CISA Practice Question: Information Systems Operations and Business Resilience
An organization uses a hot site as its disaster recovery alternative. Which of the following is the MOST critical consideration when selecting a hot site?
⚠ Common exam trap
CISA often tests the distinction between the defining characteristic of a hot site (immediate, fully compatible readiness) and secondary logistical factors like cost or distance, tempting candidates to choose a business or geographic answer over the technical prerequisite.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compatibility of hardware and software with the production environment
A hot site is a fully equipped alternate processing facility that is ready to take over operations immediately, so its hardware, operating systems, and applications must match the production environment exactly; otherwise, backups cannot be restored and workloads cannot resume. Compatibility is therefore the most critical selection criterion, since incompatibility defeats the entire purpose of paying for a hot site. Distance, cost, and staffing are important secondary factors but do not determine whether recovery is technically feasible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Compatibility of hardware and software with the production environment
Why this is correct
A hot site must take over processing immediately, so identical hardware, operating systems and application versions are essential; any mismatch prevents failover. This satisfies the stem's critical consideration, since compatibility determines whether the site can actually run production workloads.
- ✗
Distance from the primary site
Why it's wrong here
Distance matters for site-dependent risks and for cold or warm sites requiring transport of media and personnel. A hot site is already equipped and synchronised, so proximity is not the selection driver. The critical consideration is that systems and data remain ready to assume processing.
- ✗
Cost of the hot site contract
Why it's wrong here
Cost is a commercial factor weighed against recovery objectives, not the criterion that determines whether a hot site can actually deliver recovery. Budgeting applies to every DR alternative. The decisive consideration is that the site is fully configured and data is replicated to it.
- ✗
Availability of staff at the hot site
Why it's wrong here
Staff availability applies to any recovery site and is addressed through DR call trees and staffing plans, not site selection. It is a genuine operational concern for invocation. The defining hot-site criterion is that hardware, software and data are already configured and current.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.