easyMultiple Select
CISA Practice Question: Which TWO of the following are essential…
Which TWO of the following are essential components of a disaster recovery plan (DRP)?
⚠ Common exam trap
A common mix-up: candidates confuse operational procedures like backup rotation schedules (Option E) with the essential recovery-focused components of a DRP, but the DRP itself does not include the rotation schedule—it only references the use of backups.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Steps for restoring IT systems
Option A, steps for restoring IT systems, is correct because a DRP must define the documented procedures and sequence for recovering systems, applications, and data after a disruption, which is the plan's core operational purpose. Option D, a list of critical contacts, is correct because effective disaster recovery depends on reaching the right people—such as the DR team, vendors, and management—during an incident, so contact information is an essential DRP component. Option B, detailed financial audit procedures, is not part of a DRP; that belongs to financial auditing or accounting controls. Option C, employee performance reviews, is an HR function unrelated to disaster recovery. Option E, a backup media rotation schedule, is a backup/recovery operational detail that supports data restoration but is not itself one of the essential DRP components being tested here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Steps for restoring IT systems
Why this is correct
Restoring IT systems defines the recovery procedures and sequence needed to bring critical services back after disruption. Without documented restoration steps, the DRP cannot meet its recovery time and recovery point objectives, making it a core component.
- ✗
Detailed financial audit procedures
Why it's wrong here
Financial audit procedures examine accounting records and controls for accuracy and compliance, which does not restore systems after an outage. They are tempting because DRPs do address financial impacts and insurance, but detailed audit testing belongs to assurance and finance functions, not disaster recovery planning.
- ✗
Employee performance reviews
Why it's wrong here
Employee performance reviews assess individual staff output and development, contributing nothing to restoring IT services after disruption. They are tempting because DRPs include personnel elements such as roles, contact lists and training, but performance appraisal is an HR management process, not a recovery component.
- ✓
List of critical contacts
Why this is correct
A critical contacts list ensures the right personnel are reachable during disruption, satisfying the DRP requirement for defined escalation and communication paths. Without current names, roles and out-of-hours numbers, recovery actions stall when primary staff are unavailable, so this component directly supports timely activation and coordination of the plan.
- ✗
Backup media rotation schedule
Why it's wrong here
A backup media rotation schedule is an operational backup detail, not an essential DRP component; the plan must define recovery time and recovery point objectives, roles, and procedures. It is tempting because backups underpin recovery, but rotation belongs in backup operations documentation rather than the DRP's essential components.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.