CISA · topic practice

Information Systems Operations and Business Resilience practice questions

Q: How should I use these Information Systems Operations and Business Resilience practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Information Systems Operations and Business Resilience questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Information Systems Operations and Business Resilience domain.

Practise Certified Information Systems Auditor CISA Information Systems Operations and Business Resilience practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Information Systems Operations and Business Resilience

Practice 10 questions Browse domain →

What the exam tests

What to know about Information Systems Operations and Business Resilience

Information Systems Operations and Business Resilience questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Information Systems Operations and Business Resilience exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Information Systems Operations and Business Resilience questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Information Systems Operations and Business Resilience explanation →

An organization experiences a critical system failure during non-business hours. The IT team discovers that the last full backup was 48 hours ago, and the incremental backups for the past 24 hours are corrupted. The recovery time objective (RTO) for this system is 4 hours, and the recovery point objective (RPO) is 1 hour. Which of the following is the MOST immediate concern?

Trap 1: The backup schedule should be changed to daily full backups

This is a longer-term corrective action, not the most immediate concern.

Trap 2: The root cause of the failure must be determined before recovery

Root cause analysis should not delay recovery; the priority is to restore operations.

Trap 3: The recovery time objective (RTO) of 4 hours will be exceeded

RTO may be exceeded, but the immediate concern is the data loss that already occurred.

Study all Information Systems Operations and Business Resilience common traps →

A
The backup schedule should be changed to daily full backups
Why wrong: This is a longer-term corrective action, not the most immediate concern.
B
The data loss may exceed the recovery point objective (RPO)
With corrupted incremental backups, data loss will be at least 48 hours, far exceeding the 1-hour RPO.
C
The root cause of the failure must be determined before recovery
Why wrong: Root cause analysis should not delay recovery; the priority is to restore operations.
D
The recovery time objective (RTO) of 4 hours will be exceeded
Why wrong: RTO may be exceeded, but the immediate concern is the data loss that already occurred.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Information Systems Operations and Business Resilience explanation →

An IT auditor is reviewing the business continuity plan (BCP) for a financial services firm. The plan includes a hot site that is shared with another organization under a reciprocal agreement. Which of the following findings should be of MOST concern to the auditor?

Trap 1: The hot site uses a different internet service provider than the…

This is a best practice for diversity, not a concern.

Trap 2: The hot site has not been tested in the past 12 months

While testing is important, the reciprocal agreement's lack of exclusivity is a more fundamental risk.

Trap 3: The hot site is located in the same seismic zone as the primary site

Geographic risk is relevant but not as urgent as the capacity sharing issue.

Study all Information Systems Operations and Business Resilience common traps →

A
The hot site uses a different internet service provider than the primary site
Why wrong: This is a best practice for diversity, not a concern.
B
The hot site has not been tested in the past 12 months
Why wrong: While testing is important, the reciprocal agreement's lack of exclusivity is a more fundamental risk.
C
The reciprocal agreement does not guarantee exclusive use of the hot site during a disaster
If both organizations activate simultaneously, the hot site may not have sufficient capacity for both.
D
The hot site is located in the same seismic zone as the primary site
Why wrong: Geographic risk is relevant but not as urgent as the capacity sharing issue.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Information Systems Operations and Business Resilience explanation →

A company is designing its backup strategy for a critical database that must be available 24/7. The database experiences high transaction volumes. Which backup method minimizes data loss while allowing continuous operations?

Trap 1: Offline full backup performed weekly

Offline backup requires taking the database offline, causing downtime.

Trap 2: Differential backup performed daily

Differential backup alone does not provide continuous protection and still requires a full backup.

Trap 3: Full backup performed during low-usage periods

Even during low usage, a full backup can impact performance and may require downtime.

Study all Information Systems Operations and Business Resilience common traps →

A
Offline full backup performed weekly
Why wrong: Offline backup requires taking the database offline, causing downtime.
B
Differential backup performed daily
Why wrong: Differential backup alone does not provide continuous protection and still requires a full backup.
C
Online backup with transaction log backups
Online backups run while the database is active, and transaction logs allow point-in-time recovery with minimal data loss.
D
Full backup performed during low-usage periods
Why wrong: Even during low usage, a full backup can impact performance and may require downtime.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Information Systems Operations and Business Resilience explanation →

During an incident response exercise, the IT team discovers that the failover to the disaster recovery (DR) site failed because the DR site's storage area network (SAN) was not zoned correctly for the replicated data. Which of the following controls would BEST prevent this issue?

Trap 1: Maintaining a configuration management database (CMDB)

CMDB documents configurations but does not prevent misconfiguration.

Trap 2: Implementing a change management process for SAN configurations

Change management helps but does not guarantee correct zoning; testing is more direct.

Trap 3: Using automated replication monitoring tools

Monitoring tools alert on replication failures but do not prevent zoning issues.

Study all Information Systems Operations and Business Resilience common traps →

A
Maintaining a configuration management database (CMDB)
Why wrong: CMDB documents configurations but does not prevent misconfiguration.
B
Implementing a change management process for SAN configurations
Why wrong: Change management helps but does not guarantee correct zoning; testing is more direct.
C
Using automated replication monitoring tools
Why wrong: Monitoring tools alert on replication failures but do not prevent zoning issues.
D
Conducting regular disaster recovery testing including full failover
Regular testing validates that all components work together, including SAN zoning.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Information Systems Operations and Business Resilience explanation →

A company's backup policy requires that backup tapes be stored offsite for at least one year. During an audit, the auditor finds that the offsite storage facility is not access-controlled and backup tapes are not encrypted. Which of the following is the auditor's BEST recommendation?

Trap 1: Negotiate a new contract with a different offsite storage provider

This is a longer-term solution; immediate risk should be addressed first.

Trap 2: Move the tapes back to the primary site until the offsite facility…

This violates the offsite storage policy and increases risk from a site disaster.

Trap 3: Implement a check-in/check-out log for the offsite facility

This is a detective control but does not protect the data if tapes are stolen.

Study all Information Systems Operations and Business Resilience common traps →

A
Negotiate a new contract with a different offsite storage provider
Why wrong: This is a longer-term solution; immediate risk should be addressed first.
B
Move the tapes back to the primary site until the offsite facility is secured
Why wrong: This violates the offsite storage policy and increases risk from a site disaster.
C
Implement a check-in/check-out log for the offsite facility
Why wrong: This is a detective control but does not protect the data if tapes are stolen.
D
Encrypt all backup tapes before sending them offsite
Encryption mitigates the risk of unauthorized access to data on the tapes.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Information Systems Operations and Business Resilience explanation →

An organization is implementing a business continuity plan (BCP). Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA)?

Trap 1: To document the step-by-step recovery procedures for each system

That is part of the BCP development, not BIA.

Trap 2: To identify potential threats and vulnerabilities to the…

That is the purpose of a risk assessment, not BIA.

Trap 3: To inventory all IT assets and their configurations

BIA focuses on business processes, not IT asset inventory.

Study all Information Systems Operations and Business Resilience common traps →

A
To document the step-by-step recovery procedures for each system
Why wrong: That is part of the BCP development, not BIA.
B
To identify potential threats and vulnerabilities to the organization
Why wrong: That is the purpose of a risk assessment, not BIA.
C
To inventory all IT assets and their configurations
Why wrong: BIA focuses on business processes, not IT asset inventory.
D
To identify critical business processes and their recovery time objectives (RTOs)
BIA helps prioritize processes and define RTOs and RPOs.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Information Systems Operations and Business Resilience explanation →

Which TWO of the following are essential components of an effective incident response plan? (Select exactly 2.)

Trap 1: Root cause analysis procedures

Root cause analysis is done after the incident, not during response.

Trap 2: Detailed vulnerability scanning schedules

Vulnerability scanning is a preventive measure, not part of incident response.

Trap 3: List of all hardware vendors and support contacts

While useful, it is not an essential component of the plan itself.

Study all Information Systems Operations and Business Resilience common traps →

A
Root cause analysis procedures
Why wrong: Root cause analysis is done after the incident, not during response.
B
Detailed vulnerability scanning schedules
Why wrong: Vulnerability scanning is a preventive measure, not part of incident response.
C
Clearly defined roles and responsibilities
Essential for coordinated response.
D
List of all hardware vendors and support contacts
Why wrong: While useful, it is not an essential component of the plan itself.
E
Communication and escalation procedures
Critical for timely notification and decision-making.

Full breakdown with real-world context →

Question 8hardmulti select

Read the full Information Systems Operations and Business Resilience explanation →

Which THREE of the following are key metrics to include in a disaster recovery test report? (Select exactly 3.)

Trap 1: Cost per incident

Cost is not a test metric; it is a business consideration.

Trap 2: Number of personnel involved

Not a performance metric; staffing is part of planning.

Study all Information Systems Operations and Business Resilience common traps →

A
Amount of data lost (actual vs. RPO)
Measures data loss.
B
Cost per incident
Why wrong: Cost is not a test metric; it is a business consideration.
C
Time taken to recover each critical system
Measures against RTO.
D
Number of personnel involved
Why wrong: Not a performance metric; staffing is part of planning.
E
Percentage of successful restores
Indicates reliability of backups.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Information Systems Operations and Business Resilience explanation →

An administrator sees the above error after a failed backup job. What is the MOST likely cause?

Exhibit

Refer to the exhibit.

Server: DB01
Backup Job: Full_Backup_DB01
Status: Failed
Error: 0x80070003 - The system cannot find the path specified.
Backup Destination: \\BACKUPSRV\DBBackups\DB01\

Last Successful Backup: 2023-03-15 03:00 AM
Scheduled Backup Time: Daily 02:00 AM

Trap 1: The backup service account does not have write permissions to the…

This would typically result in an access denied error, not 'path not found'.

Trap 2: The SQL Server backup client is not installed

That would cause a different error, such as 'backup client not found'.

Trap 3: The backup destination disk is full

A full disk would result in an 'insufficient space' error.

Study all Information Systems Operations and Business Resilience common traps →

A
The backup service account does not have write permissions to the destination
Why wrong: This would typically result in an access denied error, not 'path not found'.
B
The network share \\BACKUPSRV\DBBackups\DB01\ is offline or unreachable
The error indicates the path specified does not exist or is unavailable.
C
The SQL Server backup client is not installed
Why wrong: That would cause a different error, such as 'backup client not found'.
D
The backup destination disk is full
Why wrong: A full disk would result in an 'insufficient space' error.

Full breakdown with real-world context →

Question 10hardmultiple choice

Review the full routing breakdown →

An organization has configured HSRP as shown. During a failover test, the primary router (G0/1) is shut down, but the DR site router does not become active. What is the MOST likely reason?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/1
 description Link to Primary Site
 ip address 10.1.1.1 255.255.255.252
 standby 1 ip 10.1.1.2
 standby 1 priority 110
 standby 1 preempt
!
interface GigabitEthernet0/2
 description Link to DR Site
 ip address 10.2.2.1 255.255.255.252
 standby 2 ip 10.2.2.2
 standby 2 priority 100
!
router ospf 1
 network 10.0.0.0 0.255.255.255 area 0
!
ip route 0.0.0.0 0.0.0.0 10.1.1.2

Trap 1: The default route on the primary router points to the wrong next-hop

The default route is not the cause of the HSRP failover failure.

Trap 2: The preempt command is missing on the DR router

Preempt causes the higher priority router to take over; the DR router has lower priority and would not preempt anyway.

Trap 3: The OSPF routing protocol is not redistributing the default route

OSPF is not related to HSRP failover; the issue is with HSRP configuration.

Study all Information Systems Operations and Business Resilience common traps →

A
The default route on the primary router points to the wrong next-hop
Why wrong: The default route is not the cause of the HSRP failover failure.
B
The preempt command is missing on the DR router
Why wrong: Preempt causes the higher priority router to take over; the DR router has lower priority and would not preempt anyway.
C
The OSPF routing protocol is not redistributing the default route
Why wrong: OSPF is not related to HSRP failover; the issue is with HSRP configuration.
D
The HSRP group numbers on the two interfaces do not match
HSRP group 1 is on G0/1 and group 2 on G0/2; they should be the same group to provide redundancy for the same virtual IP.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full DNS explanation →

A multinational corporation operates an e-commerce platform hosted in a private cloud environment. The platform consists of web servers, application servers, and a database cluster. The database cluster uses synchronous replication across two data centers (Primary and DR) located 500 km apart. The recovery time objective (RTO) for the platform is 2 hours, and the recovery point objective (RPO) is 15 minutes. During a recent disaster simulation, the primary data center lost power completely. The IT team initiated failover to the DR site. However, the failover process took 3 hours due to a misconfiguration in the DNS failover scripts, and the database was found to be inconsistent because the replication link was broken 30 minutes before the power loss. The team had to restore from a backup that was 4 hours old. After the incident, management requests a review of the disaster recovery plan. Which of the following is the BEST course of action to address the issues identified?

Trap 1: Increase the synchronous replication distance limit to ensure link…

The link failure was due to an outage, not distance; synchronous replication over long distances can introduce latency and is not the root cause.

Trap 2: Switch to asynchronous replication to avoid data loss during link…

Asynchronous replication may increase RPO and does not guarantee consistency; it also does not address the DNS failover issue.

Trap 3: Implement automated DNS failover with health checks and reduce TTL…

This addresses the DNS delay but does not solve the database inconsistency from the replication link failure.

Study all Information Systems Operations and Business Resilience common traps →

A
Increase the synchronous replication distance limit to ensure link stability over 500 km
Why wrong: The link failure was due to an outage, not distance; synchronous replication over long distances can introduce latency and is not the root cause.
B
Conduct a full-scale disaster recovery test including DNS failover and database consistency checks
A comprehensive test would identify both the DNS script error and the replication link vulnerability, allowing corrective actions.
C
Switch to asynchronous replication to avoid data loss during link failures
Why wrong: Asynchronous replication may increase RPO and does not guarantee consistency; it also does not address the DNS failover issue.
D
Implement automated DNS failover with health checks and reduce TTL values to 60 seconds
Why wrong: This addresses the DNS delay but does not solve the database inconsistency from the replication link failure.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full Information Systems Operations and Business Resilience explanation →

An organization is implementing a backup strategy for its critical database. The database is updated continuously during business hours, and the recovery point objective (RPO) is 15 minutes. Which backup method should be used to meet the RPO while minimizing backup storage and performance impact?

Trap 1: Perform full backups every 24 hours

Full daily backups provide a maximum RPO of 24 hours, which exceeds the 15-minute requirement.

Trap 2: Implement synchronous replication to a standby server

Synchronous replication is a high-availability solution, not a backup method, and can introduce performance overhead; it does not replace backup for data corruption or logical errors.

Trap 3: Perform differential backups every 6 hours

Differential backups still rely on a full backup and do not provide log-level granularity; recovery would be to the last differential, not to a specific point in time within 15 minutes.

Study all Information Systems Operations and Business Resilience common traps →

A
Perform full backups every 24 hours
Why wrong: Full daily backups provide a maximum RPO of 24 hours, which exceeds the 15-minute requirement.
B
Implement synchronous replication to a standby server
Why wrong: Synchronous replication is a high-availability solution, not a backup method, and can introduce performance overhead; it does not replace backup for data corruption or logical errors.
C
Perform incremental backups with transaction log backups every 15 minutes
Transaction log backups enable point-in-time recovery to within 15 minutes, meeting the RPO, while incremental backups reduce storage and performance overhead.
D
Perform differential backups every 6 hours
Why wrong: Differential backups still rely on a full backup and do not provide log-level granularity; recovery would be to the last differential, not to a specific point in time within 15 minutes.

Full breakdown with real-world context →

Question 13hardmulti select

Read the full Information Systems Operations and Business Resilience explanation →

Based on the backup logs, the backup administrator notices that the incremental backup job failed due to insufficient storage. Which TWO actions should the administrator take to resolve the immediate issue and prevent recurrence?

Exhibit

Refer to the exhibit.

```
Backup Log for ArcServe UDP – 2024-05-21
========================================
Job Name: Full_Backup_Weekly
Start Time: 02:00
End Time: 04:30
Status: Completed with warnings
Details:
- Volume C: Backup successful (40.5 GB)
- Volume D: Backup successful (120.2 GB)
- Volume E: Backup failed (error code 0x80070020 – file in use)
- Volume F: Backup successful (25.0 GB)

Job Name: Incremental_Backup_Daily
Start Time: 12:00
End Time: 12:45
Status: Failed
Details:
- Volume C: Backup failed (error code 0x807800C5 – insufficient storage)
- Volume D: Backup failed (error code 0x807800C5 – insufficient storage)
- Volume E: Backup failed (error code 0x807800C5 – insufficient storage)
- Volume F: Backup failed (error code 0x807800C5 – insufficient storage)
```

Trap 1: Check network bandwidth between the backup server and storage device

The error code indicates insufficient storage, not a network issue.

Trap 2: Increase the frequency of incremental backups to reduce data volume…

Increasing backup frequency would increase storage consumption, worsening the storage shortage.

Trap 3: Investigate and resolve the file-in-use warnings from the full…

While file-in-use issues are important, they are not directly related to the storage failure of the incremental backup.

Study all Information Systems Operations and Business Resilience common traps →

A
Free up space on the backup storage device by removing old backup sets manually
This addresses the immediate 'insufficient storage' error by freeing up space for the next backup.
B
Check network bandwidth between the backup server and storage device
Why wrong: The error code indicates insufficient storage, not a network issue.
C
Increase the frequency of incremental backups to reduce data volume per job
Why wrong: Increasing backup frequency would increase storage consumption, worsening the storage shortage.
D
Configure backup retention policies and enable data deduplication on the backup device
Retention policies control how long backups are kept, and deduplication reduces storage consumption, preventing future storage shortages.
E
Investigate and resolve the file-in-use warnings from the full backup job
Why wrong: While file-in-use issues are important, they are not directly related to the storage failure of the incremental backup.

Full breakdown with real-world context →

Question 14hardmultiple choice

Study the full virtualization explanation →

An online retail company runs its e-commerce platform on a virtualized infrastructure with 50 virtual servers. The platform experiences intermittent slowdowns during peak hours, and recent monitoring reports show that disk I/O latency on the storage area network (SAN) frequently exceeds 50 ms during these periods. The SAN has two fabric switches and a single storage array with 12 TB of usable capacity, currently at 80% utilization. The company’s disaster recovery plan requires recovery point objective (RPO) of 1 hour and recovery time objective (RTO) of 4 hours for the e-commerce platform. During a recent test failover to the disaster recovery site, the IT team discovered that the replication link between primary and DR sites is saturated, causing replication lag of up to 3 hours. The team also noted that the DR site storage has only 6 TB of usable capacity, now at 60% utilization. The IT manager is concerned about meeting the RPO and RTO. Which course of action should the IT team take first?

Trap 1: Upgrade the SAN fabric switches to support higher throughput and…

Reducing disk latency improves performance but does not address the replication lag that is causing the RPO breach.

Trap 2: Add additional storage capacity to the DR site to reduce storage…

Adding DR storage capacity does not resolve the replication link saturation; it only addresses potential future capacity issues.

Trap 3: Implement more frequent incremental backups and reduce retention…

More frequent backups increase replication traffic, worsening the saturation, and do not address the root cause of replication lag.

Study all Information Systems Operations and Business Resilience common traps →

A
Upgrade the SAN fabric switches to support higher throughput and reduce disk I/O latency
Why wrong: Reducing disk latency improves performance but does not address the replication lag that is causing the RPO breach.
B
Add additional storage capacity to the DR site to reduce storage utilization
Why wrong: Adding DR storage capacity does not resolve the replication link saturation; it only addresses potential future capacity issues.
C
Implement more frequent incremental backups and reduce retention period to free up storage
Why wrong: More frequent backups increase replication traffic, worsening the saturation, and do not address the root cause of replication lag.
D
Upgrade the replication link between primary and DR sites to a higher bandwidth connection
This directly addresses the replication lag, reducing it to meet the 1-hour RPO, and is the most urgent action to ensure disaster recovery objectives.

Full breakdown with real-world context →

Question 15mediumdrag order

Read the full NAT/PAT explanation →

Arrange the steps to implement a patch management process in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 16mediumdrag order

Read the full Information Systems Operations and Business Resilience explanation →

Order the steps for conducting a business impact analysis (BIA) in the correct sequence.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 17mediummatching

Read the full Information Systems Operations and Business Resilience explanation →

Match each disaster recovery site type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Fully equipped and ready within hours

Partially configured, ready in days

Basic infrastructure, no equipment

Portable unit deployed as needed

Question 18mediummatching

Read the full Information Systems Operations and Business Resilience explanation →

Match each testing technique to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Simulated attack to find weaknesses

Automated check for known flaws

Manual inspection of source code

Manipulating people to divulge info

Question 19mediummultiple choice

Read the full Information Systems Operations and Business Resilience explanation →

An organization's online transaction processing system experienced a sudden performance degradation. The database administrator checked system resources and found excessive I/O wait time on the storage subsystem. Which of the following is the MOST likely root cause?

Trap 1: An inefficient SQL query causing table scans

Inefficient queries can increase I/O, but the root cause is still the storage performance; however, the question asks for the most likely root cause, and without evidence of query issues, storage bottleneck is more direct.

Trap 2: Insufficient memory allocated to the database server

Insufficient memory leads to swapping, which increases paging activity, but the primary symptom is high paging, not I/O wait directly.

Trap 3: Network latency between the application and database servers

Network latency would show as network-related delays, not disk I/O wait.

Study all Information Systems Operations and Business Resilience common traps →

A
An inefficient SQL query causing table scans
Why wrong: Inefficient queries can increase I/O, but the root cause is still the storage performance; however, the question asks for the most likely root cause, and without evidence of query issues, storage bottleneck is more direct.
B
Inadequate disk spindles or a storage area network (SAN) bottleneck
I/O wait is a clear indicator of storage subsystem saturation, often due to insufficient disk spindles or SAN performance issues.
C
Insufficient memory allocated to the database server
Why wrong: Insufficient memory leads to swapping, which increases paging activity, but the primary symptom is high paging, not I/O wait directly.
D
Network latency between the application and database servers
Why wrong: Network latency would show as network-related delays, not disk I/O wait.

Full breakdown with real-world context →

Question 20hardmultiple choice

Read the full NAT/PAT explanation →

A multinational corporation has implemented a hot site disaster recovery solution for its critical financial applications. Which of the following is the MOST important consideration to ensure the effectiveness of the hot site?

Trap 1: Data replication latency is less than 15 minutes

Recovery point objective is critical but must be validated through testing to ensure it meets requirements.

Trap 2: The hot site is located in a different seismic zone

Geographic separation is important but not the most important; testing validates the entire recovery process.

Trap 3: The hot site complies with regional data privacy regulations

Compliance is necessary but does not guarantee operational effectiveness.

Study all Information Systems Operations and Business Resilience common traps →

A
Data replication latency is less than 15 minutes
Why wrong: Recovery point objective is critical but must be validated through testing to ensure it meets requirements.
B
The hot site is located in a different seismic zone
Why wrong: Geographic separation is important but not the most important; testing validates the entire recovery process.
C
The hot site complies with regional data privacy regulations
Why wrong: Compliance is necessary but does not guarantee operational effectiveness.
D
Regular, documented testing of the failover process is performed
Testing is the only way to verify that the hot site will work when needed, including all technical and procedural aspects.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Information Systems Operations and Business Resilience sessions

Start a Information Systems Operations and Business Resilience only practice session

Every question in these sessions is drawn from the Information Systems Operations and Business Resilience domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Information Systems Operations and Business Resilience questions →Mixed CISA session

Frequently asked questions

What does the CISA exam test about Information Systems Operations and Business Resilience?: Information Systems Operations and Business Resilience questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Information Systems Operations and Business Resilience questions in a focused session?: Yes — the session launcher on this page draws every question from the Information Systems Operations and Business Resilience domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CISA topics?: Use the topic links above to move to related areas, or go back to the CISA question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CISA exam covers. They are not copied from any real exam or dump site.

Information Systems Operations and Business Resilience only

10 questions 20 questions 30 questions 50 questions

Mixed CISA session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CISA questions Information Systems Operations and Business Resilience domain overview CISA exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Information Systems Operations and Business Resilience practice questions

What to know about Information Systems Operations and Business Resilience

Common Information Systems Operations and Business Resilience exam traps

Information Systems Operations and Business Resilience questions

An IT auditor is reviewing the business continuity plan (BCP) for a financial services firm. The plan includes a hot site that is shared with another organization under a reciprocal agreement. Which of the following findings should be of MOST concern to the auditor?

A company is designing its backup strategy for a critical database that must be available 24/7. The database experiences high transaction volumes. Which backup method minimizes data loss while allowing continuous operations?

During an incident response exercise, the IT team discovers that the failover to the disaster recovery (DR) site failed because the DR site's storage area network (SAN) was not zoned correctly for the replicated data. Which of the following controls would BEST prevent this issue?

A company's backup policy requires that backup tapes be stored offsite for at least one year. During an audit, the auditor finds that the offsite storage facility is not access-controlled and backup tapes are not encrypted. Which of the following is the auditor's BEST recommendation?

An organization is implementing a business continuity plan (BCP). Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA)?

Which TWO of the following are essential components of an effective incident response plan? (Select exactly 2.)

Which THREE of the following are key metrics to include in a disaster recovery test report? (Select exactly 3.)

An administrator sees the above error after a failed backup job. What is the MOST likely cause?

Exhibit

An organization has configured HSRP as shown. During a failover test, the primary router (G0/1) is shut down, but the DR site router does not become active. What is the MOST likely reason?

Exhibit

An organization is implementing a backup strategy for its critical database. The database is updated continuously during business hours, and the recovery point objective (RPO) is 15 minutes. Which backup method should be used to meet the RPO while minimizing backup storage and performance impact?

Based on the backup logs, the backup administrator notices that the incremental backup job failed due to insufficient storage. Which TWO actions should the administrator take to resolve the immediate issue and prevent recurrence?

Exhibit

Arrange the steps to implement a patch management process in the correct order.

Order the steps for conducting a business impact analysis (BIA) in the correct sequence.

Match each disaster recovery site type to its description.

Match each testing technique to its description.

An organization's online transaction processing system experienced a sudden performance degradation. The database administrator checked system resources and found excessive I/O wait time on the storage subsystem. Which of the following is the MOST likely root cause?

A multinational corporation has implemented a hot site disaster recovery solution for its critical financial applications. Which of the following is the MOST important consideration to ensure the effectiveness of the hot site?

Track your progress over time

Start a Information Systems Operations and Business Resilience only practice session

Related CISA topic practice pages

Governance and Management of IT practice questions

Information Systems Acquisition, Development and Implementation practice questions