CISSP Practice Question: Which TWO of the following are valid reasons for…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To identify vulnerabilities in the network infrastructure

  Why it's wrong here

  A Business Impact Analysis (BIA) focuses on the impact of disruptions to business processes, not the causes or specific technical weaknesses. Identifying vulnerabilities in network infrastructure, such as unpatched systems or misconfigured firewalls, is a distinct activity typically performed during vulnerability assessments or penetration testing, which are components of a broader risk assessment framework. The BIA assumes a disruption has occurred and quantifies its effects.

• ✗

  To perform a full security audit of the organization

  Why it's wrong here

  Performing a full security audit involves a comprehensive examination of an organization's security posture, including policies, procedures, technical controls, and compliance with standards. This extensive review aims to identify weaknesses across the entire security program. In contrast, a Business Impact Analysis (BIA) is a focused exercise specifically designed to understand the financial and operational consequences of business process interruptions, rather than evaluating the effectiveness of security controls themselves.

• ✗

  To create a list of all hardware and software assets

  Why it's wrong here

  While understanding the assets supporting critical processes is important, the primary purpose of a Business Impact Analysis (BIA) is not to compile a comprehensive inventory of all hardware and software. Asset inventory management is a foundational IT governance and security practice that systematically catalogs all organizational assets. A BIA leverages existing asset information to understand dependencies but does not initiate the creation of the asset list itself; it focuses on the impact of their unavailability.

• ✓

  To identify critical business processes and their dependencies

  Why this is correct

  A fundamental objective of a Business Impact Analysis (BIA) is to systematically identify and prioritize the organization's critical business processes. This involves determining which operations are essential for the organization's survival and mission fulfillment. Furthermore, the BIA meticulously maps out the internal and external dependencies—such as IT systems, personnel, facilities, and third-party services—that these critical processes rely upon to function effectively.

• ✓

  To determine the maximum acceptable outage time for each process

  Why this is correct

  A key outcome of a Business Impact Analysis (BIA) is the establishment of recovery objectives, specifically the Maximum Acceptable Outage (MAO) or Maximum Tolerable Downtime (MTD) for each critical business process. This metric quantifies the longest period a process can be unavailable before unacceptable damage occurs. The BIA also helps define Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs), which are crucial for guiding the development of effective disaster recovery and business continuity strategies.

Go deeper

Related to this question