CISA Information Systems Operations and Business Resilience Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. An IT operator receives this error message from an automated backup job. What is the MOST likely cause of this failure?

Accepted Answer

The LUN presenting the virtual disk is not zoned or masked to the backup server. Option D is correct because the error indicates that the backup server cannot access the virtual disk, which is typically a LUN masking or zoning issue. Option A is plausible but the message specifically points to storage access; Option B is not indicated; Option C is possible but less direct.

Answer

The FinanceDB database is corrupted

Answer

The network link between servers is down

Answer

The backup server's disk is full

Question 2

Refer to the exhibit. An auditor reviews the log shipping configuration for a critical database. Based on the information provided, what is the MOST significant finding?

Accepted Answer

The current latency of 18 minutes exceeds the 15-minute log shipping interval. Option B is correct because the latency (18 minutes) exceeds the log shipping interval (15 minutes), indicating that the secondary server is falling behind. Option A is not a finding; Option C is not indicated; Option D is about alerting but latency is the core issue.

Answer

The alert threshold of 30 minutes is too high

Answer

The secondary server is not being used for reporting

Answer

The last backup was created at 06:00, but it is now later in the day

Question 3

Refer to the exhibit. An auditor reviews the security log of a sensitive server. Which of the following is the MOST suspicious event?

Accepted Answer

The remote interactive logon from IP 192.168.10.50 using NTLM. Option B is correct because a logon type 10 (Remote Interactive) from an unknown IP (192.168.10.50) using NTLM could indicate an unauthorized remote desktop session, especially if the employee is not on shift or the IP is unfamiliar. Option A is a normal network logon; Option C is not an event; Option D is not logged here.

Answer

The use of Negotiate authentication package

Answer

The logoff event at 23:45:12

Answer

The logon from workstation WS-FINANCE at 10.0.0.15

Question 4

An organization's backup strategy involves weekly full backups and daily incremental backups. After a system failure, the restoration takes longer than expected. What is the most likely cause?

Accepted Answer

Restoration process not tested. Option D is correct because without periodic testing, the recovery time may be underestimated. Option A is plausible but not the most likely cause given the time issue; B and C are incorrect because they are not directly related to the restoration time.

Answer

Incremental backups not stored offsite

Answer

Full backup frequency too low

Answer

Tape rotation failure

Question 5

An IT manager notices that the CPU utilization of a critical server consistently exceeds 90% during peak hours. Which is the BEST course of action?

Accepted Answer

Implement load balancing. Option A is correct because implementing load balancing distributes the workload across multiple servers, addressing the performance issue. Options B, C, and D are not the best; B is hasty, C helps but is not best, D does not fix the problem.

Answer

Immediately add more CPUs

Answer

Increase monitoring frequency

Answer

Schedule batch jobs during off-peak

Question 6

During an audit, the IS auditor finds that the business continuity plan (BCP) was last updated two years ago and does not include new cloud-based applications. The organization has not conducted a BCP test in 18 months. What should the auditor recommend FIRST?

Accepted Answer

Perform a risk assessment to prioritize changes. Option B is correct because a risk assessment is needed to prioritize which updates are critical. Option A is premature without understanding current risks; C is part of the update process but should follow risk assessment; D is later in the process.

Answer

Obtain management approval for BCP updates

Answer

Immediately schedule a full-scale test

Answer

Update the BCP to include cloud applications

Question 7

A company's backup policy requires that backup media be stored offsite. Which of the following is the PRIMARY reason for this requirement?

Accepted Answer

To ensure data is available in case of a site disaster. Option C is correct because offsite storage ensures data availability in case of a site disaster. Options A, B, and D are secondary or incorrect.

Answer

To reduce backup storage costs

Answer

To comply with regulatory requirements

Answer

To protect against theft

Question 8

An organization uses a hot site for disaster recovery. During a recent test, the hot site did not have the latest version of the application software. What is the MOST likely cause?

Accepted Answer

Inadequate change management procedures. Option D is correct because inadequate change management procedures fail to ensure that updates are replicated to the hot site. Options A, B, and C are less likely.

Answer

Failure to synchronize data

Answer

Lack of backup media

Answer

Insufficient bandwidth

Question 9

An IS auditor is reviewing the incident management process. The organization has a policy that all security incidents must be reported within one hour. However, the average reporting time is four hours. Which is the BEST corrective action?

Accepted Answer

Provide additional training to staff. Option A is correct because additional training addresses the human factors causing delays. Option B lowers the standard; C is punitive; D might help but is not the best first step.

Answer

Reduce the reporting time requirement

Answer

Increase penalties for non-compliance

Answer

Implement automated incident detection

Question 10

Which of the following is the PRIMARY objective of an operational audit?

Accepted Answer

To assess the efficiency and effectiveness of operations. Option A is correct because operational audit focuses on efficiency and effectiveness. Options B, C, and D are objectives of other types of audits.

Answer

To identify security vulnerabilities

Answer

To evaluate financial reporting

Answer

To verify compliance with laws

Question 11

A database administrator accidentally deleted a critical table. The last full backup was taken 24 hours ago, and transaction logs are archived every 15 minutes. Which recovery method will minimize data loss?

Accepted Answer

Restore from full backup and apply transaction logs up to the time of deletion. Option C is correct because restoring the full backup and applying transaction logs up to the deletion point recovers all data except the very last transactions. Option A is incomplete; B loses 24 hours; D is not applicable.

Answer

Use a standby database

Answer

Point-in-time recovery using transaction logs

Answer

Restore from full backup only

Question 12

An organization's business continuity plan includes a reciprocal agreement with another company. What is the PRIMARY risk of this arrangement?

Accepted Answer

Both companies may be affected by the same disaster. Option D is correct because both companies may be affected by the same regional disaster. Options A, B, and C are valid concerns but secondary.

Answer

The other company may be a competitor

Answer

The agreement may not be legally enforceable

Answer

The other company may not have adequate security

Question 13

Which is the MOST likely cause?

Accepted Answer

Backup media is not connected. Option B is correct because 'The device is not ready' indicates the backup media is not available. Option A would give a different error; C typically shows license; D shows network.

Answer

Network connectivity lost

Answer

Backup software license expired

Answer

Backup media is full

Question 14

Given this configuration, which is the PRIMARY concern?

Accepted Answer

Bandwidth may be insufficient to meet RPO. Option A is correct because the data change rate of 50 GB per hour (~112 Mbps sustained) exceeds the 100 Mbps bandwidth, causing replication lag that may exceed the RPO. Option B is less direct; C is a concern but not primary; D is the same as A.

Answer

Data change rate exceeds bandwidth

Answer

RTO may not be achievable

Answer

Synchronous replication may impact application performance

Question 15

Which control failure is MOST significant?

Accepted Answer

Insufficient incident notification procedures. Option D is correct because the delay in notifying the incident response team (from 14:25 to 16:00) is the most significant failure, as it allowed unauthorized access to continue. Option A is not a failure (alert timely); B is a factor but not the primary; C is secondary.

Answer

Lack of timely incident response

Answer

Delayed alerting

Answer

Inadequate monitoring

CISA Information Systems Operations and Business Resilience Practice Test 3 — 15 Questions

Exhibit

CISA Information Systems Operations and Business Resilience Practice Test 3 — 15 Questions

Exhibit