hardMultiple ChoiceObjective-mapped

CISA Practice Question: Refer to the exhibit

Exhibit

Backup Policy "CriticalData" {
  Schedule: Daily at 02:00
  Retention: 30 days
  Encryption: AES-256
  Offsite: Enabled
}

Compliance requirement: Retain financial data for 7 years.

Refer to the exhibit. Which of the following is the most significant risk associated with the backup policy for critical data?

⚠ Common exam trap

The trap here is that candidates focus on operational risks like backup frequency or encryption, but the most significant risk is regulatory compliance failure due to insufficient retention, which can result in severe penalties and loss of business license.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Retention period is insufficient to meet regulatory requirements

The backup policy shows a retention period of only 30 days, which is insufficient to meet common regulatory requirements such as GDPR, HIPAA, or SOX that often mandate retention of critical data for months or years. Without adequate retention, the organization risks non-compliance, legal penalties, and inability to produce historical records during audits or litigation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Offsite backup storage is not configured
Why it's wrong here
Offsite backup is enabled, so this is not a risk.
✓
Retention period is insufficient to meet regulatory requirements
Why this is correct
The policy retains backups for 30 days, but compliance requires 7 years. This is a critical gap.
✗
Backup frequency is too low to meet recovery point objectives
Why it's wrong here
Daily backups are typically sufficient for most RPOs; the main risk is retention, not frequency.
✗
Encryption is not enabled for backup data
Why it's wrong here
Encryption is enabled (AES-256), so this is not a risk.

Go deeper

CISA Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question