Question 2 of 509

Information Systems Operations and Business Resilience →hardMultiple ChoiceObjective-mapped

Quick Answer

The correct first step is to upgrade the replication link between primary and DR sites to a higher bandwidth connection, because the saturated link directly causes the 3-hour replication lag that violates the 1-hour RPO. In disaster recovery architecture, insufficient replication bandwidth creates a bottleneck where data changes cannot be transmitted quickly enough to meet the required recovery point objective, regardless of other infrastructure improvements. On the CISA exam, this scenario tests your ability to prioritize the root cause of an RPO failure—a common trap is to focus on storage capacity or I/O latency at the primary site, when the real issue is the WAN link’s throughput. Remember the memory tip: “Bandwidth before boxes”—always address the replication pipe’s capacity first when RPO is missed, as no amount of local tuning can fix a choked remote link.

CISA Practice Question: Information Systems Operations and Business Resilience

This CISA practice question tests your understanding of information systems operations and business resilience. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

An online retail company runs its e-commerce platform on a virtualized infrastructure with 50 virtual servers. The platform experiences intermittent slowdowns during peak hours, and recent monitoring reports show that disk I/O latency on the storage area network (SAN) frequently exceeds 50 ms during these periods. The SAN has two fabric switches and a single storage array with 12 TB of usable capacity, currently at 80% utilization. The company’s disaster recovery plan requires recovery point objective (RPO) of 1 hour and recovery time objective (RTO) of 4 hours for the e-commerce platform. During a recent test failover to the disaster recovery site, the IT team discovered that the replication link between primary and DR sites is saturated, causing replication lag of up to 3 hours. The team also noted that the DR site storage has only 6 TB of usable capacity, now at 60% utilization. The IT manager is concerned about meeting the RPO and RTO. Which course of action should the IT team take first?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Clue: "primary"
Why it matters: Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.

Question 1hardmultiple choice

Study the full virtualization explanation →

A
Upgrade the SAN fabric switches to support higher throughput and reduce disk I/O latency
Why wrong: Reducing disk latency improves performance but does not address the replication lag that is causing the RPO breach.
B
Add additional storage capacity to the DR site to reduce storage utilization
Why wrong: Adding DR storage capacity does not resolve the replication link saturation; it only addresses potential future capacity issues.
C
Implement more frequent incremental backups and reduce retention period to free up storage
Why wrong: More frequent backups increase replication traffic, worsening the saturation, and do not address the root cause of replication lag.
D
Upgrade the replication link between primary and DR sites to a higher bandwidth connection
This directly addresses the replication lag, reducing it to meet the 1-hour RPO, and is the most urgent action to ensure disaster recovery objectives.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Upgrade the replication link between primary and DR sites to a higher bandwidth connection

The immediate issue preventing the organization from meeting its RPO of 1 hour is the saturated replication link, which causes replication lag of up to 3 hours. Upgrading the link to a higher bandwidth connection directly addresses the bottleneck, reducing replication time and enabling the RPO to be met. Other options, while potentially beneficial, do not resolve the primary cause of the RPO failure.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Upgrade the SAN fabric switches to support higher throughput and reduce disk I/O latency
Why it's wrong here
Reducing disk latency improves performance but does not address the replication lag that is causing the RPO breach.
✗
Add additional storage capacity to the DR site to reduce storage utilization
Why it's wrong here
Adding DR storage capacity does not resolve the replication link saturation; it only addresses potential future capacity issues.
✗
Implement more frequent incremental backups and reduce retention period to free up storage
Why it's wrong here
More frequent backups increase replication traffic, worsening the saturation, and do not address the root cause of replication lag.
✓
Upgrade the replication link between primary and DR sites to a higher bandwidth connection
Why this is correct
This directly addresses the replication lag, reducing it to meet the 1-hour RPO, and is the most urgent action to ensure disaster recovery objectives.
Clue confirmation
The clue words "first", "primary" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates focus on the disk I/O latency or storage utilization issues, which are performance concerns, rather than recognizing that the saturated replication link is the direct cause of the RPO failure and must be addressed first.

Detailed technical explanation

How to think about this question

Replication link saturation occurs when the bandwidth is insufficient to handle the write I/O generated by the primary site within the RPO window. For a 1-hour RPO, the link must support the peak write throughput over that period. Upgrading to a higher bandwidth connection (e.g., from 1 Gbps to 10 Gbps) increases the available throughput, reducing replication lag. In practice, compression and deduplication on the replication stream can also help, but the first step is to address the physical bandwidth constraint.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A practitioner preparing for the CISA exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related CISA practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Governance and Management of IT practice questions

Practise CISA questions linked to Governance and Management of IT.

Information Systems Acquisition, Development and Implementation practice questions

Practise CISA questions linked to Information Systems Acquisition, Development and Implementation.

Information Systems Operations and Business Resilience practice questions

Practise CISA questions linked to Information Systems Operations and Business Resilience.

Protection of Information Assets practice questions

Practise CISA questions linked to Protection of Information Assets.

Information System Auditing Process practice questions

Practise CISA questions linked to Information System Auditing Process.

CISA fundamentals practice questions

Practise CISA questions linked to CISA fundamentals.

CISA scenario practice questions

Practise CISA questions linked to CISA scenario.

CISA troubleshooting practice questions

Practise CISA questions linked to CISA troubleshooting.

Practice this exam

Start a free CISA practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

CISA practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this CISA question test?

Information Systems Operations and Business Resilience — This question tests Information Systems Operations and Business Resilience — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Upgrade the replication link between primary and DR sites to a higher bandwidth connection — The immediate issue preventing the organization from meeting its RPO of 1 hour is the saturated replication link, which causes replication lag of up to 3 hours. Upgrading the link to a higher bandwidth connection directly addresses the bottleneck, reducing replication time and enabling the RPO to be met. Other options, while potentially beneficial, do not resolve the primary cause of the RPO failure.

What should I do if I get this CISA question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "first", "primary". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on CISA

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Given this configuration, which is the PRIMARY concern?

medium

A.Data change rate exceeds bandwidth
B.RTO may not be achievable
C.Synchronous replication may impact application performance
✓ D.Bandwidth may be insufficient to meet RPO

Why D: Option A is correct because the data change rate of 50 GB per hour (~112 Mbps sustained) exceeds the 100 Mbps bandwidth, causing replication lag that may exceed the RPO. Option B is less direct; C is a concern but not primary; D is the same as A.

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.