CISA Practice Question: Information Systems Operations and Business Resilience
An organization's business continuity plan (BCP) includes alternate facilities that can be operational within 24 hours. The maximum tolerable downtime (MTD) for a critical process is 12 hours. What is the most significant gap?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The alternate facility cannot be activated within the required MTD.
The alternate facility recovery time (24 hours) exceeds the MTD (12 hours), meaning the process would fail its recovery requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The BCP does not include customer communication procedures.
Why it's wrong here
While customer communication procedures are a valid BCP component, the most significant gap is that the alternate facilities require 24 hours to become operational, yet the MTD for the critical process is only 12 hours. This option is tempting because communication plans are essential for stakeholder notification during a disaster, and in a scenario where recovery time objectives were already met, missing procedures would indeed be the primary gap.
- ✓
The alternate facility cannot be activated within the required MTD.
Why this is correct
The facility's 24-hour activation exceeds the 12-hour MTD.
- ✗
The BCP does not address data backup procedures.
Why it's wrong here
Data backup is important, but the gap is in the facility recovery time.
- ✗
The recovery time objective (RTO) for the process is not defined.
Why it's wrong here
RTO should be based on MTD; the gap is that the facility cannot meet the RTO.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.