CISA Information Systems Operations and Business Resilience — 15 Questions

Question 1

An organization experiences a critical system failure during non-business hours. The IT team discovers that the last full backup was 48 hours ago, and the incremental backups for the past 24 hours are corrupted. The recovery time objective (RTO) for this system is 4 hours, and the recovery point objective (RPO) is 1 hour. Which of the following is the MOST immediate concern?

Accepted Answer

The data loss may exceed the recovery point objective (RPO). The RPO of 1 hour means the organization can tolerate losing at most 1 hour of data. With the last full backup 48 hours old and incremental backups for the past 24 hours corrupted, the usable recovery point is at least 24 hours old, resulting in data loss far exceeding the 1-hour RPO. This gap between actual and acceptable data loss is the most immediate concern because it directly violates the business continuity requirement.

Answer

The backup schedule should be changed to daily full backups

Answer

The root cause of the failure must be determined before recovery

Answer

The recovery time objective (RTO) of 4 hours will be exceeded

Question 2

An IT auditor is reviewing the business continuity plan (BCP) for a financial services firm. The plan includes a hot site that is shared with another organization under a reciprocal agreement. Which of the following findings should be of MOST concern to the auditor?

Accepted Answer

The reciprocal agreement does not guarantee exclusive use of the hot site during a disaster. Option C is correct because a reciprocal agreement for a shared hot site does not guarantee exclusive access during a disaster. If both organizations declare a disaster simultaneously, the site may become oversubscribed, leading to resource contention and potential failure of the BCP. This directly undermines the recovery capability, making it the most critical finding.

Answer

The hot site uses a different internet service provider than the primary site

Answer

The hot site has not been tested in the past 12 months

Answer

The hot site is located in the same seismic zone as the primary site

Question 3

A company is designing its backup strategy for a critical database that must be available 24/7. The database experiences high transaction volumes. Which backup method minimizes data loss while allowing continuous operations?

Accepted Answer

Online backup with transaction log backups. Online backup with transaction log backups (Option C) is correct because it allows the database to remain fully operational (24/7 availability) while capturing every committed transaction in the transaction log. In the event of a failure, you can restore the most recent full backup and then apply all subsequent transaction log backups to recover to the exact point of failure, minimizing data loss to only uncommitted transactions.

Answer

Offline full backup performed weekly

Answer

Differential backup performed daily

Answer

Full backup performed during low-usage periods

Question 4

During an incident response exercise, the IT team discovers that the failover to the disaster recovery (DR) site failed because the DR site's storage area network (SAN) was not zoned correctly for the replicated data. Which of the following controls would BEST prevent this issue?

Accepted Answer

Conducting regular disaster recovery testing including full failover. Option D is correct because regular disaster recovery testing that includes a full failover is the only control that directly validates that the DR site's SAN zoning is correctly configured to accept replicated data. Without such testing, misconfigurations like incorrect zone sets or missing WWPN (World Wide Port Name) mappings in the SAN fabric remain undetected until an actual failover is attempted. This aligns with the CISA emphasis on testing recovery procedures to ensure business continuity.

Answer

Maintaining a configuration management database (CMDB)

Answer

Implementing a change management process for SAN configurations

Answer

Using automated replication monitoring tools

Question 5

A company's backup policy requires that backup tapes be stored offsite for at least one year. During an audit, the auditor finds that the offsite storage facility is not access-controlled and backup tapes are not encrypted. Which of the following is the auditor's BEST recommendation?

Accepted Answer

Encrypt all backup tapes before sending them offsite. The core issue is that backup tapes contain sensitive data and are stored in an uncontrolled environment. Encrypting the tapes before transport ensures that even if the physical security of the offsite facility is compromised, the data remains confidential. This directly addresses the risk of unauthorized access to the data, which is the primary concern, and is a cost-effective, immediate control that does not disrupt operations.

Answer

Negotiate a new contract with a different offsite storage provider

Answer

Move the tapes back to the primary site until the offsite facility is secured

Answer

Implement a check-in/check-out log for the offsite facility

Question 6

An organization is implementing a business continuity plan (BCP). Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA)?

Accepted Answer

To identify critical business processes and their recovery time objectives (RTOs). The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the impact of their disruption, which directly drives the recovery time objectives (RTOs) and recovery point objectives (RPOs). These RTOs and RPOs form the foundation for selecting appropriate recovery strategies and technologies, such as synchronous replication for near-zero RPO or warm standby sites for specific RTO windows. Without a BIA, the BCP would lack the business-driven metrics needed to prioritize recovery efforts and allocate resources effectively.

Answer

To document the step-by-step recovery procedures for each system

Answer

To identify potential threats and vulnerabilities to the organization

Answer

To inventory all IT assets and their configurations

Question 7

Which TWO of the following are essential components of an effective incident response plan? (Select exactly 2.)

Accepted Answer

Clearly defined roles and responsibilities. Clearly defined roles and responsibilities (C) are essential because they ensure that during a security incident, every team member knows their specific tasks, such as who leads the investigation, who communicates with stakeholders, and who executes containment actions. Without this clarity, response efforts become chaotic, leading to delays and missed containment windows, which directly impacts the organization's ability to minimize damage and recover quickly.

Answer

Root cause analysis procedures

Answer

Detailed vulnerability scanning schedules

Answer

List of all hardware vendors and support contacts

Question 8

Which THREE of the following are key metrics to include in a disaster recovery test report? (Select exactly 3.)

Accepted Answer

Amount of data lost (actual vs. RPO). Option A is correct because the amount of data lost (actual vs. RPO) directly measures whether the recovery process met the Recovery Point Objective. This metric validates the effectiveness of backup frequency and replication lag, which is critical for determining if the DR plan preserved data integrity within acceptable loss limits.

Answer

Cost per incident

Answer

Number of personnel involved

Question 9

An administrator sees the above error after a failed backup job. What is the MOST likely cause?

Accepted Answer

The network share \BACKUPSRV\DBBackups\DB01\ is offline or unreachable. The error message indicates that the backup destination path \BACKUPSRV\DBBackups\DB01\ is inaccessible. This is most commonly caused by the network share being offline, unreachable due to network issues, or the target server being down. Without connectivity to the UNC path, the backup job cannot proceed, even if permissions and disk space are adequate.

Answer

The backup service account does not have write permissions to the destination

Answer

The SQL Server backup client is not installed

Answer

The backup destination disk is full

Question 10

An organization has configured HSRP as shown. During a failover test, the primary router (G0/1) is shut down, but the DR site router does not become active. What is the MOST likely reason?

Accepted Answer

The HSRP group numbers on the two interfaces do not match. HSRP requires that both routers participating in the same virtual IP address use the same group number to form a single HSRP group. If the group numbers on the two interfaces do not match, each router will form its own separate HSRP group, and neither will recognize the other as a peer. Consequently, when the primary router fails, the DR router does not assume the active role because it is not part of the same HSRP group.

Answer

The default route on the primary router points to the wrong next-hop

Answer

The preempt command is missing on the DR router

Answer

The OSPF routing protocol is not redistributing the default route

Question 11

A multinational corporation operates an e-commerce platform hosted in a private cloud environment. The platform consists of web servers, application servers, and a database cluster. The database cluster uses synchronous replication across two data centers (Primary and DR) located 500 km apart. The recovery time objective (RTO) for the platform is 2 hours, and the recovery point objective (RPO) is 15 minutes. During a recent disaster simulation, the primary data center lost power completely. The IT team initiated failover to the DR site. However, the failover process took 3 hours due to a misconfiguration in the DNS failover scripts, and the database was found to be inconsistent because the replication link was broken 30 minutes before the power loss. The team had to restore from a backup that was 4 hours old. After the incident, management requests a review of the disaster recovery plan. Which of the following is the BEST course of action to address the issues identified?

Accepted Answer

Conduct a full-scale disaster recovery test including DNS failover and database consistency checks. The correct answer is B because the incident revealed failures in DNS failover scripts (causing RTO breach) and database consistency checks (causing RPO breach). A full-scale test that includes DNS failover and database consistency validation is the only option that directly addresses both root causes, ensuring the DR plan meets the stated RTO of 2 hours and RPO of 15 minutes. Without such a test, the organization cannot verify that the failover process and data integrity mechanisms work as intended under realistic conditions.

Answer

Increase the synchronous replication distance limit to ensure link stability over 500 km

Answer

Switch to asynchronous replication to avoid data loss during link failures

Answer

Implement automated DNS failover with health checks and reduce TTL values to 60 seconds

Question 12

An organization is implementing a backup strategy for its critical database. The database is updated continuously during business hours, and the recovery point objective (RPO) is 15 minutes. Which backup method should be used to meet the RPO while minimizing backup storage and performance impact?

Accepted Answer

Perform incremental backups with transaction log backups every 15 minutes. Incremental backups with transaction log backups every 15 minutes meets the 15-minute RPO by capturing all changes since the last full or incremental backup, while transaction log backups record every individual database transaction. This method minimizes storage by only backing up changes and reduces performance impact compared to continuous replication, as log backups are lightweight and can be scheduled without constant I/O overhead.

Answer

Perform full backups every 24 hours

Answer

Implement synchronous replication to a standby server

Answer

Perform differential backups every 6 hours

Question 13

Based on the backup logs, the backup administrator notices that the incremental backup job failed due to insufficient storage. Which TWO actions should the administrator take to resolve the immediate issue and prevent recurrence?

Accepted Answer

Free up space on the backup storage device by removing old backup sets manually. Option A is correct because freeing up space on the backup storage device by removing old backup sets immediately resolves the insufficient storage issue that caused the incremental backup job to fail. This is a direct, short-term fix that reclaims capacity without altering backup schedules or configurations.

Answer

Check network bandwidth between the backup server and storage device

Answer

Increase the frequency of incremental backups to reduce data volume per job

Answer

Investigate and resolve the file-in-use warnings from the full backup job

Question 14

An online retail company runs its e-commerce platform on a virtualized infrastructure with 50 virtual servers. The platform experiences intermittent slowdowns during peak hours, and recent monitoring reports show that disk I/O latency on the storage area network (SAN) frequently exceeds 50 ms during these periods. The SAN has two fabric switches and a single storage array with 12 TB of usable capacity, currently at 80% utilization. The company’s disaster recovery plan requires recovery point objective (RPO) of 1 hour and recovery time objective (RTO) of 4 hours for the e-commerce platform. During a recent test failover to the disaster recovery site, the IT team discovered that the replication link between primary and DR sites is saturated, causing replication lag of up to 3 hours. The team also noted that the DR site storage has only 6 TB of usable capacity, now at 60% utilization. The IT manager is concerned about meeting the RPO and RTO. Which course of action should the IT team take first?

Accepted Answer

Upgrade the replication link between primary and DR sites to a higher bandwidth connection. The immediate issue preventing the organization from meeting its RPO of 1 hour is the saturated replication link, which causes replication lag of up to 3 hours. Upgrading the link to a higher bandwidth connection directly addresses the bottleneck, reducing replication time and enabling the RPO to be met. Other options, while potentially beneficial, do not resolve the primary cause of the RPO failure.

Answer

Upgrade the SAN fabric switches to support higher throughput and reduce disk I/O latency

Answer

Add additional storage capacity to the DR site to reduce storage utilization

Answer

Implement more frequent incremental backups and reduce retention period to free up storage

Question 15

Arrange the steps to implement a patch management process in the correct order.