CISA Practice Question: Information Systems Operations and Business Resilience
An IS auditor is reviewing the backup strategy for a financial institution. The backup administrator states that full backups are taken every Sunday, and incremental backups are taken Monday through Saturday. On Thursday morning, a database server fails, and the administrator needs to restore the server to its state as of Wednesday night. Which backup sets must the administrator use to perform this restoration?
⚠ Common exam trap
The trap here is assuming that the most recent incremental backup contains all changes since the last full backup, when in fact it only contains changes since the last backup of any type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The most recent full backup and all incremental backups taken since that full backup.
In a full-plus-incremental backup strategy, a full backup captures all data, while each incremental backup captures only changes since the last backup of any type. To restore to a specific point, the administrator must restore the most recent full backup and then apply each subsequent incremental backup in the correct order. This ensures all changes are recovered. The other options incorrectly describe the restore process or assume a different backup scheme.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The most recent full backup, the differential backup, and the latest incremental backup.
Why it's wrong here
This is incorrect because the scenario describes a full-plus-incremental strategy, not a full-plus-differential strategy. There is no differential backup in this rotation. Introducing a differential backup that does not exist would cause confusion and is not part of the documented schedule. The administrator must follow the actual backup types taken: full on Sunday and incrementals on subsequent days.
- ✗
The most recent full backup and the single most recent incremental backup.
Why it's wrong here
This is incorrect because with an incremental backup scheme, each incremental contains only the data changed since the last backup of any type. The most recent incremental (Wednesday) contains only Wednesday's changes. To restore to Wednesday night, the administrator must also apply Monday's and Tuesday's incrementals after the Sunday full backup. Using only the latest incremental would lose all changes from Monday and Tuesday.
- ✓
The most recent full backup and all incremental backups taken since that full backup.
Why this is correct
This is correct because the backup rotation described is a full-plus-incremental scheme. To restore to Wednesday night, the administrator must first restore the most recent full backup (from Sunday) and then apply each incremental backup taken Monday, Tuesday, and Wednesday in sequence. Skipping any incremental backup would result in an incomplete restoration, losing data changes made on the skipped day.
- ✗
Only the most recent full backup, as it contains all data up to the point of the backup.
Why it's wrong here
This is incorrect because the most recent full backup was taken on Sunday and contains only the data as of that time. Any transactions or changes made on Monday, Tuesday, and Wednesday would be lost. To restore to Wednesday night, the administrator must apply the incremental backups taken after the full backup. Relying solely on the full backup would result in significant data loss.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.