CISA Information Systems Operations and Business Resilience Practice Test 9 — 15 Questions

Question 1

An IS auditor is reviewing an organization's problem management process. The auditor wants to verify that the process effectively identifies and resolves root causes of incidents. Which TWO of the following are the MOST important controls to ensure effective problem management? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incidents are logged with sufficient detail to allow trend analysis and identification of recurring issues.. The two most important controls are detailed incident logging for trend analysis and documentation of known errors linked to incidents. These controls enable the problem management process to identify recurring issues and provide workarounds, ultimately reducing the frequency and impact of incidents. They are fundamental to effective root cause analysis and continuous improvement.

Answer

Service level agreements (SLAs) specify penalties for missing incident resolution targets.

Answer

Problem tickets are automatically closed when the associated incident is resolved.

Answer

All changes are approved by the change advisory board (CAB) before implementation.

Question 2

An IS auditor is reviewing an organization's problem management process. The auditor wants to verify that the process effectively identifies and resolves root causes of incidents. Which TWO of the following are the MOST important controls to ensure effective problem management? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident resolution times will increase because support staff lack a knowledge base of known errors.. Problem management focuses on identifying the root causes of incidents and preventing recurrence. Without it, organizations suffer from repeated incidents and lack a known error database, which slows resolution. Incident logging and change management are separate processes that do not depend on problem management. Escalation of major incidents is an incident management activity, not a consequence of missing problem management.

Answer

Major incidents will automatically be escalated to the problem manager for resolution.

Answer

The service desk will be unable to log incidents due to the absence of problem records.

Answer

Change management will be unable to assess the impact of changes without problem tickets.

Question 3

An IS auditor is assessing the capacity management process for a virtualized data center. The auditor finds that CPU and memory utilization on a cluster of hosts regularly exceeds 85 percent during month-end processing, causing performance degradation. Management states that they monitor utilization but have no formal forecasting or trend analysis. Which of the following is the MOST significant risk arising from this situation?

Accepted Answer

Unplanned outages and service degradation during peak business periods.. The absence of forecasting and trend analysis in a capacity management process means the organization cannot anticipate resource demands. With utilization already exceeding 85 percent during month-end, the most significant risk is that peak loads will exhaust resources, causing outages or severe performance issues. This directly impacts business operations and service availability. Other concerns like chargeback or licensing are less immediate and not indicated by the scenario.

Answer

Inaccurate chargeback to business units for IT resource consumption.

Answer

Noncompliance with software licensing agreements due to overutilization.

Answer

Inability to recover from a disaster within the recovery time objective.

Question 4

An IS auditor is reviewing an organization's problem management process. The auditor wants to verify that the process effectively identifies and resolves root causes of incidents. Which TWO of the following are the MOST important controls to ensure effective problem management? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Operators rerun failed jobs without documenting the root cause, which prevents trend analysis and recurring failure identification.. Missing predecessor dependencies can cause downstream jobs to run before their inputs are ready, directly threatening data integrity and financial accuracy. Undocumented reruns prevent root cause analysis, allowing recurring failures to persist and potentially disrupt critical processing. Together, these findings represent significant operational risks that an IS auditor should prioritize because they affect the reliability, integrity, and recoverability of essential batch operations.

Answer

The batch schedule does not include a job for backing up the job scheduler's own configuration database.

Answer

The batch jobs process financial data but do not use checksums to verify data integrity during transfer between systems.

Answer

Operators are permitted to access the production job scheduler without a second person reviewing their changes.

Question 5

An IS auditor is evaluating the disaster recovery plan (DRP) for a organization that relies on a cloud-based ERP system. The DRP states that the recovery time objective (RTO) is 4 hours and the recovery point objective (RPO) is 1 hour. The cloud provider's SLA guarantees 99.9% availability but does not specify RTO or RPO. Which of the following should the auditor recommend FIRST?

Accepted Answer

Obtain a contractual commitment from the cloud provider that includes specific RTO and RPO guarantees.. The correct answer is to obtain a contractual commitment from the cloud provider that includes specific RTO and RPO guarantees. The organization's DRP is based on assumptions about the provider's recovery capabilities that are not backed by the SLA. Without contractual assurance, the organization cannot demonstrate that its RTO/RPO will be achieved. This is the foundational step before considering technical or architectural changes.

Answer

Develop an internal disaster recovery site to eliminate reliance on the cloud provider.

Answer

Increase the frequency of backup testing to ensure the RPO can be met.

Answer

Implement a secondary cloud region for real-time replication to achieve the RPO.

Question 6

An IS auditor is evaluating an organization's capacity management process for a critical database server. The auditor observes that CPU utilization averages 85% during peak hours, memory utilization is at 90%, and disk I/O wait times are consistently high. The organization has no formal capacity plan. Which of the following is the MOST significant risk the auditor should report?

Accepted Answer

The lack of a formal capacity plan may lead to unplanned outages and inability to meet service level agreements.. The absence of a formal capacity plan is the most critical risk because it leaves the organization unable to predict and prevent performance issues. High utilization metrics indicate the server is already stressed, and without a plan, the organization cannot ensure it will meet current and future demands, leading to potential outages and SLA breaches. Other issues like hardware needs or SAN tuning are symptoms that should be addressed within a capacity management framework.

Answer

The high CPU and memory utilization may indicate a need for additional hardware, which should be procured immediately.

Answer

The disk I/O wait times suggest that the storage area network (SAN) is misconfigured and requires tuning.

Answer

The organization is not complying with industry best practices for capacity management, which could result in regulatory penalties.

Question 7

An IS auditor is reviewing the job scheduling environment for an organization's overnight batch processing on a mainframe. The auditor finds that operators have the authority to modify job control statements, restart failed jobs, and manually release jobs held for review, all using the same production operator ID. Which finding should the auditor report as the GREATEST concern?

Accepted Answer

Execution, modification, and review of batch jobs are performed under a single shared operator ID.. Batch integrity depends on separating who prepares and modifies jobs from who executes, restarts, and releases them, and on unique IDs so every action is attributable. When one shared operator ID carries modification, restart, and release rights, a single operator can alter processing logic and then release the altered job without any independent check. That combination of powers, not any single right, is the reportable control failure.

Answer

Operators can restart failed jobs without notifying the application owner.

Answer

Operators can manually release jobs held for review using the same production operator ID.

Answer

Operators can modify job control statements without a second approver.

Question 8

An IS auditor is reviewing the IT operations of a small company. The auditor finds that scheduled batch jobs are monitored manually by an operator who checks job logs each morning. Which of the following is the MOST significant risk associated with this practice?

Accepted Answer

Job failures may not be detected until the next morning, delaying critical business processes.. Manual monitoring once per day means that any failure occurring after the check will not be detected until the next day, potentially delaying critical business processes. Automated monitoring with real-time alerts is essential for timely detection and response. Resource contention, operator skill, and log access are relevant but are not the primary risk introduced by this practice.

Answer

Batch jobs may run longer than expected, causing resource contention during peak hours.

Answer

The operator may lack the technical skills to restart failed jobs, leading to prolonged outages.

Answer

Manual monitoring increases the risk of unauthorized access to job logs containing sensitive data.

Question 9

An IS auditor is reviewing the backup strategy for a financial institution. The backup administrator states that full backups are taken every Sunday, and incremental backups are taken Monday through Saturday. On Thursday morning, a database server fails, and the administrator needs to restore the server to its state as of Wednesday night. Which backup sets must the administrator use to perform this restoration?

Accepted Answer

The most recent full backup and all incremental backups taken since that full backup.. In a full-plus-incremental backup strategy, a full backup captures all data, while each incremental backup captures only changes since the last backup of any type. To restore to a specific point, the administrator must restore the most recent full backup and then apply each subsequent incremental backup in the correct order. This ensures all changes are recovered. The other options incorrectly describe the restore process or assume a different backup scheme.

Answer

The most recent full backup, the differential backup, and the latest incremental backup.

Answer

The most recent full backup and the single most recent incremental backup.

Answer

Only the most recent full backup, as it contains all data up to the point of the backup.

Question 10

An IS auditor is reviewing how a data center schedules preventive maintenance on its uninterruptible power supply (UPS) systems and backup generators. The operations manager states that maintenance is performed monthly by an external vendor and that no formal maintenance window is documented because the work is done during low-usage hours. Which of the following is the MOST significant audit concern?

Accepted Answer

Maintenance is performed without a formally approved and documented maintenance window.. Preventive maintenance on power infrastructure must be planned, authorized, and documented so that availability risks are controlled and any outage can be traced to an approved activity. Performing maintenance during low-usage hours without a formal window means the activity is not governed by change and scheduling controls, leaving the organization exposed to uncoordinated interruptions and no reliable record of what was done to critical equipment.

Answer

Maintenance is performed monthly instead of quarterly.

Answer

The vendor performing the maintenance is external rather than internal staff.

Answer

The operations manager, rather than the vendor, owns the maintenance schedule.

Question 11

An IS auditor is reviewing the capacity management process for a virtualized server environment. The auditor finds that CPU and memory utilization reports are generated monthly, but no formal forecasting is performed, and no thresholds are defined for triggering capacity upgrades. Which of the following is the MOST significant risk arising from this situation?

Accepted Answer

The organization may be unable to detect and respond to emerging resource constraints before they impact service levels.. The absence of forecasting and defined thresholds means the organization cannot anticipate when resources will be exhausted. Monthly reports are retrospective and may not provide sufficient warning. This reactive posture increases the likelihood of unplanned outages or performance degradation, directly impacting service levels. The most significant risk is therefore the inability to detect and respond to emerging resource constraints before they affect critical business services.

Answer

Virtual machines may be over-provisioned, leading to unnecessary licensing costs.

Answer

Backup and recovery processes may fail because they are not integrated with capacity planning.

Answer

The virtualized environment may not comply with software licensing agreements due to inaccurate inventory.

Question 12

An IS auditor is reviewing the backup and restoration controls for a hospital's electronic health record (EHR) system, which runs on a relational database with a recovery point objective (RPO) of 15 minutes. The database administrator performs a full backup every Sunday at 01:00, differential backups nightly at 01:00, and transaction log backups every 15 minutes. During testing, the auditor observes that a restore of the database to a point in time at 14:07 on Wednesday completed successfully but took 9 hours, exceeding the stated maximum tolerable downtime (MTD) of 4 hours. Which TWO conclusions should the auditor draw from this observation? (Choose two.)

Accepted Answer

The recovery process should be re-engineered or supplemented so that restoration can be completed within the MTD.. The backup frequency meets the RPO, but the restore duration violates the MTD, revealing a gap between backup adequacy and actual recoverability. The auditor must recognize that a successful restore is not sufficient if it cannot be completed within the business tolerance. The appropriate conclusions are that the RPO is satisfied and that the recovery process must be improved to meet the MTD.

Answer

The transaction log backups should be replaced with hourly full backups to reduce the total restore time.

Answer

The differential backup strategy is the root cause of the lengthy restore because differential backups must be applied in sequence.

Answer

The restore should be considered a failure of the backup integrity controls because the elapsed time exceeded the MTD.

Question 13

An IS auditor is reviewing an organization's problem management process. The auditor wants to verify that the process effectively identifies and resolves root causes of incidents. Which TWO of the following are the MOST important controls to ensure effective problem management? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establish a formal problem prioritization scheme based on business impact and urgency.. The problem management process is reactive because problems are only created after multiple incidents. The two most important improvements are proactive trend analysis to identify recurring issues and a formal prioritization scheme to ensure business-relevant problems are addressed appropriately. These changes shift the process from reactive to proactive and risk-based, reducing repeat incidents and aligning problem resolution with business impact.

Answer

Require all incidents to be escalated to the problem manager immediately.

Answer

Outsource the problem management function to a third-party service provider.

Answer

Automate the closure of incidents when a problem record is created.

Question 14

An IS auditor is assessing the business impact analysis (BIA) for a critical business function. The BIA identifies a maximum tolerable downtime (MTD) of 8 hours and a recovery time objective (RTO) of 4 hours. The current disaster recovery plan (DRP) states that the recovery of this function will take 6 hours. What should the IS auditor conclude?

Accepted Answer

The DRP is inadequate because the recovery time exceeds the RTO.. The recovery time objective (RTO) defines the maximum acceptable time to restore a business function after a disruption. The disaster recovery plan's recovery time of 6 hours exceeds the RTO of 4 hours, meaning the plan cannot meet the business requirement. Although the recovery time is within the maximum tolerable downtime (MTD), the RTO is the target that must be met to avoid unacceptable impact. Therefore, the auditor should conclude the DRP is inadequate and recommend improvements.

Answer

The DRP is adequate because the recovery time is within the MTD, and the RTO is only a guideline.

Answer

The DRP is inadequate because the MTD is greater than the RTO, indicating a misalignment.

Answer

The DRP is adequate because the recovery time is less than the MTD.

Question 15

An IS auditor is reviewing a batch job scheduling environment. A critical nightly job that feeds the general ledger depends on a file transfer from a subsidiary. The scheduler is configured so that if the transfer does not complete by 02:00, the job is cancelled and the ledger is not updated. Operations staff report that they manually rerun the job each morning when this occurs. Which of the following is the MOST important issue for the auditor to raise?

Accepted Answer

The manual morning reruns are not documented, approved, or monitored as operational procedures.. A recurring batch failure that is silently corrected by manual reruns represents an uncontrolled operational workaround. Because the ledger update depends on informal operator action, there is no assurance that the rerun is performed consistently, authorized, or evidenced. The auditor should require that the dependency failure be detected and alerted, that the recovery procedure be documented and approved, and that reruns be logged and reviewed so completeness of financial processing is demonstrable.

Answer

The scheduler cancels the job instead of retrying the file transfer automatically.

Answer

The subsidiary file transfer uses a protocol that is not encrypted.

Answer

The 02:00 cutoff time is too early for the subsidiary to complete its transfer.