CISA Information Systems Operations and Business Resilience Practice Test 7 — 15 Questions

Question 1

An IS auditor is reviewing change management for a financial application. Which TWO of the following findings would most likely indicate a control weakness?

Accepted Answer

Regression testing is not performed for minor changes.. Regression testing ensures that code changes do not introduce new defects into existing functionality. Skipping regression testing for minor changes is a control weakness because even small modifications can have unintended side effects in a financial application where accuracy and reliability are critical. Without regression testing, the organization risks undetected errors that could lead to financial misstatements or system instability.

Answer

Normal changes are tested in a development environment before production.

Answer

The change advisory board meets weekly to review all changes.

Answer

All changes are documented in a change log.

Question 2

An organization is implementing an automated job scheduling system. Which of the following is the PRIMARY benefit of using dependency management in job scheduling?

Accepted Answer

Ensuring jobs execute in the correct sequence based on prerequisites. Dependency management ensures jobs run in the correct sequence based on prerequisites, reducing errors and manual intervention.

Answer

Reducing the need for backup procedures

Answer

Automatically rerunning failed jobs without notification

Answer

Eliminating the need for human operators

Question 3

An IS auditor is reviewing a backup strategy that includes daily full backups and weekly offsite storage. The recovery time objective (RTO) for a critical application is 4 hours. Which of the following findings would be of GREATEST concern?

Accepted Answer

Backup tapes are stored offsite and retrieved only once per month. If the backup media are stored offsite without a local copy, the time to retrieve and restore may exceed the RTO.

Answer

Backup logs are reviewed weekly

Answer

Incremental backups are not performed between full backups

Answer

Backups are encrypted with AES-256

Question 4

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

To identify critical business processes and their recovery requirements. BIA identifies critical processes, dependencies, and recovery requirements.

Answer

To establish service level agreements (SLAs)

Answer

To test the effectiveness of backup procedures

Answer

To develop the disaster recovery plan

Question 5

An organization uses a hot site as its disaster recovery alternative. Which of the following is the MOST critical consideration when selecting a hot site?

Accepted Answer

Compatibility of hardware and software with the production environment. The hot site must be compatible with the production environment to enable quick recovery.

Answer

Distance from the primary site

Answer

Cost of the hot site contract

Answer

Availability of staff at the hot site

Question 6

During a change management audit, an IS auditor finds that a critical system change was approved by the change manager without a CAB meeting. The change was categorized as a standard change. Which of the following should the auditor do FIRST?

Accepted Answer

Determine if the change was correctly classified as standard. The auditor's first step must be to verify whether the change was correctly classified as a standard change, because standard changes are pre-approved and do not require a CAB meeting. If the classification is correct, the process was followed; if not, the lack of CAB approval is a control failure. This aligns with ITIL best practices, where standard changes are low-risk, pre-authorized changes with a defined procedure, and the auditor must confirm the classification before escalating or recommending action.

Answer

Report a lack of segregation of duties

Answer

Recommend immediate rollback of the change

Answer

Escalate to senior management

Question 7

An organization has an availability requirement of 99.99% for its online transaction processing system. The system's MTBF is 720 hours. What is the maximum allowable MTTR to meet this requirement?

Accepted Answer

4.32 minutes. Availability = MTBF/(MTBF+MTTR). 0.9999 = 720/(720+MTTR) => MTTR = 720/0.9999 - 720 = 0.072 hours ≈ 4.32 minutes.

Answer

43.2 minutes

Answer

72 minutes

Answer

7.2 minutes

Question 8

Which of the following is the PRIMARY benefit of conducting a tabletop exercise for disaster recovery?

Accepted Answer

Improving communication and decision-making among key personnel. Tabletop exercises focus on discussion and coordination among participants without technical testing.

Answer

Measuring the recovery time objective (RTO)

Answer

Validating the technical recovery procedures

Answer

Testing the actual restoration of systems

Question 9

An IS auditor is reviewing a third-party service provider's controls. Which of the following is the MOST important clause to include in the contract to ensure the auditor can assess the provider's controls?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the customer or its auditor to review the provider's controls.

Answer

Service level agreement (SLA) with penalties

Answer

Exit strategy clause

Answer

Confidentiality clause

Question 10

An organization uses RAID 5 for its database server. Which of the following is the PRIMARY advantage of RAID 5?

Accepted Answer

Fault tolerance with one disk failure. RAID 5 provides fault tolerance with parity, allowing recovery from a single disk failure.

Answer

Simplified backup process

Answer

Increased storage capacity without parity overhead

Answer

Improved read performance

Question 11

During an audit of IT asset management, the IS auditor finds that several servers are running an operating system that has reached end-of-life (EOL). The organization has not deployed any compensating controls. Which of the following is the GREATEST risk?

Accepted Answer

Unpatched security vulnerabilities. An operating system that has reached end-of-life (EOL) no longer receives security patches from the vendor. Without compensating controls, any newly discovered vulnerabilities remain unpatched, exposing the organization to exploitation, data breaches, and system compromise. This directly undermines the confidentiality, integrity, and availability of the IT assets, making unpatched security vulnerabilities the greatest risk.

Answer

Incompatibility with new applications

Answer

Increased licensing costs

Answer

Lack of vendor support

Question 12

In ITIL incident management, which severity level typically indicates a critical incident that severely impacts business operations and requires immediate resolution?

Accepted Answer

P1. P1 (Priority 1) incidents are the highest severity, requiring immediate attention.

Answer

P2

Answer

P3

Answer

P4

Question 13

An organization is implementing a software asset management (SAM) program. Which of the following is the PRIMARY benefit of SAM?

Accepted Answer

Ensuring compliance with software licensing agreements. SAM helps ensure compliance with software licenses and avoid penalties.

Answer

Reducing hardware costs

Answer

Automating patch management

Answer

Improving network performance

Question 14

An IS auditor is reviewing a business continuity plan (BCP). Which TWO of the following are key components of the business continuity strategy? (Select two.)

Accepted Answer

Data backup and recovery. Alternate facilities and data backup and recovery are essential components of BC strategy.

Answer

Incident management procedures

Answer

Service desk procedures

Answer

Change management process

Question 15

An organization is planning a full interruption test of its disaster recovery plan. Which THREE of the following should the IS auditor recommend as best practices for this type of test? (Select three.)

Accepted Answer

Notify all relevant stakeholders in advance. Notifying all relevant stakeholders in advance is a best practice for a full interruption test. This ensures that business units, IT teams, and external vendors are prepared for the planned outage, minimizing confusion and allowing coordinated execution. Without prior notification, the test could cause unnecessary panic or operational disruption, undermining the controlled nature of the exercise.

Answer

Conduct the test during peak business hours to simulate real conditions

Answer

Ensure the test is scheduled after a major system upgrade to validate changes