CISA - Certified Information Systems Auditor Business Continuity Planning Questions and Answers

Question 1

An IS auditor is reviewing an organization's business continuity plan (BCP). The Business Impact Analysis (BIA) identifies a critical sales processing system with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 15 minutes. Which of the following is the MOST appropriate recovery strategy for this system?

Accepted Answer

High-availability system with data replication.

Answer

A high-availability system with data replication is the only option that can meet the stringent RTO of 4 hours and RPO of 15 minutes. Data replication ensures that data loss is minimal (meeting the RPO), and a high-availability setup allows for rapid failover (meeting the RTO). Tape backups, a cold site, and bi-hourly electronic vaulting would not be able to restore service or data within the required timeframes.

Question 2

What is the PRIMARY output of the Business Impact Analysis (BIA) phase in the business continuity planning process?

Accepted Answer

A prioritization of critical business processes and their recovery time objectives.

Answer

The primary purpose of a Business Impact Analysis (BIA) is to identify the organization's critical business processes and determine the impact a disruption would have on them. This analysis results in a prioritized list of these processes and the establishment of Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for each, which guides the rest of the BCP strategy.

Question 3

An organization conducts a business continuity test where key team members gather in a conference room to discuss their roles and responsibilities in response to a simulated disaster scenario presented by a facilitator. Which type of test does this scenario describe?

Accepted Answer

Tabletop exercise

Answer

This scenario describes a tabletop exercise. A tabletop exercise is a discussion-based session where team members review and discuss their roles and responses to a particular emergency situation, without any actual activation of recovery systems. It's used to validate plans and confirm team members' understanding of their roles.

Question 4

During a review of a company's business continuity plan, an IS auditor notes that the plan has not been updated in over three years, despite significant changes in business processes and IT infrastructure. Which of the following is the GREATEST risk associated with this finding?

Accepted Answer

The plan may be ineffective in recovering critical operations after a disruption.

Answer

The greatest risk is that the plan is no longer aligned with the current business environment and will fail when executed. Business processes, technology, and personnel change over time, and a BCP must be regularly updated and tested to ensure it remains relevant and effective for recovering the organization's critical functions.

Question 5

Which of the following BEST defines the Recovery Point Objective (RPO)?

Accepted Answer

The maximum amount of data loss an organization can tolerate, measured in time.

Answer

The Recovery Point Objective (RPO) is a measure of the maximum acceptable amount of data loss after a disruptive event. It's measured in time and looks backward from the moment of disruption to the last successful data backup or replication point. For example, an RPO of one hour means the organization can tolerate losing up to one hour of data.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Business Continuity Planning Questions and Answers