CISA - Certified Information Systems Auditor Disaster Recovery Testing Questions and Answers

Question 1

An organization performs a disaster recovery test in which the alternate processing site is brought online and used to process non-critical transactions. Meanwhile, the primary site continues to handle the full production workload. Which type of disaster recovery test does this scenario describe?

Accepted Answer

Parallel test

Answer

A parallel test involves activating the disaster recovery facility and processing data in parallel with the primary site. This allows for testing of the recovery site's capabilities with a real workload without impacting the live production environment, which is exactly what the scenario describes.

Question 2

An IS auditor is reviewing the results of a recent disaster recovery test. The test report shows that while all systems were recovered, the time taken exceeded the Recovery Time Objective (RTO) by several hours. Which of the following is the MOST important recommendation for the auditor to make?

Accepted Answer

Perform a root cause analysis of the delays and revise recovery procedures.

Answer

The primary goal of DR testing is to verify that recovery objectives, such as the RTO, can be met. When a test fails to meet the RTO, the most critical next step is to understand why the failure occurred. A root cause analysis will identify the specific bottlenecks or procedural flaws that caused the delay, allowing the organization to make targeted improvements to the recovery plan. Simply updating the plan to match the failed time (B) accepts failure, while recommending more tests (A) or more budget (D) without understanding the problem is premature.

Question 3

Which of the following provides the GREATEST assurance that a disaster recovery plan (DRP) will function as intended when required?

Accepted Answer

A full interruption test conducted at the alternate site.

Answer

A full interruption test, also known as a full-scale test, is the most rigorous and realistic testing method. It involves shutting down the primary production environment and failing over completely to the recovery site. This type of test provides the highest level of assurance because it is the most accurate simulation of an actual disaster, validating that all components of the plan work together effectively in a real-world scenario.

Question 4

An IS auditor notes that a company's disaster recovery plan has not been tested since a major cloud migration project was completed one year ago. The PRIMARY risk associated with this finding is that the:

Accepted Answer

DRP may not be aligned with the current technology infrastructure.

Answer

Disaster recovery plans must be tested regularly, especially after significant changes to the IT environment, such as a cloud migration. The primary risk of not testing after such a change is that the documented recovery procedures are likely outdated and will not work for the new infrastructure, rendering the plan ineffective in a real disaster.

Question 5

An organization is planning its annual disaster recovery testing strategy. Management is concerned about the high cost and potential business disruption of a full interruption test. Which type of test would be the BEST alternative to validate the technical recovery procedures with high assurance but minimal production impact?

Accepted Answer

A parallel test

Answer

A parallel test provides a high degree of assurance by activating the recovery systems and processing real data or transactions, but it does so without taking the primary systems offline. This approach allows for thorough technical validation while avoiding the disruption and risk associated with a full interruption test, making it the best alternative in this scenario.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Disaster Recovery Testing Questions and Answers