CISA Practice Question: Information Systems Operations and Business Resilience
An IT auditor is reviewing the business continuity plan (BCP) testing schedule. The organization conducts a test where participants discuss their roles and responses to a scenario without any actual system activation. Which type of test is this?
⚠ Common exam trap
A common mix-up: candidates confuse discussion-based tests (tabletop, walkthrough) with execution-based tests (simulation, parallel, full interruption); candidates who see 'scenario' and jump to 'simulation' miss the phrase 'without any actual system activation.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tabletop exercise
A tabletop exercise is a discussion-based BCP test where participants verbally walk through their roles and responses to a hypothetical scenario without activating systems or relocating staff. It is the least disruptive and least expensive test type, used to validate plans, clarify roles, and identify gaps before conducting more resource-intensive tests. Because the question specifies 'discuss their roles and responses... without any actual system activation,' this maps directly to a tabletop exercise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Parallel test
Why it's wrong here
A parallel test runs recovery systems at an alternate site alongside production, so it involves actual system activation. It is tempting because it validates real recovery capability, making it correct when the organisation wants assurance that backup systems function without disrupting live operations.
- ✗
Walkthrough
Why it's wrong here
A walkthrough is a discussion-based review of documentation and procedures, not a scenario-driven role-play of responses. It is tempting because walkthroughs do validate understanding of the plan, but they would be correct only when the objective is confirming procedural accuracy, not rehearsing participant roles against a simulated incident.
- ✗
Simulation
Why it's wrong here
A simulation is a scenario-based exercise, but the described discussion of roles without system activation is a tabletop exercise. It is tempting because simulation and tabletop overlap in discussion format, making simulation correct when participants practise responses using simulated system outputs.
- ✓
Tabletop exercise
Why this is correct
A tabletop exercise gathers participants to walk through roles, decisions and communications against a hypothetical scenario, with no systems activated and no relocation. This discussion-based format contrasts with functional, simulation and full-interruption tests, which involve actual system or site activation.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.