CISA Information Systems Operations and Business Resilience Practice Test 7 — 15 Questions

Question 1

An organization's business continuity plan (BCP) includes alternate facilities that can be operational within 24 hours. The maximum tolerable downtime (MTD) for a critical process is 12 hours. What is the most significant gap?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The alternate facility cannot be activated within the required MTD.. The alternate facility recovery time (24 hours) exceeds the MTD (12 hours), meaning the process would fail its recovery requirement.

Answer

The BCP does not include customer communication procedures.

Answer

The BCP does not address data backup procedures.

Answer

The recovery time objective (RTO) for the process is not defined.

Question 2

An organization has a disaster recovery plan that includes a hot site. During a full interruption test, the recovery team discovers that the hot site's network configuration is incompatible with the production environment. What is the most likely root cause?

Accepted Answer

The DR plan was not updated to reflect production changes.. The incompatibility suggests that the hot site was not properly configured to mirror production, possibly due to lack of change synchronization or testing.

Answer

The backup data was not encrypted.

Answer

The test was not conducted during business hours.

Answer

The hot site is too far from the primary site.

Question 3

An organization is negotiating a contract with a cloud service provider. Which clause is most important for the IS auditor to ensure is included?

Accepted Answer

Right-to-audit clause.. The right-to-audit clause is the most critical contractual provision for an IS auditor because it grants the organization the legal right to inspect the cloud provider's controls, processes, and records — either directly or via third-party attestations (SOC 2, ISO 27001). Without it, the auditor cannot obtain sufficient evidence to opine on the effectiveness of controls over outsourced data and processing. It is the contractual foundation that makes all other assurance activities possible.

Answer

Data localization requirements.

Answer

Automatic renewal terms.

Answer

Service level agreement (SLA) with penalties.

Question 4

During a software asset management (SAM) audit, the IS auditor discovers that the organization is using software versions that are no longer supported by the vendor. What is the primary risk?

Accepted Answer

Exposure to security vulnerabilities without patches.. The primary risk of using unsupported software versions is the absence of vendor-provided security patches. Without these patches, known vulnerabilities remain unaddressed, exposing the organization to exploitation, data breaches, and system compromise. This directly impacts the confidentiality, integrity, and availability of information assets.

Answer

Inability to recover data from backups.

Answer

Increased licensing costs due to non-compliance.

Answer

Difficulty in migrating to new versions.

Question 5

An organization uses a third-party vendor for application support. The vendor has subcontracted some support activities to another firm (fourth party). The contract with the vendor requires the vendor to ensure fourth-party compliance, but there is no direct oversight. What is the IS auditor's primary recommendation?

Accepted Answer

Include a right-to-audit clause for all subcontractors in the contract.. The primary recommendation is to include a right-to-audit clause for all subcontractors in the contract. This ensures the organization retains direct oversight and contractual leverage over fourth-party risks, as relying solely on the vendor's assurance without audit rights creates a blind spot in the supply chain. Without such a clause, the organization cannot independently verify the fourth party's compliance with security controls, which is critical for maintaining business resilience.

Answer

Perform a vulnerability assessment on the fourth party.

Answer

Terminate the contract with the vendor.

Answer

Require the vendor to provide evidence of fourth-party compliance.

Question 6

An IS auditor is reviewing the availability management process. The auditor calculates that the mean time between failures (MTBF) is 200 hours and the mean time to repair (MTTR) is 20 hours. What is the availability percentage?

Accepted Answer

90.91%. Availability is calculated as MTBF / (MTBF + MTTR). With MTBF = 200 hours and MTTR = 20 hours, availability = 200 / (200 + 20) = 200 / 220 = 0.90909..., which is 90.91%. This formula expresses the proportion of time the system is operational relative to total time (uptime + downtime).

Answer

99.00%

Answer

95.00%

Answer

80.00%

Question 7

An organization is disposing of old servers. The IS auditor reviews the asset disposition process and finds that hard drives are being erased using a standard format command. What is the auditor's primary concern?

Accepted Answer

The data on the hard drives may still be recoverable.. Standard format commands do not securely erase data; data can still be recovered. Secure sanitization methods (e.g., degaussing, shredding) should be used.

Answer

The drives are not being tested for functionality.

Answer

The software licenses are not being transferred.

Answer

The servers are not being recycled for environmental compliance.

Question 8

An IS auditor is reviewing the backup process for a critical database. Which TWO of the following are essential controls to ensure data recoverability?

Accepted Answer

Offsite storage of backup media.. Option B (offsite storage of backup media) is essential because it ensures that a viable copy of the data survives a site-level disaster such as fire, flood, or theft that destroys the primary data center, which is a core requirement for recoverability. Option C (regular restore testing of backups) is essential because backups are only proven recoverable when restores are actually performed and validated; untested backups may fail due to media errors, corrupted files, or incomplete jobs, so periodic restore drills confirm the recovery capability and RTO/RPO assumptions. Option A (automated job scheduling) improves reliability and consistency but is a convenience/efficiency control, not a guarantee of recoverability, since scheduled jobs can still fail silently. Option D (encryption of backup data) is a confidentiality control that protects data at rest or in transit but does nothing to ensure the data can be restored. Option E (a one-year retention period) is an arbitrary retention choice driven by business, legal, and regulatory requirements rather than a universal essential control for recoverability.

Answer

Automated job scheduling for backups.

Answer

Encryption of backup data.

Answer

Backup retention period of at least one year.

Question 9

An organization is developing a business continuity strategy. According to best practices, which THREE of the following should be included in the strategy?

Accepted Answer

Customer and partner communications plan.. A customer and partner communications plan (A) is a required element of a business continuity strategy because during a disruption the organization must be able to notify external stakeholders about service status, expected recovery times, and alternate contact channels, which protects reputation and contractual relationships. Procedures for staff to work remotely (C) belong in the strategy because personnel are the most critical resource; documented remote-work procedures ensure that essential functions can continue when the primary site is unavailable. Details of alternate processing facilities (E) are essential because the strategy must identify where and how critical systems and operations will be resumed, including recovery site type (hot, warm, or cold), location, and activation criteria. Vendor contract renewal dates (B) are administrative procurement data rather than continuity planning content, and an IT asset inventory list (D) is an operational input used during business impact analysis and recovery planning, not a strategic continuity element itself.

Answer

Vendor contract renewal dates.

Answer

IT asset inventory list.

Question 10

An IS auditor is reviewing change management for a financial application. Which TWO of the following findings would most likely indicate a control weakness?

Accepted Answer

Regression testing is not performed for minor changes.. Option A is a control weakness because regression testing verifies that a change has not broken existing functionality; skipping it even for minor changes to a financial application risks undetected defects or integrity failures in production. Option B is a control weakness because emergency changes should be authorized by an appropriate business or IT authority (and later reviewed by the change advisory board), not by the change manager alone, which creates an improper segregation-of-duties conflict since the same person manages and approves the change. Option C is not a weakness because testing normal changes in a development environment before production is a sound change management control. Option D is not a weakness because a weekly change advisory board reviewing all changes provides proper oversight and authorization. Option E is not a weakness because documenting all changes in a change log supports traceability and auditability.

Answer

Normal changes are tested in a development environment before production.

Answer

The change advisory board meets weekly to review all changes.

Answer

All changes are documented in a change log.

Question 11

An organization is implementing an automated job scheduling system. Which of the following is the PRIMARY benefit of using dependency management in job scheduling?

Accepted Answer

Ensuring jobs execute in the correct sequence based on prerequisites. Dependency management in job scheduling ensures that jobs execute in the correct sequence based on prerequisites, so that a downstream job does not start until all its upstream dependencies have completed successfully. This prevents data corruption, race conditions, and processing errors that occur when jobs run out of order. It is the primary control that maintains processing integrity in automated batch environments.

Answer

Reducing the need for backup procedures

Answer

Automatically rerunning failed jobs without notification

Answer

Eliminating the need for human operators

Question 12

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

To identify critical business processes and their recovery requirements. A business impact analysis (BIA) is the foundational step in business continuity planning that identifies which business processes are critical and quantifies the impact of their disruption over time. It determines recovery time objectives (RTOs) and recovery point objectives (RPOs) for each process, which then drive the recovery strategies and resource requirements documented in the BCP and DRP. Without a BIA, recovery priorities cannot be rationally established.

Answer

To establish service level agreements (SLAs)

Answer

To test the effectiveness of backup procedures

Answer

To develop the disaster recovery plan

Question 13

An organization uses a hot site as its disaster recovery alternative. Which of the following is the MOST critical consideration when selecting a hot site?

Accepted Answer

Compatibility of hardware and software with the production environment. A hot site is a fully equipped alternate processing facility that is ready to take over operations immediately, so its hardware, operating systems, and applications must match the production environment exactly; otherwise, backups cannot be restored and workloads cannot resume. Compatibility is therefore the most critical selection criterion, since incompatibility defeats the entire purpose of paying for a hot site. Distance, cost, and staffing are important secondary factors but do not determine whether recovery is technically feasible.

Answer

Distance from the primary site

Answer

Cost of the hot site contract

Answer

Availability of staff at the hot site

Question 14

During a change management audit, an IS auditor finds that a critical system change was approved by the change manager without a CAB meeting. The change was categorized as a standard change. Which of the following should the auditor do FIRST?

Accepted Answer

Determine if the change was correctly classified as standard. The auditor's first step must be to verify whether the change was correctly classified as a standard change, because standard changes are pre-approved and do not require a CAB meeting. If the classification is correct, the process was followed; if not, the lack of CAB approval is a control failure. This aligns with ITIL best practices, where standard changes are low-risk, pre-authorized changes with a defined procedure, and the auditor must confirm the classification before escalating or recommending action.

Answer

Report a lack of segregation of duties

Answer

Recommend immediate rollback of the change

Answer

Escalate to senior management

Question 15

Which of the following is the PRIMARY benefit of conducting a tabletop exercise for disaster recovery?

Accepted Answer

Improving communication and decision-making among key personnel. A tabletop exercise brings key personnel together to walk through a disaster recovery scenario in a discussion-based setting, with the primary goal of testing and improving communication, coordination, and decision-making. It surfaces gaps in roles, escalation paths, and assumptions without touching production systems. This makes improved communication and decision-making the primary benefit.

Answer

Measuring the recovery time objective (RTO)

Answer

Validating the technical recovery procedures

Answer

Testing the actual restoration of systems