receives vendor updates, drivers, or patches, so it can fail to interoperate with current operating systems, databases, APIs, and hardware, causing integration and availability problems. Option E (Increased vulnerability to security breaches) is correct because once a vendor ends support, no new security patches are issued, leaving known and newly discovered CVEs permanently exploitable by attackers. Option A is not a risk of unsupported software; backups remain necessary regardless of support status, and EOL software does not reduce backup requirements. Option C is not inherently a risk of EOL software; licensing costs may actually drop or become irrelevant, and cost changes are not a standard risk associated with running unsupported software.

Answer

Reduced need for data backups

Answer

Higher software licensing costs

Question 8

An organization classifies IT incidents based on severity. A critical financial application is unavailable, impacting all users. According to ITIL best practices, which severity level should this incident be assigned?

Accepted Answer

P1. Under ITIL best practices, an incident that makes a critical financial application unavailable to all users is a P1 (Priority 1) incident because it has the highest impact and urgency. P1 incidents typically represent a complete loss of a critical business service affecting a large user population, requiring immediate escalation and continuous effort until resolution. The severity classification drives response times, escalation paths, and communication cadence.

Answer

P2

Answer

P3

Answer

P4

Question 9

During a change management board (CAB) meeting, a proposed change to the network firewall configuration is discussed. The change is considered low risk and pre-approved. Which type of change does this represent?

Accepted Answer

Standard change. A standard change is a pre-approved, low-risk change that follows a documented procedure and does not require additional review or approval from the change management board (CAB). Since the firewall change is described as low risk and pre-approved, it fits the definition of a standard change. Standard changes are routine and repeatable, allowing them to bypass the full CAB review process, which is reserved for normal or major changes.

Answer

Emergency change

Answer

Major change

Answer

Normal change

Question 10

An IT auditor is reviewing the problem management process. The IT team maintains a repository of known errors with documented workarounds. Which component of problem management is this?

Accepted Answer

Known error database. A known error database (KED) is the ITIL problem management repository that stores known errors and their documented workarounds. When the IT team maintains a repository of known errors with workarounds, that is by definition the KED.

Answer

Service request

Answer

Root cause analysis

Answer

Problem record

Question 11

An organization's backup strategy includes taking full backups weekly and transactional log backups every 15 minutes. The auditor wants to verify that backup encryption is implemented for offsite storage. Which control is most relevant?

Accepted Answer

Backup encryption at rest. Backup encryption at rest ensures that data stored offsite is protected from unauthorized access, which is a key control for offsite backups.

Answer

Backup compression

Answer

Offsite transport log

Answer

Backup verification logs

Question 12

An IT auditor is reviewing capacity management. The server team monitors CPU utilization and disk space. They receive alerts when thresholds are exceeded. Which practice is most effective for proactive capacity planning?

Accepted Answer

Analyzing historical utilization trends. Analyzing historical utilization trends allows the team to identify growth patterns, seasonal peaks, and long-term capacity exhaustion points before thresholds are breached. This is the essence of proactive capacity planning: using past data to predict future demand rather than reacting to alerts. Threshold alerts and manual checks are reactive or operational, not strategic planning practices.

Answer

Performing weekly manual checks

Answer

Increasing server resources quarterly

Answer

Setting threshold alerts at 90% utilization

Question 13

An organization's availability management team reports that a critical server has an MTBF of 720 hours and an MTTR of 4 hours. What is the availability percentage for this server?

Accepted Answer

99.45%. Availability is calculated as MTBF / (MTBF + MTTR). With MTBF = 720 hours and MTTR = 4 hours, availability = 720 / (720 + 4) = 720 / 724 ≈ 0.994475, which is 99.45% when rounded to two decimal places. This formula reflects the proportion of time the system is operational over its total lifecycle.

Answer

99.56%

Answer

99.72%

Answer

99.89%

Question 14

During a business impact analysis (BIA), the auditor identifies a critical process with a maximum tolerable downtime (MTD) of 4 hours. The IT department proposes a recovery time objective (RTO) of 2 hours and a recovery point objective (RPO) of 1 hour. Which statement is correct?

Accepted Answer

The RTO is acceptable as it is less than the MTD. The RTO must be less than or equal to the MTD. Here, RTO (2 hours) is less than MTD (4 hours), so the recovery target is acceptable.

Answer

The MTD should be reduced to match the RTO

Answer

The RPO is too high because it exceeds the MTD

Answer

The RTO should be equal to the MTD

Question 15

An organization is selecting a disaster recovery (DR) site. The primary data center is located in a region prone to earthquakes. The DR site should be at a sufficient distance to avoid the same disaster. Which type of alternate site provides the best balance of cost and recovery time for a medium-sized organization?

Accepted Answer

Warm site. A warm site is partially configured with some hardware, software, and data synchronization, offering a balance between cost and recovery time. For a medium-sized organization, it provides faster recovery than a cold site while being significantly less expensive than a hot site, making it suitable for a region prone to earthquakes where the DR site must be geographically distant.

Answer

Hot site

Answer

Mobile site

Answer

Cold site