hardMultiple Select
CISA Practice Question: Which THREE of the following are key metrics to…
Which THREE of the following are key metrics to include in a disaster recovery test report? (Select exactly 3.)
⚠ Common exam trap
A common mix-up: candidates confuse operational metrics (like cost or personnel count) with technical DR success metrics, leading them to select B or D instead of focusing on RPO, RTO, and restore integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amount of data lost (actual vs. RPO)
Option A is correct because a DR test report must quantify actual data loss against the Recovery Point Objective (RPO), showing whether the achieved recovery point met the agreed tolerable data-loss threshold. Option C is correct because measuring the time taken to recover each critical system validates performance against the Recovery Time Objective (RTO) and identifies systems that exceeded acceptable downtime. Option E is correct because the percentage of successful restores demonstrates the reliability and integrity of backups and recovery procedures, exposing failed or partial restores that need remediation. Option B is not a standard DR test metric; cost per incident belongs to financial or business-impact analysis rather than recovery validation. Option D is also not a key DR metric, since headcount alone does not measure recovery effectiveness, speed, or data integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amount of data lost (actual vs. RPO)
Why this is correct
Comparing actual data loss against the recovery point objective quantifies whether the restore met the agreed tolerable loss. It is a core recovery metric, revealing gaps between tested capability and business requirements that the report must communicate to management.
- ✗
Cost per incident
Why it's wrong here
Cost per incident measures operational incident management expenditure, not disaster recovery test outcomes. A DR test report documents recovery time and recovery point achievements against objectives. Cost per incident would suit an incident management performance review, where financial impact of individual incidents is assessed.
- ✓
Time taken to recover each critical system
Why this is correct
Recording recovery duration for each critical system shows whether restoration met the recovery time objective and exposes dependencies that serialise recovery. It is a core metric because it measures the tested capability against the agreed availability requirement.
- ✗
Number of personnel involved
Why it's wrong here
Personnel count is a resourcing input, not a recovery performance metric. A DR test report measures whether systems were restored within the recovery time objective and to the recovery point objective. Staffing numbers belong in resource planning or exercise participation records, not recovery capability evidence.
- ✓
Percentage of successful restores
Why this is correct
The percentage of successful restores quantifies how many recovery attempts completed correctly, directly evidencing whether recovery objectives were met. It is a core metric because it measures restore reliability rather than speed, coverage or cost alone.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.