CISA Practice Question: Information Systems Operations and Business Resilience
An IS auditor is reviewing the business impact analysis (BIA) for a financial services company. Which THREE metrics are typically defined in a BIA?
⚠ Common exam trap
A common mix-up: candidates confuse operational metrics like MTBF and MTTR (which are used in IT service management and availability calculations) with the business-focused recovery metrics (RTO, RPO, MTD) that are defined in a BIA, leading them to select options A or B instead of the correct trio.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recovery point objective (RPO).
The Recovery Point Objective (RPO) is a key metric defined in a Business Impact Analysis (BIA) because it specifies the maximum acceptable amount of data loss measured in time, guiding the frequency of backups and replication. In a financial services company, RPO directly determines how much transactional data could be lost during a disruption, which is critical for regulatory compliance and data integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mean time to repair (MTTR).
Why it's wrong here
Availability metric, not part of BIA.
- ✗
Mean time between failures (MTBF).
Why it's wrong here
Availability metric, not part of BIA.
- ✓
Recovery point objective (RPO).
Why this is correct
The acceptable amount of data loss measured in time.
- ✓
Maximum tolerable downtime (MTD).
Why this is correct
The maximum amount of time a process can be down without causing irreparable harm.
- ✓
Recovery time objective (RTO).
Why this is correct
The target time to recover a process after a disruption.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.