CISA Information Systems Operations and Business Resilience Practice Test 5 — 15 Questions

Question 1

An IS auditor is reviewing the software asset management (SAM) process. The organization uses a mix of commercial off-the-shelf (COTS) and open-source software. The auditor finds that several servers are running end-of-life (EOL) operating systems that are no longer patched. Which TWO risks are most directly associated with this finding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increased risk of security breaches due to unpatched vulnerabilities.. End-of-life (EOL) operating systems no longer receive security patches from the vendor, leaving known vulnerabilities unmitigated. This directly increases the risk of security breaches because attackers can exploit these unpatched flaws. Additionally, many regulatory frameworks (e.g., PCI DSS, SOX) require timely patching of critical systems, so running EOL software constitutes non-compliance with those requirements.

Answer

Difficulty in integrating with newer systems.

Answer

Reduced performance due to outdated software.

Answer

Higher software licensing costs.

Question 2

An organization's IT service desk categorizes incidents based on severity levels. A P1 incident is defined as a critical system outage affecting all users. Which of the following is the MOST appropriate target for the initial response time for a P1 incident?

Accepted Answer

Within 15 minutes. P1 incidents are critical and require immediate response, typically within minutes, not hours.

Answer

Within 4 hours

Answer

Within 1 business day

Answer

Within 30 minutes

Question 3

During a problem management meeting, the team identifies a recurring issue causing multiple incidents. The root cause is known, but a permanent fix is not yet available. Which of the following is the BEST approach to manage this situation until a permanent fix is implemented?

Accepted Answer

Document the known error and implement a workaround. In ITIL-based problem management, when a root cause is known but a permanent fix is unavailable, the known error should be documented in the Known Error Database (KEDB) and a workaround should be implemented to reduce incident impact and restore service. This aligns with the problem management process of controlling the error until a permanent solution (e.g., a patch or change) is deployed, ensuring operational continuity and minimizing recurrence of incidents.

Answer

Escalate the problem to senior management

Answer

Reclassify the problem as an incident

Answer

Close the problem record and wait for the fix

Question 4

An organization is implementing a change management process. A change that requires approval from the Change Advisory Board (CAB) but is scheduled to be implemented during the next maintenance window is classified as which type of change?

Accepted Answer

Normal change. Standard changes are pre-approved and low risk; emergency changes require urgent approval. Normal changes require CAB approval.

Answer

Emergency change

Answer

Standard change

Answer

Minor change

Question 5

An IT auditor is reviewing the release management process. Which of the following is the MOST important control to ensure that new releases do not negatively impact production systems?

Accepted Answer

Testing in a pre-production environment. Testing in a pre-production environment is essential to identify issues before deployment.

Answer

Rollback plan

Answer

Communication to users

Answer

Approval from the change advisory board

Question 6

Which of the following is the PRIMARY purpose of a service desk?

Accepted Answer

To provide a single point of contact for incidents and service requests. The service desk acts as a single point of contact for IT support.

Answer

To monitor network performance

Answer

To manage IT assets

Answer

To perform root cause analysis

Question 7

An organization uses automated job scheduling for batch processing. A critical job fails due to a dependency on another job that has not completed. Which of the following controls would BEST prevent this issue?

Accepted Answer

Dependency management. Dependency management is the correct control because it ensures that job scheduling logic explicitly defines and enforces the order of execution based on predecessor/successor relationships. By configuring dependencies (e.g., using job control language (JCL) with COND parameters or scheduling tools like CA Workload Automation ESP), the system will automatically hold a job until all prerequisite jobs have completed successfully, preventing the failure scenario described.

Answer

Job failure alerts

Answer

Manual job scheduling

Answer

Rerun procedures

Question 8

An IT auditor is reviewing backup procedures. The organization performs daily full backups and retains them for 30 days. Additionally, weekly backups are retained for 12 months. Which of the following is the MOST likely risk associated with this backup strategy?

Accepted Answer

Excessive storage consumption and longer backup windows. Full backups every day consume large amounts of storage and time; incremental backups are more efficient.

Answer

Backup data may not be recoverable

Answer

Inability to meet recovery point objectives

Answer

Backup encryption may be weak

Question 9

A system has a Mean Time Between Failures (MTBF) of 500 hours and a Mean Time To Repair (MTTR) of 20 hours. What is the availability of the system?

Accepted Answer

96.15%. Availability is calculated as MTBF / (MTBF + MTTR). With MTBF = 500 hours and MTTR = 20 hours, availability = 500 / (500 + 20) = 500 / 520 ≈ 0.9615, or 96.15%. This formula measures the proportion of time the system is operational, directly reflecting its resilience and recoverability.

Answer

97.50%

Answer

92.00%

Answer

95.00%

Question 10

During a business impact analysis (BIA), which of the following is the MOST important metric to identify for each critical business process?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) defines the maximum acceptable downtime before severe impact.

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Answer

Recovery Time Objective (RTO)

Question 11

An organization is selecting an alternate site for disaster recovery. The site must have sufficient equipment to resume operations within a few hours, and the organization is willing to share the site with another business. Which type of alternate site is MOST appropriate?

Accepted Answer

Warm site. A hot site is fully equipped and can be operational quickly, but sharing is uncommon. A warm site has some equipment. A cold site has no equipment. A mobile site is not a standard classification.

Answer

Mobile site

Answer

Cold site

Answer

Hot site

Question 12

Which of the following disaster recovery test types involves a full switch-over to the alternate site, resulting in actual disruption to normal operations?

Accepted Answer

Full interruption test. The full interruption test (also known as a cold-start test) involves an actual shutdown of primary systems and a complete switch-over to the alternate site, causing real disruption to normal operations. This validates the entire recovery capability under realistic conditions, including failover, data synchronization, and user reconnection, but carries the highest risk of data loss or extended downtime.

Answer

Simulation test

Answer

Parallel test

Answer

Tabletop test

Question 13

An organization outsources its data center operations to a third-party provider. Which of the following is the MOST important clause to include in the contract to ensure the organization can verify the provider's controls?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the organization or its auditor to review the provider's controls.

Answer

Exit strategy

Answer

Service level agreement (SLA)

Answer

Vendor concentration risk clause

Question 14

During a software asset management (SAM) audit, it is discovered that the organization is using software that has reached end-of-life. Which of the following is the MOST significant risk associated with this situation?

Accepted Answer

Lack of security patches. End-of-life software no longer receives security patches from the vendor, meaning any newly discovered vulnerabilities will remain unaddressed. This creates a direct and exploitable attack surface, making lack of security patches the most significant risk because it can lead to data breaches, system compromise, and regulatory non-compliance.

Answer

Incompatibility with new hardware

Answer

Increased maintenance costs

Answer

License compliance issues

Question 15

An IT auditor is reviewing the capacity management process. Which TWO of the following are key activities that should be performed?

Accepted Answer

Monitoring resource utilization trends. Monitoring trends helps proactive planning; threshold alerts prevent overload.

Answer

Performing daily backup verification

Answer

Reviewing incident response times

Answer

Conducting annual disaster recovery tests