CISA Information Systems Operations and Business Resilience Practice Test 4 — 15 Questions

Question 1

An organization has defined an RTO of 4 hours for its critical financial system. During a disaster recovery test, the system was recovered in 3.5 hours, but data loss was 30 minutes. Which metric is most directly addressed by the recovery time?

Accepted Answer

RTO. The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a system after a disaster. Since the organization's RTO is 4 hours and the system was recovered in 3.5 hours, the recovery time directly satisfies the RTO metric. The 30 minutes of data loss is irrelevant to RTO; it pertains to the Recovery Point Objective (RPO).

Answer

RPO

Answer

MTBF

Answer

MTTR

Question 2

During a change management review, an IS auditor discovers that a recent database upgrade was implemented without prior approval from the Change Advisory Board (CAB) because it was classified as a 'standard change.' However, the change involved migrating to a new database version that required application code modifications. What should concern the auditor most?

Accepted Answer

The change was implemented without CAB approval.. The core issue is that the change was misclassified as a 'standard change' to bypass CAB approval, but it required application code modifications, which means it was not pre-authorized and should have been treated as a normal or emergency change. Standard changes are low-risk, pre-approved, and typically involve no application code changes (e.g., applying a routine patch to a database that does not alter the schema or API). By bypassing CAB review, the organization lost the opportunity to assess risks, dependencies, and rollback procedures, which is a critical control failure in change management.

Answer

The change did not include a backout plan.

Answer

The change was implemented during business hours.

Answer

The change was implemented without testing.

Question 3

An organization outsources its data center operations to a third-party vendor. The contract includes a right-to-audit clause. During a scheduled audit, the vendor refuses to provide access to logs from a subcontractor managing network security. What is the IS auditor's best course of action?

Accepted Answer

Escalate the issue to the vendor management team to enforce the contractual right.. The right-to-audit clause in the contract gives the organization legal authority to examine all relevant records, including those from subcontractors. Escalating to the vendor management team is the correct first step because they can enforce the contractual obligation without prematurely escalating to termination. This preserves the business relationship while asserting the organization's audit rights over the entire outsourced environment, including subcontracted network security operations.

Answer

Accept the vendor's refusal to avoid conflict.

Answer

Request the vendor to include a clause in its subcontractor agreement allowing audits.

Answer

Report the refusal to senior management and recommend terminating the contract.

Question 4

An IS auditor is reviewing the incident management process. Incidents are categorized as P1 (critical) through P4 (low). The SLA for P1 incidents requires initial response within 15 minutes and resolution within 4 hours. The auditor notes that the average time to respond to P1 incidents is 12 minutes, but the average resolution time is 6 hours. The root cause analysis shows that many P1 incidents are due to known errors documented in the known error database (KEDB). What is the most significant finding?

Accepted Answer

Problem management is not effectively utilizing the KEDB to prevent recurring incidents.. If known errors are causing P1 incidents, problem management should have identified workarounds or permanent fixes. The fact that these incidents recur indicates a weakness in the problem management process, which should reduce incidents from known errors.

Answer

The average resolution time for P1 incidents exceeds SLA.

Answer

The average response time for P1 incidents is within SLA.

Answer

Incident management is not escalating P1 incidents properly.

Question 5

Which backup method copies all data that has changed since the last full backup, regardless of subsequent incremental backups, and is often used to reduce restore time?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any incremental backups taken in between. This approach reduces restore time because only the last full backup and the most recent differential backup are needed, unlike incremental backups which require the full backup plus every subsequent incremental in sequence.

Answer

Full backup

Answer

Incremental backup

Answer

Mirror backup

Question 6

An organization uses automated job scheduling with dependency management. A critical nightly batch job failed because a prerequisite job did not complete successfully. The job scheduler automatically attempted to rerun the failed job three times, each time failing due to the same dependency. The operations team was not alerted until the next morning. What control should the auditor recommend to improve this process?

Accepted Answer

Implement real-time alerts for job failures and dependency issues.. The core issue is the lack of timely notification, not the number of retries or the dependency logic itself. The job scheduler correctly identified the dependency failure and attempted reruns, but the operations team remained unaware until the next morning. Implementing real-time alerts for job failures and dependency issues (Option B) ensures that the operations team can intervene immediately, rather than discovering the problem hours later during a manual check.

Answer

Increase the number of automatic rerun attempts.

Answer

Remove dependency management for critical jobs.

Answer

Schedule all critical jobs to run sequentially without dependencies.

Question 7

During a business impact analysis (BIA), the IS auditor identifies that the maximum tolerable downtime (MTD) for an online payment system is 2 hours, and the recovery point objective (RPO) is 15 minutes. The current disaster recovery solution uses nightly backups (12-hour RPO) and can restore the system in 4 hours. Which risk is most critical?

Accepted Answer

Data loss exceeds the RPO.. The current solution has a 12-hour RPO (nightly backups), but the business requires an RPO of 15 minutes. This means up to 11 hours and 45 minutes of transaction data could be lost, far exceeding the acceptable data loss threshold. While the recovery time of 4 hours also exceeds the MTD of 2 hours, the most critical risk is data loss because the gap between the actual RPO and the required RPO is proportionally larger and directly impacts transaction integrity and financial reconciliation.

Answer

The backup frequency is not aligned with the RPO.

Answer

The disaster recovery plan has not been tested.

Answer

Recovery time exceeds the MTD.

Question 8

An IS auditor is reviewing the release management process for a critical application. The release strategy includes a phased rollout to 10% of users initially, then 50%, then 100%. The first phase revealed a data integrity issue that affected a subset of transactions. The release manager decided to continue with the next phase while a patch was being developed. What should the auditor most recommend?

Accepted Answer

Halt the rollout until the data integrity issue is resolved.. Continuing the rollout while a data integrity issue exists could affect more users. Best practice is to halt the rollout until the issue is resolved and patched, to prevent further impact and ensure the fix is effective.

Answer

Document the issue as a known error and proceed.

Answer

Accelerate the rollout to quickly identify all issues.

Answer

Increase testing in the next phase to catch issues earlier.

Question 9

Which type of disaster recovery test involves actually switching over to the alternate site and processing live transactions, but does not require the primary site to be shut down?

Accepted Answer

Parallel test. Parallel testing is the correct answer because it involves processing live transactions at the alternate site while the primary site remains fully operational. This allows validation of the disaster recovery (DR) systems without risking a service outage, as both sites run concurrently and results are compared for consistency. Unlike a full interruption test, the primary site is not shut down, ensuring business continuity during the test.

Answer

Simulation test

Answer

Full interruption test

Answer

Tabletop test

Question 10

An organization uses a cloud-based CRM system. The asset management team has implemented tagging to track resource costs by department. During an audit, the IS auditor finds that several orphaned resources (e.g., virtual machines, storage volumes) exist that are not tagged and have been running for months. The cloud service provider's cost allocation report shows these resources under a default account. What is the most significant risk associated with this finding?

Accepted Answer

Inaccurate cost allocation and potential budget overruns.. The most significant risk is inaccurate cost allocation and potential budget overruns because the orphaned resources are not tagged and are billed under a default account, preventing the organization from accurately attributing cloud costs to the responsible departments. This undermines the purpose of the tagging strategy implemented by the asset management team and can lead to unplanned expenses that are not tracked against any budget owner, directly impacting financial control and operational accountability.

Answer

Increased attack surface from forgotten resources.

Answer

Security misconfiguration due to lack of ownership.

Answer

Compliance violation with data residency requirements.

Question 11

An IS auditor is reviewing the capacity management process for a server hosting a critical application. The server's CPU utilization has been consistently above 90% for the past three months, and memory usage is at 85%. There are no threshold alerts configured. The capacity plan shows that additional resources are scheduled to be added in six months. What should the auditor most recommend?

Accepted Answer

Request immediate addition of resources to meet current demand.. The high utilization indicates a need for immediate capacity expansion. The existing plan is too far in the future, risking performance degradation or outages. The auditor should recommend expediting the addition of resources.

Answer

Review the capacity plan and adjust the forecast.

Answer

Accept the risk as the server has not failed yet.

Answer

Implement threshold alerts to monitor the situation.

Question 12

An organization's IT service desk is the single point of contact for all incidents. The SLA for resolving P2 incidents is 8 hours. The auditor finds that the service desk frequently reassigns P2 incidents to second-level support without updating the incident record, causing delays in resolution. The average resolution time for P2 incidents is 10 hours. What is the primary control weakness?

Accepted Answer

Lack of automated escalation and tracking for incident reassignments.. The primary control weakness is the lack of automated escalation and tracking for incident reassignments. Without automated mechanisms (e.g., workflow triggers, timestamped reassignment logs, or integration with IT service management tools), the service desk can reassign P2 incidents to second-level support without updating the incident record, leading to untracked delays. This directly violates the SLA of 8 hours, as the average resolution time of 10 hours indicates that incidents are not being monitored or escalated properly, causing them to exceed the target.

Answer

Inadequate training of service desk staff.

Answer

SLA targets are too aggressive for P2 incidents.

Answer

Insufficient number of second-level support staff.

Question 13

An IS auditor is reviewing the vendor management program for a critical outsourced service. The vendor has recently been acquired by another company. Which TWO factors should the auditor be most concerned about regarding the acquisition?

Accepted Answer

The vendor's new owner may have different security standards.. A change in vendor ownership can affect the contractual relationship and service delivery. The auditor should focus on whether the contract allows assignment (without consent) and whether the new owner's financial stability poses a risk.

Answer

The vendor's new owner may increase prices.

Answer

The vendor's new owner may have a different organizational culture.

Answer

The vendor's new owner may lay off key personnel.

Question 14

During a disaster recovery planning audit, the IS auditor notes that the organization's plan includes a hot standby site. However, the plan has not been updated in two years, and the last test was a tabletop exercise 18 months ago. The organization has recently implemented a new ERP system. Which THREE findings should the auditor report as most significant?

Accepted Answer

The DR plan has not been tested in over a year.. The plan is outdated (two years), the last test was only tabletop (not sufficient for a hot site), and the new ERP system is not reflected in the plan. These three issues directly impact the ability to recover effectively.

Answer

The hot standby site is located too far from the primary site.

Answer

The DR plan has not been reviewed and approved by senior management in the last year.

Question 15

An IS auditor is reviewing the software asset management (SAM) process. The organization uses a mix of commercial off-the-shelf (COTS) and open-source software. The auditor finds that several servers are running end-of-life (EOL) operating systems that are no longer patched. Which TWO risks are most directly associated with this finding?

Accepted Answer

Increased risk of security breaches due to unpatched vulnerabilities.. End-of-life (EOL) operating systems no longer receive security patches from the vendor, leaving known vulnerabilities unmitigated. This directly increases the risk of security breaches because attackers can exploit these unpatched flaws. Additionally, many regulatory frameworks (e.g., PCI DSS, SOX) require timely patching of critical systems, so running EOL software constitutes non-compliance with those requirements.

Answer

Difficulty in integrating with newer systems.

Answer

Reduced performance due to outdated software.

Answer

Higher software licensing costs.