CISA Information Systems Operations and Business Resilience Practice Test 6 — 15 Questions

Question 1

An organization is implementing a new incident management process based on ITIL. An incident classified as P1 (Priority 1) occurs. According to ITIL best practices, what is the most appropriate initial action?

Accepted Answer

Immediately assign the incident to the appropriate support team for resolution.. P1 incidents are critical and require immediate response to restore service. The service desk should assign the incident to the appropriate support team without delay.

Answer

Escalate the incident to problem management for root cause analysis.

Answer

Update the known error database with a workaround.

Answer

Log the incident and inform the user that it will be handled within the next business day.

Question 2

During a change management process review, an IS auditor finds that the change advisory board (CAB) approved a change that subsequently caused a major service outage. The change was classified as 'normal' with no emergency. What is the auditor's primary concern?

Accepted Answer

The CAB did not adequately assess the potential impact of the change.. The primary concern is that the CAB approved a 'normal' change without adequately assessing its potential impact, leading to a major service outage. In ITIL-based change management, the CAB is responsible for evaluating the risk, impact, and resource requirements of a change before approval. A failure in this assessment indicates a breakdown in the change management process, which is the core issue an IS auditor must address.

Answer

The service desk was not notified of the change.

Answer

The change should have been classified as emergency.

Answer

The change was not tested in a pre-production environment.

Question 3

An IS auditor is reviewing automated job scheduling controls. A critical batch job failed due to a dependency on a previous job that had not completed. The system did not alert operations staff. Which control weakness is most significant?

Accepted Answer

Missing dependency management in job scheduling.. Job scheduling should include dependency management and failure alerts. The lack of an alert means the issue went unnoticed, potentially causing delays.

Answer

Insufficient capacity management to handle job load.

Answer

Inadequate rerun procedures for the failed job.

Answer

Lack of a known error database entry for this issue.

Question 4

An organization performs daily full backups of its critical database. The recovery time objective (RTO) is 4 hours. During a disaster, it takes 6 hours to restore the database. What is the most likely cause?

Accepted Answer

Recovery procedures are not tested against the RTO.. If the restore takes longer than the RTO, the backup and recovery process does not meet the required timeline. This could be due to inadequate infrastructure or testing.

Answer

Offsite storage location is too far.

Answer

The backup type (full) is insufficient.

Answer

Backup retention period is too short.

Question 5

An IS auditor is evaluating the capacity management process. The auditor notices that CPU utilization has been consistently above 90% for the past three months. The IT manager states that no proactive capacity planning has been performed. What is the primary risk?

Accepted Answer

Potential service degradation or unplanned outages.. Consistently high utilization without planning risks performance degradation and outages. The organization may not be able to handle peak loads.

Answer

Increased licensing costs for software.

Answer

Inability to meet backup windows.

Answer

Increased energy costs for cooling.

Question 6

An organization's business continuity plan (BCP) includes alternate facilities that can be operational within 24 hours. The maximum tolerable downtime (MTD) for a critical process is 12 hours. What is the most significant gap?

Accepted Answer

The alternate facility cannot be activated within the required MTD.. The alternate facility recovery time (24 hours) exceeds the MTD (12 hours), meaning the process would fail its recovery requirement.

Answer

The BCP does not include customer communication procedures.

Answer

The BCP does not address data backup procedures.

Answer

The recovery time objective (RTO) for the process is not defined.

Question 7

An organization has a disaster recovery plan that includes a hot site. During a full interruption test, the recovery team discovers that the hot site's network configuration is incompatible with the production environment. What is the most likely root cause?

Accepted Answer

The DR plan was not updated to reflect production changes.. The incompatibility suggests that the hot site was not properly configured to mirror production, possibly due to lack of change synchronization or testing.

Answer

The backup data was not encrypted.

Answer

The test was not conducted during business hours.

Answer

The hot site is too far from the primary site.

Question 8

An organization is negotiating a contract with a cloud service provider. Which clause is most important for the IS auditor to ensure is included?

Accepted Answer

Right-to-audit clause.. A right-to-audit clause allows the organization to verify the provider's controls and compliance, which is critical for third-party risk management.

Answer

Data localization requirements.

Answer

Automatic renewal terms.

Answer

Service level agreement (SLA) with penalties.

Question 9

During a software asset management (SAM) audit, the IS auditor discovers that the organization is using software versions that are no longer supported by the vendor. What is the primary risk?

Accepted Answer

Exposure to security vulnerabilities without patches.. The primary risk of using unsupported software versions is the absence of vendor-provided security patches. Without these patches, known vulnerabilities remain unaddressed, exposing the organization to exploitation, data breaches, and system compromise. This directly impacts the confidentiality, integrity, and availability of information assets.

Answer

Inability to recover data from backups.

Answer

Increased licensing costs due to non-compliance.

Answer

Difficulty in migrating to new versions.

Question 10

An organization uses a third-party vendor for application support. The vendor has subcontracted some support activities to another firm (fourth party). The contract with the vendor requires the vendor to ensure fourth-party compliance, but there is no direct oversight. What is the IS auditor's primary recommendation?

Accepted Answer

Include a right-to-audit clause for all subcontractors in the contract.. The primary recommendation is to include a right-to-audit clause for all subcontractors in the contract. This ensures the organization retains direct oversight and contractual leverage over fourth-party risks, as relying solely on the vendor's assurance without audit rights creates a blind spot in the supply chain. Without such a clause, the organization cannot independently verify the fourth party's compliance with security controls, which is critical for maintaining business resilience.

Answer

Perform a vulnerability assessment on the fourth party.

Answer

Terminate the contract with the vendor.

Answer

Require the vendor to provide evidence of fourth-party compliance.

Question 11

An IS auditor is reviewing the availability management process. The auditor calculates that the mean time between failures (MTBF) is 200 hours and the mean time to repair (MTTR) is 20 hours. What is the availability percentage?

Accepted Answer

90.91%. Availability = MTBF / (MTBF + MTTR) = 200 / 220 ≈ 0.9091, or 90.91%.

Answer

99.00%

Answer

95.00%

Answer

80.00%

Question 12

An organization is disposing of old servers. The IS auditor reviews the asset disposition process and finds that hard drives are being erased using a standard format command. What is the auditor's primary concern?

Accepted Answer

The data on the hard drives may still be recoverable.. Standard format commands do not securely erase data; data can still be recovered. Secure sanitization methods (e.g., degaussing, shredding) should be used.

Answer

The drives are not being tested for functionality.

Answer

The software licenses are not being transferred.

Answer

The servers are not being recycled for environmental compliance.

Question 13

An IS auditor is reviewing the backup process for a critical database. Which TWO of the following are essential controls to ensure data recoverability?

Accepted Answer

Offsite storage of backup media.. Offsite storage of backup media (Option B) is essential because it protects against site-level disasters such as fire, flood, or physical theft. Without geographic separation, a single incident could destroy both the primary data and its backups, making recovery impossible. This control directly supports the recoverability objective by ensuring a usable copy exists outside the primary facility.

Answer

Automated job scheduling for backups.

Answer

Encryption of backup data.

Answer

Backup retention period of at least one year.

Question 14

An organization is developing a business continuity strategy. According to best practices, which THREE of the following should be included in the strategy?

Accepted Answer

Customer and partner communications plan.. A comprehensive BCP includes procedures for people, alternate facilities, and communications.

Answer

Vendor contract renewal dates.

Answer

IT asset inventory list.

Question 15

An IS auditor is reviewing change management for a financial application. Which TWO of the following findings would most likely indicate a control weakness?

Accepted Answer

Regression testing is not performed for minor changes.. Regression testing ensures that code changes do not introduce new defects into existing functionality. Skipping regression testing for minor changes is a control weakness because even small modifications can have unintended side effects in a financial application where accuracy and reliability are critical. Without regression testing, the organization risks undetected errors that could lead to financial misstatements or system instability.

Answer

Normal changes are tested in a development environment before production.

Answer

The change advisory board meets weekly to review all changes.

Answer

All changes are documented in a change log.