easyMultiple Choice
CISA Practice Question: A company's backup policy requires that backup…
A company's backup policy requires that backup media be stored offsite. Which of the following is the PRIMARY reason for this requirement?
⚠ Common exam trap
Watch out — candidates often confuse compliance or cost as the primary driver, but the CISA exam emphasizes that business continuity and disaster recovery (BC/DR) requirements—specifically ensuring data survival after a site disaster—are the fundamental reason for offsite backup storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To ensure data is available in case of a site disaster
The primary reason for storing backup media offsite is to ensure data availability and recoverability in the event of a site-level disaster, such as a fire, flood, or physical destruction of the primary data center. This aligns with the core business continuity principle of geographic separation to avoid a single point of failure. Without offsite storage, a site disaster would destroy both primary and backup data, making recovery impossible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To ensure data is available in case of a site disaster
Why this is correct
Offsite storage ensures a copy of backup media survives destruction of the primary site, such as fire, flood or theft. This satisfies the policy's primary goal of restoring data after a site disaster, which onsite copies alone cannot guarantee.
- ✗
To reduce backup storage costs
Why it's wrong here
Offsite storage adds transport, vaulting and courier charges, so it raises rather than reduces cost. Cost reduction is the goal of deduplication, compression or tiering to cheaper media, and this option would fit a question asking how to lower backup storage expenditure, not why media must leave the site.
- ✗
To comply with regulatory requirements
Why it's wrong here
Regulatory compliance is only one possible driver and applies to specific industries or data types; the primary reason for offsite storage is to survive a site-wide disaster that destroys both primary data and onsite copies. It is tempting because many regulations do mandate offsite retention, making it the correct answer only when the scenario cites a specific regulatory obligation.
- ✗
To protect against theft
Why it's wrong here
Offsite storage primarily preserves recoverability when the primary site is destroyed, since a copy in the same building is lost with it. Theft protection is a secondary benefit of physical controls, and this option would be correct if the stem asked how to prevent media being stolen from the data centre.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.