CISA Information Systems Operations and Business Resilience Practice Test 6 — 15 Questions

Question 1

During a problem management meeting, the team identifies a recurring issue causing multiple incidents. The root cause is known, but a permanent fix is not yet available. Which of the following is the BEST approach to manage this situation until a permanent fix is implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Document the known error and implement a workaround. In ITIL-based problem management, when a root cause is known but a permanent fix is unavailable, the known error should be documented in the Known Error Database (KEDB) and a workaround should be implemented to reduce incident impact and restore service. This aligns with the problem management process of controlling the error until a permanent solution (e.g., a patch or change) is deployed, ensuring operational continuity and minimizing recurrence of incidents.

Answer

Escalate the problem to senior management

Answer

Reclassify the problem as an incident

Answer

Close the problem record and wait for the fix

Question 2

An organization is implementing a change management process. A change that requires approval from the Change Advisory Board (CAB) but is scheduled to be implemented during the next maintenance window is classified as which type of change?

Accepted Answer

Normal change. A normal change is any change that is not a standard (pre-approved, low-risk, routine) change and not an emergency change; it must go through the full change management process including CAB review and approval, and is typically scheduled for a maintenance window. Because the change requires CAB approval and is scheduled for the next maintenance window, it fits the definition of a normal change. Standard changes are pre-authorized and do not require CAB review, while emergency changes bypass the normal schedule.

Answer

Emergency change

Answer

Standard change

Answer

Minor change

Question 3

An IT auditor is reviewing the release management process. Which of the following is the MOST important control to ensure that new releases do not negatively impact production systems?

Accepted Answer

Testing in a pre-production environment. Testing in a pre-production environment is the most critical control because it validates that the new release functions correctly and integrates with existing systems before it reaches production. This environment mirrors production, allowing defects, compatibility issues, and performance problems to be identified and resolved without impacting live operations. While other controls like rollback plans and approvals are important, they are reactive or administrative; pre-production testing is the primary proactive measure to prevent negative impacts.

Answer

Rollback plan

Answer

Communication to users

Answer

Approval from the change advisory board

Question 4

Which of the following is the PRIMARY purpose of a service desk?

Accepted Answer

To provide a single point of contact for incidents and service requests. The service desk acts as a single point of contact for IT support.

Answer

To monitor network performance

Answer

To manage IT assets

Answer

To perform root cause analysis

Question 5

An organization uses automated job scheduling for batch processing. A critical job fails due to a dependency on another job that has not completed. Which of the following controls would BEST prevent this issue?

Accepted Answer

Dependency management. Dependency management is the correct control because it ensures that job scheduling logic explicitly defines and enforces the order of execution based on predecessor/successor relationships. By configuring dependencies (e.g., using job control language (JCL) with COND parameters or scheduling tools like CA Workload Automation ESP), the system will automatically hold a job until all prerequisite jobs have completed successfully, preventing the failure scenario described.

Answer

Job failure alerts

Answer

Manual job scheduling

Answer

Rerun procedures

Question 6

An IT auditor is reviewing backup procedures. The organization performs daily full backups and retains them for 30 days. Additionally, weekly backups are retained for 12 months. Which of the following is the MOST likely risk associated with this backup strategy?

Accepted Answer

Excessive storage consumption and longer backup windows. The backup strategy performs daily full backups retained for 30 days and weekly backups retained for 12 months. This means that for each day, a full backup is stored, and additionally, weekly full backups are kept for a year. The most likely risk is excessive storage consumption because full backups are large and numerous, and longer backup windows because full backups take time to complete. This can strain storage capacity and backup infrastructure.

Answer

Backup data may not be recoverable

Answer

Inability to meet recovery point objectives

Answer

Backup encryption may be weak

Question 7

A system has a Mean Time Between Failures (MTBF) of 500 hours and a Mean Time To Repair (MTTR) of 20 hours. What is the availability of the system?

Accepted Answer

96.15%. Availability is calculated as MTBF / (MTBF + MTTR). With MTBF = 500 hours and MTTR = 20 hours, availability = 500 / (500 + 20) = 500 / 520 ≈ 0.9615, or 96.15%. This formula measures the proportion of time the system is operational, directly reflecting its resilience and recoverability.

Answer

97.50%

Answer

92.00%

Answer

95.00%

Question 8

During a business impact analysis (BIA), which of the following is the MOST important metric to identify for each critical business process?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) is the most important metric because it defines the maximum time a business process can be unavailable before causing unacceptable consequences. It sets the upper bound for recovery objectives like RTO and WRT. Without knowing MTD, other metrics lack context.

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Answer

Recovery Time Objective (RTO)

Question 9

An organization outsources its data center operations to a third-party provider. Which of the following is the MOST important clause to include in the contract to ensure the organization can verify the provider's controls?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the organization or its auditor to review the provider's controls.

Answer

Exit strategy

Answer

Service level agreement (SLA)

Answer

Vendor concentration risk clause

Question 10

During a software asset management (SAM) audit, it is discovered that the organization is using software that has reached end-of-life. Which of the following is the MOST significant risk associated with this situation?

Accepted Answer

Lack of security patches. End-of-life software no longer receives security patches from the vendor, meaning any newly discovered vulnerabilities will remain unaddressed. This creates a direct and exploitable attack surface, making lack of security patches the most significant risk because it can lead to data breaches, system compromise, and regulatory non-compliance.

Answer

Incompatibility with new hardware

Answer

Increased maintenance costs

Answer

License compliance issues

Question 11

An IT auditor is reviewing the capacity management process. Which TWO of the following are key activities that should be performed?

Accepted Answer

Monitoring resource utilization trends. Capacity management focuses on ensuring IT resources meet current and future demand, so option B (Monitoring resource utilization trends) is correct because tracking CPU, memory, storage, and network usage over time is the foundational activity that reveals whether capacity is adequate and where growth is heading. Option D (Setting threshold alerts for resource usage) is also correct because defining thresholds and alerts (for example, at 80% CPU or disk utilization) enables proactive notification before performance degrades, allowing timely scaling or remediation. Together, B and D represent the core capacity management cycle of measuring trends and acting on predefined limits. Option A (Performing daily backup verification) belongs to backup and recovery management, not capacity management. Option C (Reviewing incident response times) is a service-level or incident management metric, and option E (Conducting annual disaster recovery tests) is a business continuity and disaster recovery activity, neither of which addresses resource capacity planning.

Answer

Performing daily backup verification

Answer

Reviewing incident response times

Answer

Conducting annual disaster recovery tests

Question 12

An organization is developing a business continuity strategy. Which THREE of the following are essential components of a comprehensive BC strategy?

Accepted Answer

Alternate facilities. A comprehensive business continuity strategy must include alternate facilities (A), because if the primary site is unavailable, the organization needs a prearranged recovery site such as a hot, warm, or cold site to resume critical operations within the recovery time objective. Data backup and technology recovery (B) are essential because restoring systems, applications, and data from backups (with defined RPO/RTO) is the technical foundation for resuming business functions after disruption. People procedures and communication (E) are equally essential, since BC plans require defined roles, call trees, escalation paths, and communication methods to coordinate staff, customers, and stakeholders during and after an incident. Software licensing compliance (C) is a legal/audit concern rather than a core BC component, and vendor audit reports (D) support third-party risk management but are not themselves essential elements of a BC strategy.

Answer

Software licensing compliance

Answer

Vendor audit reports

Question 13

During a change management process review, an IS auditor finds that the change advisory board (CAB) approved a change that subsequently caused a major service outage. The change was classified as 'normal' with no emergency. What is the auditor's primary concern?

Accepted Answer

The CAB did not adequately assess the potential impact of the change.. The primary concern is that the CAB approved a 'normal' change without adequately assessing its potential impact, leading to a major service outage. In ITIL-based change management, the CAB is responsible for evaluating the risk, impact, and resource requirements of a change before approval. A failure in this assessment indicates a breakdown in the change management process, which is the core issue an IS auditor must address.

Answer

The service desk was not notified of the change.

Answer

The change should have been classified as emergency.

Answer

The change was not tested in a pre-production environment.

Question 14

An IS auditor is reviewing automated job scheduling controls. A critical batch job failed due to a dependency on a previous job that had not completed. The system did not alert operations staff. Which control weakness is most significant?

Accepted Answer

Missing dependency management in job scheduling.. The job failed because it ran before its prerequisite job completed, which is a classic dependency management failure in job scheduling. The scheduler should have enforced the dependency so the downstream job waits for the upstream job's successful completion. The absence of an alert is a secondary symptom of the same missing control, but the root control weakness is the lack of dependency management.

Answer

Insufficient capacity management to handle job load.

Answer

Inadequate rerun procedures for the failed job.

Answer

Lack of a known error database entry for this issue.

Question 15

An IS auditor is evaluating the capacity management process. The auditor notices that CPU utilization has been consistently above 90% for the past three months. The IT manager states that no proactive capacity planning has been performed. What is the primary risk?

Accepted Answer

Potential service degradation or unplanned outages.. Consistently high utilization without planning risks performance degradation and outages. The organization may not be able to handle peak loads.

Answer

Increased licensing costs for software.

Answer

Inability to meet backup windows.

Answer

Increased energy costs for cooling.