CISA Information Systems Operations and Business Resilience Practice Test 2 — 15 Questions

Question 1

Order the steps for conducting a business impact analysis (BIA) in the correct sequence.

Question 2

Match each disaster recovery site type to its description.

Question 3

Match each testing technique to its description.

Question 4

An organization's online transaction processing system experienced a sudden performance degradation. The database administrator checked system resources and found excessive I/O wait time on the storage subsystem. Which of the following is the MOST likely root cause?

Accepted Answer

Inadequate disk spindles or a storage area network (SAN) bottleneck. Option C is correct because excessive I/O wait time typically indicates that the storage system cannot keep up with the demand, often due to insufficient disk spindles or a storage bottleneck. Option A is wrong because insufficient memory usually causes high CPU usage or swapping, not directly I/O wait. Option B is wrong because network latency affects network I/O, not disk I/O. Option D is wrong because application code bugs might cause logical errors but not necessarily storage I/O issues.

Answer

An inefficient SQL query causing table scans

Answer

Insufficient memory allocated to the database server

Answer

Network latency between the application and database servers

Question 5

A multinational corporation has implemented a hot site disaster recovery solution for its critical financial applications. Which of the following is the MOST important consideration to ensure the effectiveness of the hot site?

Accepted Answer

Regular, documented testing of the failover process is performed. Option D is correct because without regular testing, the hot site may not function as expected. Options A, B, and C are important but secondary: A is part of planning, B is operational, C is compliance but not the most critical for effectiveness.

Answer

Data replication latency is less than 15 minutes

Answer

The hot site is located in a different seismic zone

Answer

The hot site complies with regional data privacy regulations

Question 6

During an IT audit, the auditor finds that a system administrator has local administrator rights on multiple production servers and uses a shared service account for routine maintenance. What is the PRIMARY risk associated with this practice?

Accepted Answer

Audit trails cannot attribute actions to a specific individual. Option B is correct because a shared account obscures individual accountability, making it impossible to determine who performed specific actions. Option A is a general risk but less specific; Option C is not the primary risk; Option D is the opposite.

Answer

Password changes become more difficult to manage

Answer

The administrator may accidentally delete critical files

Answer

The shared account may be used by unauthorized personnel

Question 7

A company's IT service desk receives multiple reports of users being unable to access a cloud-based CRM system. The network team confirms that internet connectivity is working. Which of the following should be the FIRST step in troubleshooting the issue?

Accepted Answer

Check the vendor's service status page for any reported outages. Option A is correct because checking the status of the CRM service provider helps determine if it is a known outage. Option B is premature; Option C is device-specific; Option D is a later step.

Answer

Ask a user to try accessing from a different device

Answer

Restart the company's firewall and proxy servers

Answer

Review recent change requests for the CRM system

Question 8

An organization is evaluating its business continuity plan (BCP) for a critical application with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. The current backup strategy involves daily full backups and hourly transaction log backups. Which of the following is the MOST significant risk?

Accepted Answer

The backup media is stored in the same building as the primary system. Option D is correct because if the backups are stored at the same site, a disaster destroying the primary site would also destroy the backups, making recovery impossible. Options A, B, and C are less critical: A is a procedural issue, B is a minor gap, C is about recovery method but not as fundamental as off-site storage.

Answer

The recovery process requires manual intervention to apply logs

Answer

The backups are not tested regularly

Answer

The hourly logs cover only the last 24 hours

Question 9

Which of the following is the BEST indicator that an organization's incident management process is effective?

Accepted Answer

The percentage of recurring incidents is decreasing over time. Option C is correct because a decreasing number of recurring incidents indicates that root causes are being identified and resolved. Option A is about recovery time, not effectiveness; Option B is about volume, which could increase; Option D is reactive, not proactive effectiveness.

Answer

The average time to resolve incidents is under 1 hour

Answer

The number of incidents reported per month is increasing

Answer

All incidents are logged within 10 minutes of detection

Question 10

An IT auditor is reviewing the change management process for a financial application. The auditor finds that emergency changes are frequently implemented without post-implementation review. What is the MOST significant risk?

Accepted Answer

Security vulnerabilities may be introduced and remain undetected. Option A is correct because without review, emergency changes may introduce security vulnerabilities or instability that go unnoticed. Option B is a lesser risk; Option C is a consequence but not the most significant; Option D is operational risk but less critical than security.

Answer

The change may not be documented properly

Answer

The change may cause an outage during the next backup cycle

Answer

Users may not be notified of the change

Question 11

A large enterprise is implementing a backup strategy for a critical database that requires an RTO of 2 hours and an RPO of 15 minutes. The database is 2 TB in size. Which backup method would BEST meet these requirements while minimizing storage costs?

Accepted Answer

Weekly full backups with transactional log backups every 15 minutes. Option B is correct because incremental backups after a full backup minimize data loss and allow frequent backups with low storage overhead, meeting the 15-minute RPO. Option A does not meet RPO; Option C uses too much storage; Option D is for file-level, not databases.

Answer

Daily full backups

Answer

Continuous data protection (CDP) replicating to a remote site

Answer

A daily full backup and a differential backup every 4 hours

Question 12

Which of the following is the PRIMARY purpose of a business impact analysis (BIA) in business continuity planning?

Accepted Answer

To determine the criticality of business processes and their recovery requirements. Option C is correct because BIA identifies critical processes and determines the maximum allowable downtime (RTO) and data loss (RPO). Options A, B, and D are subsequent steps after the BIA.

Answer

To create a list of emergency contacts

Answer

To identify the resources required for recovery

Answer

To document the technical recovery procedures

Question 13

Which TWO of the following are key elements of an effective incident response plan? (Select exactly 2.)

Accepted Answer

A clear escalation path with contact information. Options B and D are correct. A clear escalation path ensures proper reporting and decision-making; predefined communication templates speed up notification. Option A is not essential; Option C is part of strategy but not directly incident response; Option E is after-action, not during.

Answer

A schedule for post-incident reviews

Answer

A detailed inventory of software licenses

Answer

A list of all hardware serial numbers

Question 14

Which TWO of the following are primary objectives of capacity management? (Select exactly 2.)

Accepted Answer

To ensure adequate IT resources to meet current and future business demands. Options B and E are correct. Capacity management aims to ensure that current and future business requirements are met cost-effectively. Option A is about financial management; Option C is performance monitoring but not the primary objective; Option D is procurement.

Answer

To monitor and report on system performance against SLAs

Answer

To minimize the total cost of ownership of IT resources

Answer

To procure hardware and software at the lowest possible cost

Question 15

Which THREE of the following are common challenges when implementing a bring-your-own-device (BYOD) policy that affect information systems operations? (Select exactly 3.)

Accepted Answer

Difficulty in enforcing data encryption and remote wipe capabilities. Options A, C, and D are correct. BYOD introduces security risks (A), support complexity (C), and data leakage (D). Option B is an advantage, not a challenge; Option E is less common as a challenge compared to the others.

Answer

Reduced hardware procurement costs for the organization

Answer

Increased employee productivity due to device familiarity