CISA - Certified Information Systems Auditor Business Continuity Planning Questions and Answers

Question 1

An IS auditor is reviewing an organization's business continuity plan (BCP).
The Business Impact Analysis (BIA) identifies a critical sales processing system with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 15 minutes.
Which of the following is the MOST appropriate recovery strategy for this system?

Accepted Answer

High-availability system with data replication.

Answer

Daily tape backups stored at an off-site facility.

Answer

A cold site with hardware available for installation.

Answer

Electronic vaulting to a remote location every 2 hours.

Question 2

What is the PRIMARY output of the Business Impact Analysis (BIA) phase in the business continuity planning process?

Accepted Answer

A prioritization of critical business processes and their recovery time objectives.

Answer

A list of emergency contact information for all key personnel.

Answer

The selection of an off-site recovery facility.

Answer

A detailed procedure for restoring the IT data center.

Question 3

An organization conducts a business continuity test where key team members gather in a conference room to discuss their roles and responsibilities in response to a simulated disaster scenario presented by a facilitator. Which type of test does this scenario describe?

Accepted Answer

Tabletop exercise

Answer

Full interruption test

Answer

Parallel test

Answer

Walk-through test

Question 4

During a review of a company's business continuity plan, an IS auditor notes that the plan has not been updated in over three years, despite significant changes in business processes and IT infrastructure. Which of the following is the GREATEST risk associated with this finding?

Accepted Answer

The plan may be ineffective in recovering critical operations after a disruption.

Answer

The plan may not comply with outdated regulatory requirements.

Answer

The cost of maintaining the outdated plan is wasted.

Answer

New employees may not be aware of the plan's existence.

Question 5

Which of the following BEST defines the Recovery Point Objective (RPO)?

Accepted Answer

The maximum amount of data loss an organization can tolerate, measured in time.

Answer

The time required to restore a system to full operation after a failure.

Answer

The point in time when the business declares a disaster.

Answer

The minimum frequency for testing the disaster recovery plan.

Question 6

An IS auditor is evaluating the business continuity preparedness of a large financial institution. Which of the following provides the MOST assurance that the business continuity plan (BCP) is effective and will function as intended in a real disaster?

Accepted Answer

A full-scale interruption test conducted at the alternate processing site.

Answer

Annual review and approval of the BCP by senior management.

Answer

A recent, successful tabletop exercise with key stakeholders.

Answer

A comprehensive business impact analysis (BIA) that is updated quarterly.