CISA Business Continuity Planning 2

Question 1

Which metric defines the maximum amount of data an organization can afford to lose in a disaster, measured in time?

Accepted Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Mean Time to Repair (MTTR)

Question 2

A hot site differs from a warm site primarily because a hot site:

Accepted Answer

Is fully operational with real-time data replication

Answer

Has hardware installed but no current data

Answer

Requires 24-48 hours to become operational

Answer

Is owned by a third-party vendor only

Question 3

During a BCP audit, an IS auditor finds that the organization has not updated its BCP in three years. What is the MOST significant risk?

Accepted Answer

The plan may not reflect current business processes and systems

Answer

Executive management may not have signed off on the plan

Answer

The plan may be stored in an insecure location

Answer

The BCP may not include a communication tree

Question 4

Which of the following BEST describes the purpose of a Business Impact Analysis (BIA)?

Accepted Answer

To quantify the impact of disruptions and prioritize recovery of critical functions

Answer

To identify the probability of each type of disaster occurring

Answer

To document recovery procedures for critical systems

Answer

To test the effectiveness of existing backup procedures

Question 5

An organization's BCP team is conducting an emergency response exercise. Which type of test involves actually moving operations to the recovery site?

Accepted Answer

Full interruption test

Answer

Tabletop exercise

Answer

Parallel test

Answer

Checklist review

Question 6

Which element is MOST critical to include in a business continuity plan for an organization that relies heavily on third-party vendors?

Accepted Answer

Third-party vendor continuity and resilience requirements

Answer

Vendor contact lists only

Answer

A list of alternative vendors with no contract in place

Answer

Vendor financial ratings

Question 7

When auditing a disaster recovery plan, which finding would be of GREATEST concern to an IS auditor?

Accepted Answer

The DRP is stored only at the primary site

Answer

The DRP has not been tested in the past 18 months

Answer

Recovery procedures are documented but not assigned to specific personnel

Answer

The DRP does not include a budget estimate for recovery