CISA Information Systems Operations and Business Resilience Practice Test 5 — 15 Questions

Question 1

An IT auditor is reviewing the business continuity plan (BCP) testing schedule. The organization conducts a test where participants discuss their roles and responses to a scenario without any actual system activation. Which type of test is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based BCP test where participants verbally walk through their roles and responses to a hypothetical scenario without activating systems or relocating staff. It is the least disruptive and least expensive test type, used to validate plans, clarify roles, and identify gaps before conducting more resource-intensive tests. Because the question specifies 'discuss their roles and responses... without any actual system activation,' this maps directly to a tabletop exercise.

Answer

Parallel test

Answer

Walkthrough

Answer

Simulation

Question 2

An organization outsources its help desk to a third-party vendor. The contract includes a service level agreement (SLA) with response times. The auditor wants to ensure that the organization can monitor vendor performance. Which clause is most important?

Accepted Answer

Right-to-audit clause. A right-to-audit clause contractually grants the organization the authority to audit the vendor's processes, controls, and records. Without it, the organization cannot independently verify SLA compliance or vendor performance, making it the most critical clause for monitoring. It provides the legal basis for the auditor to examine vendor operations and evidence.

Answer

Exit strategy clause

Answer

Indemnification clause

Answer

Confidentiality clause

Question 3

An IT auditor is reviewing the asset management process for hardware lifecycle. Which two controls should the auditor verify to ensure secure disposition of decommissioned servers?

Accepted Answer

Secure sanitization of storage media. Option C (Secure sanitization of storage media) is correct because decommissioned servers often retain sensitive data on HDDs, SSDs, or NVMe drives, and the auditor must verify that media are wiped using approved methods such as NIST SP 800-88 purge/clear or cryptographic erase, or physically destroyed, before the hardware leaves organizational control. Option D (Formal disposal policy with authorization) is correct because secure disposition requires a documented, approved process that defines roles, disposal methods, chain-of-custody, and management sign-off, ensuring decommissioning is authorized and auditable rather than ad hoc. The unmarked options do not belong: A (Hardware warranty tracking) relates to maintenance and support entitlements, not data-bearing disposition; B (Performance benchmarking) measures system capability and has no bearing on secure disposal; and E (Asset tagging during procurement) is an intake/inventory control that supports tracking but does not itself ensure secure sanitization or authorized disposal at end of life.

Answer

Hardware warranty tracking

Answer

Performance benchmarking

Answer

Asset tagging during procurement

Question 4

An organization is performing software asset management (SAM) to ensure license compliance. Which two activities should the auditor verify?

Accepted Answer

Reconciling installed software with purchase records. Option A is correct because reconciling installed software against purchase records is the core SAM control that detects over-deployment or under-licensing, matching discovered installations (via inventory/discovery tools) to entitlements and proof of purchase. Option C is correct because conducting regular license compliance audits provides periodic, documented verification that the organization's entitlements match actual usage, which is exactly what an auditor would test for ongoing license compliance. Option B is not part of SAM license compliance; vulnerability scans address security weaknesses, not entitlement reconciliation. Option D is unrelated, as network bandwidth monitoring concerns performance/capacity, not software licensing. Option E is also unrelated, since hardware depreciation is a financial asset-accounting activity, not software license compliance.

Answer

Performing vulnerability scans

Answer

Monitoring network bandwidth usage

Answer

Tracking hardware depreciation

Question 5

An organization has defined an RTO of 4 hours for its critical financial system. During a disaster recovery test, the system was recovered in 3.5 hours, but data loss was 30 minutes. Which metric is most directly addressed by the recovery time?

Accepted Answer

RTO. The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a system after a disaster. Since the organization's RTO is 4 hours and the system was recovered in 3.5 hours, the recovery time directly satisfies the RTO metric. The 30 minutes of data loss is irrelevant to RTO; it pertains to the Recovery Point Objective (RPO).

Answer

RPO

Answer

MTBF

Answer

MTTR

Question 6

An organization outsources its data center operations to a third-party vendor. The contract includes a right-to-audit clause. During a scheduled audit, the vendor refuses to provide access to logs from a subcontractor managing network security. What is the IS auditor's best course of action?

Accepted Answer

Escalate the issue to the vendor management team to enforce the contractual right.. The right-to-audit clause in the contract gives the organization legal authority to examine all relevant records, including those from subcontractors. Escalating to the vendor management team is the correct first step because they can enforce the contractual obligation without prematurely escalating to termination. This preserves the business relationship while asserting the organization's audit rights over the entire outsourced environment, including subcontracted network security operations.

Answer

Accept the vendor's refusal to avoid conflict.

Answer

Request the vendor to include a clause in its subcontractor agreement allowing audits.

Answer

Report the refusal to senior management and recommend terminating the contract.

Question 7

An IS auditor is reviewing the incident management process. Incidents are categorized as P1 (critical) through P4 (low). The SLA for P1 incidents requires initial response within 15 minutes and resolution within 4 hours. The auditor notes that the average time to respond to P1 incidents is 12 minutes, but the average resolution time is 6 hours. The root cause analysis shows that many P1 incidents are due to known errors documented in the known error database (KEDB). What is the most significant finding?

Accepted Answer

Problem management is not effectively utilizing the KEDB to prevent recurring incidents.. If known errors are causing P1 incidents, problem management should have identified workarounds or permanent fixes. The fact that these incidents recur indicates a weakness in the problem management process, which should reduce incidents from known errors.

Answer

The average resolution time for P1 incidents exceeds SLA.

Answer

The average response time for P1 incidents is within SLA.

Answer

Incident management is not escalating P1 incidents properly.

Question 8

Which backup method copies all data that has changed since the last full backup, regardless of subsequent incremental backups, and is often used to reduce restore time?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any incremental backups taken in between. This approach reduces restore time because only the last full backup and the most recent differential backup are needed, unlike incremental backups which require the full backup plus every subsequent incremental in sequence.

Answer

Full backup

Answer

Incremental backup

Answer

Mirror backup

Question 9

An organization uses automated job scheduling with dependency management. A critical nightly batch job failed because a prerequisite job did not complete successfully. The job scheduler automatically attempted to rerun the failed job three times, each time failing due to the same dependency. The operations team was not alerted until the next morning. What control should the auditor recommend to improve this process?

Accepted Answer

Implement real-time alerts for job failures and dependency issues.. The core issue is the lack of timely notification, not the number of retries or the dependency logic itself. The job scheduler correctly identified the dependency failure and attempted reruns, but the operations team remained unaware until the next morning. Implementing real-time alerts for job failures and dependency issues (Option B) ensures that the operations team can intervene immediately, rather than discovering the problem hours later during a manual check.

Answer

Increase the number of automatic rerun attempts.

Answer

Remove dependency management for critical jobs.

Answer

Schedule all critical jobs to run sequentially without dependencies.

Question 10

An IS auditor is reviewing the release management process for a critical application. The release strategy includes a phased rollout to 10% of users initially, then 50%, then 100%. The first phase revealed a data integrity issue that affected a subset of transactions. The release manager decided to continue with the next phase while a patch was being developed. What should the auditor most recommend?

Accepted Answer

Halt the rollout until the data integrity issue is resolved.. Continuing the rollout while a data integrity issue exists could affect more users. Best practice is to halt the rollout until the issue is resolved and patched, to prevent further impact and ensure the fix is effective.

Answer

Document the issue as a known error and proceed.

Answer

Accelerate the rollout to quickly identify all issues.

Answer

Increase testing in the next phase to catch issues earlier.

Question 11

Which type of disaster recovery test involves actually switching over to the alternate site and processing live transactions, but does not require the primary site to be shut down?

Accepted Answer

Parallel test. Parallel testing is the correct answer because it involves processing live transactions at the alternate site while the primary site remains fully operational. This allows validation of the disaster recovery (DR) systems without risking a service outage, as both sites run concurrently and results are compared for consistency. Unlike a full interruption test, the primary site is not shut down, ensuring business continuity during the test.

Answer

Simulation test

Answer

Full interruption test

Answer

Tabletop test

Question 12

An organization's IT service desk is the single point of contact for all incidents. The SLA for resolving P2 incidents is 8 hours. The auditor finds that the service desk frequently reassigns P2 incidents to second-level support without updating the incident record, causing delays in resolution. The average resolution time for P2 incidents is 10 hours. What is the primary control weakness?

Accepted Answer

Lack of automated escalation and tracking for incident reassignments.. The primary control weakness is the lack of automated escalation and tracking for incident reassignments. Without automated mechanisms (e.g., workflow triggers, timestamped reassignment logs, or integration with IT service management tools), the service desk can reassign P2 incidents to second-level support without updating the incident record, leading to untracked delays. This directly violates the SLA of 8 hours, as the average resolution time of 10 hours indicates that incidents are not being monitored or escalated properly, causing them to exceed the target.

Answer

Inadequate training of service desk staff.

Answer

SLA targets are too aggressive for P2 incidents.

Answer

Insufficient number of second-level support staff.

Question 13

An IS auditor is reviewing the vendor management program for a critical outsourced service. The vendor has recently been acquired by another company. Which TWO factors should the auditor be most concerned about regarding the acquisition?

Accepted Answer

The vendor's new owner may have different security standards.. Option A is correct because an acquisition can result in the new owner applying its own security policies, controls, and risk posture to the acquired vendor, potentially degrading the security safeguards the outsourced critical service previously met. Option E is correct because if the contract lacks a change-of-control clause requiring the customer's consent or notification, the acquisition could transfer the service to an owner the organization never vetted, leaving it without a contractual right to renegotiate, exit, or enforce prior obligations. Option B is not the primary audit concern since price increases are a commercial matter typically addressed through existing contract terms rather than a control or risk exposure. Option C is not selected because cultural differences, while relevant to relationship management, do not directly threaten the security or contractual integrity of the outsourced service. Option D is not selected because personnel turnover is an operational risk that should be managed through SLAs, knowledge transfer, and continuity provisions rather than being the defining concern of a change of control.

Answer

The vendor's new owner may increase prices.

Answer

The vendor's new owner may have a different organizational culture.

Answer

The vendor's new owner may lay off key personnel.

Question 14

During a disaster recovery planning audit, the IS auditor notes that the organization's plan includes a hot standby site. However, the plan has not been updated in two years, and the last test was a tabletop exercise 18 months ago. The organization has recently implemented a new ERP system. Which THREE findings should the auditor report as most significant?

Accepted Answer

The DR plan has not been tested in over a year.. Option A is correct because the plan's last test was a tabletop exercise 18 months ago, exceeding the commonly expected annual DR testing cadence; tabletop exercises alone also do not validate technical recovery of systems, so the lack of recent, more substantive testing is a significant finding. Option B is correct because the plan has not been updated in two years, meaning it likely no longer reflects the current infrastructure, dependencies, and recovery procedures, which undermines its reliability during an actual disaster. Option E is correct because the recently implemented ERP system is a critical business application whose recovery time objective (RTO) and recovery point objective (RPO), backup integration, and dependencies must be documented in the DR plan; failing to update the plan for it creates a major gap in recoverability. Option C is not marked correct because distance between sites is a design consideration that depends on the organization's risk assessment and is not inherently a deficiency. Option D is not marked correct because the scenario provides no evidence about management review or approval status, so it cannot be reported as a finding.

Answer

The hot standby site is located too far from the primary site.

Answer

The DR plan has not been reviewed and approved by senior management in the last year.

Question 15

An IS auditor is reviewing the software asset management (SAM) process. The organization uses a mix of commercial off-the-shelf (COTS) and open-source software. The auditor finds that several servers are running end-of-life (EOL) operating systems that are no longer patched. Which TWO risks are most directly associated with this finding?

Accepted Answer

Increased risk of security breaches due to unpatched vulnerabilities.. Option A is correct because EOL operating systems no longer receive vendor security patches, so known vulnerabilities (e.g., unpatched CVEs) remain exploitable, directly raising the likelihood of security breaches, malware infection, and unauthorized access. Option C is correct because many regulatory and compliance frameworks (e.g., PCI DSS, HIPAA, ISO 27001) mandate timely patching and vulnerability management; running unpatched EOL systems constitutes a direct compliance violation subject to audit findings, fines, or loss of certification. Option B is not the most direct risk, since integration difficulty is an operational/interoperability concern rather than the primary consequence of missing patches. Option D is not directly tied to EOL status, as reduced performance stems from hardware or software age, not the absence of security patches. Option E is unrelated, because licensing costs depend on contract terms and usage, not on whether an OS is EOL or unpatched.

Answer

Difficulty in integrating with newer systems.

Answer

Reduced performance due to outdated software.

Answer

Higher software licensing costs.