CISA Practice Question: Information Systems Operations and Business Resilience
An IS auditor is reviewing the IT operations of a small organization that runs a critical application on a single physical server. The auditor finds that backups are performed daily to a local tape drive, but the tapes are stored in the same room as the server. Which of the following is the MOST significant risk?
⚠ Common exam trap
The trap here is focusing on backup frequency or hardware reliability when the scenario's key weakness is the absence of offsite storage, which creates a single point of failure for both systems and backups.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Loss of both the server and backups in the event of a site-wide disaster.
The most significant risk is that backups are stored in the same room as the server. A site-wide disaster such as a fire or flood could destroy both the production server and the backup tapes, making recovery impossible. Offsite storage is a basic requirement for backup media to ensure that a disaster at the primary site does not also destroy the recovery data. Other risks like tape degradation or backup frequency are less severe in this context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The tape drive may fail, rendering backups unusable.
Why it's wrong here
Hardware failure is always a risk, but it is mitigated by testing backups and maintaining spare hardware. The scenario does not suggest the tape drive is unreliable. The critical flaw is that the backups are stored in the same location as the server, so a site-wide disaster would destroy both. This is a more fundamental and severe risk than a single hardware failure.
- ✗
Daily backups may not capture transactions that occur after the backup window.
Why it's wrong here
The backup frequency may indeed leave a gap for transactions after the backup, but the scenario states backups are performed daily, which is a common practice. The most significant risk is not the frequency but the storage location. If the site is destroyed, the backups are lost regardless of frequency. The lack of offsite storage is a more severe and immediate risk.
- ✗
Backup tapes may degrade over time due to environmental conditions.
Why it's wrong here
While environmental conditions can affect tape integrity, the scenario does not indicate that the room has adverse conditions. The more critical risk is the co-location of backups with the server, which creates a single point of failure for both production and recovery data. Tape degradation is a secondary concern that is typically managed through periodic restoration testing and proper storage.
- ✓
Loss of both the server and backups in the event of a site-wide disaster.
Why this is correct
Storing backup tapes in the same room as the server means that a fire, flood, or other site-wide disaster could destroy both the production system and the backups. This eliminates the ability to recover, potentially causing extended downtime or permanent data loss. Offsite storage is a fundamental control to ensure backups survive a disaster that affects the primary site.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.