CISA Practice Question: Information Systems Operations and Business Resilience
An organization has defined an SLA that requires critical incidents to be resolved within 4 hours. A P1 incident is reported at 10:00 AM. At what time must the incident be resolved to meet the SLA?
⚠ Common exam trap
CISA often tests basic SLA calculations, and the trap is misreading the start time or adding the wrong number of hours, or confusing the deadline with an earlier resolution time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
2:00 PM
The SLA requires critical incidents to be resolved within 4 hours. A P1 incident reported at 10:00 AM must therefore be resolved by 2:00 PM, which is exactly 4 hours later. This is a straightforward time calculation based on the SLA definition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
2:00 PM
Why this is correct
Resolving by 2:00 PM satisfies the four-hour SLA window starting at 10:00 AM, giving the critical incident team the full mandated response period. Any later resolution breaches the defined service commitment, triggering escalation and SLA penalty provisions under the organisation's incident management process.
- ✗
4:00 PM
Why it's wrong here
A 4-hour SLA from 10:00 AM resolves at 2:00 PM, not 4:00 PM. The tempting error is treating the SLA window as six hours or adding the duration to a misread start time; 4:00 PM would only be right if the SLA specified six hours from the same 10:00 AM report.
- ✗
6:00 PM
Why it's wrong here
Eight hours from 10:00 AM exceeds the four-hour resolution window by four hours; the deadline is 2:00 PM. It is tempting because 6:00 PM matches a typical end-of-business-day target, but the SLA clock runs from the 10:00 AM report time, not from a working-day boundary.
- ✗
12:00 PM
Why it's wrong here
Two hours from 10:00 AM does not satisfy a four-hour resolution window; the deadline is 2:00 PM. It is tempting because halving the SLA interval feels like a safety margin, but the SLA measures elapsed time from report to resolution, so 12:00 PM resolves the incident two hours early, not on time.
Visual reference
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.