CISA Business Continuity Planning 2

Question 1

Which metric defines the maximum amount of data an organization can afford to lose in a disaster, measured in time?

Accepted Answer

Recovery Point Objective (RPO)

Answer

RPO defines the point in time to which data must be recovered, representing the maximum acceptable data loss.

Question 2

A hot site differs from a warm site primarily because a hot site:

Accepted Answer

Is fully operational with real-time data replication

Answer

A hot site is fully equipped, staffed, and has mirrored data so it can assume operations almost immediately.

Question 3

During a BCP audit, an IS auditor finds that the organization has not updated its BCP in three years. What is the MOST significant risk?

Accepted Answer

The plan may not reflect current business processes and systems

Answer

An outdated BCP may fail to account for changes in infrastructure, personnel, and critical processes, making it ineffective during a real disaster.

Question 4

Which of the following BEST describes the purpose of a Business Impact Analysis (BIA)?

Accepted Answer

To quantify the impact of disruptions and prioritize recovery of critical functions

Answer

A BIA quantifies financial and operational impacts of disruptions and prioritizes which functions must be restored first.

Question 5

An organization's BCP team is conducting an emergency response exercise. Which type of test involves actually moving operations to the recovery site?

Accepted Answer

Full interruption test

Answer

A full interruption test shuts down primary operations and transfers them to the recovery site, providing the most realistic but disruptive test.

CISA - Certified Information Systems Auditor Practice Test