hardMultiple SelectObjective-mapped
CISA Practice Question: An IS auditor is assessing the backup and…
An IS auditor is assessing the backup and recovery procedures for a critical database. Which TWO of the following are the MOST important controls to ensure recoverability?
⚠ Common exam trap
Test-takers frequently confuse backup existence or frequency (e.g., weekly full backups) with recoverability, failing to recognize that only actual restore testing proves a backup is usable, and that offsite storage is critical for disaster recovery, not just for data protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restore tests are conducted quarterly.
Regular restore tests (e.g., quarterly) are the only way to validate that backup data can actually be recovered and that the recovery procedures work as intended, which directly ensures recoverability. Option E is correct because storing backups offsite protects against site-level disasters (fire, flood, physical theft) that could destroy both primary data and on-site backups, ensuring data can be recovered from a separate location.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Backup media is encrypted.
Why it's wrong here
Encryption protects confidentiality, not recoverability.
- ✗
Full backups are performed weekly.
Why it's wrong here
Frequency depends on RPO; weekly may be insufficient.
- ✓
Restore tests are conducted quarterly.
Why this is correct
Restore tests verify that backups can actually be recovered.
- ✗
Backup logs are reviewed daily.
Why it's wrong here
Log review is important but does not ensure recoverability.
- ✓
Backups are stored offsite.
Why this is correct
Offsite storage protects against site-level disasters.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.