CISA Business Continuity Planning 3 — Questions and Answers
Question 1: Which of the following is the CORRECT sequence for developing a Business Continuity Plan?
- Test → BIA → Risk Assessment → Plan Development
- Risk Assessment → BIA → Plan Development → Test (Correct answer)
- BIA → Plan Development → Risk Assessment → Test
- Plan Development → Risk Assessment → BIA → Test
Correct answer: Risk Assessment → BIA → Plan Development → Test
Risk assessment identifies threats, BIA quantifies their impact, plan development addresses the findings, and testing validates the plan.
Question 2: A reciprocal agreement for disaster recovery is BEST described as:
- A contract with a third-party recovery vendor for dedicated facilities
- An arrangement between two organizations to use each other's facilities during a disaster (Correct answer)
- An agreement to share cloud resources during peak demand
- A government mandate for critical infrastructure sharing
Correct answer: An arrangement between two organizations to use each other's facilities during a disaster
Reciprocal agreements allow two organizations to use each other's facilities in a disaster, though compatibility and capacity can be concerns.
Question 3: The Maximum Tolerable Downtime (MTD) for a critical process is 4 hours. The RTO is set at 6 hours. This situation indicates:
- The recovery plan is adequate since RTO is greater than MTD
- The RTO exceeds MTD, meaning recovery may not happen before unacceptable damage occurs (Correct answer)
- The MTD and RTO are properly aligned
- The BIA needs to be redone to align these metrics
Correct answer: The RTO exceeds MTD, meaning recovery may not happen before unacceptable damage occurs
The RTO must always be less than or equal to the MTD; an RTO greater than MTD means the system may not be restored before irreversible damage occurs.
Question 4: During a BCP test, an organization discovers its backup tapes contain corrupted data. What control failure does this PRIMARILY represent?
- Lack of a documented recovery procedure
- Failure to validate backup integrity through regular restoration testing (Correct answer)
- Insufficient offsite storage of backup media
- Inadequate encryption of backup data
Correct answer: Failure to validate backup integrity through regular restoration testing
Backups must be regularly tested through actual restoration to verify data integrity; storing backups without testing them is a critical control gap.
Question 5: Which of the following BEST supports an organization's ability to meet a very aggressive RPO of near zero?
- Daily incremental backups to tape
- Synchronous data replication to a secondary site (Correct answer)
- Weekly full backups with offsite rotation
- Asynchronous replication with a 15-minute lag
Correct answer: Synchronous data replication to a secondary site
Synchronous replication writes data to both primary and secondary sites simultaneously, achieving near-zero RPO.
Question 6: An IS auditor is reviewing crisis communication procedures in a BCP. Which finding is MOST critical?
- The communication plan does not include social media guidelines
- There is no designated spokesperson authorized to communicate with the media and stakeholders (Correct answer)
- The communication tree is maintained only in digital format
- The plan uses email as the primary communication method
Correct answer: There is no designated spokesperson authorized to communicate with the media and stakeholders
Without a designated spokesperson, inconsistent or unauthorized communications during a crisis can cause legal liability and reputational damage.
Question 7: A parallel test of the business continuity plan is conducted. Which statement BEST describes this type of test?
- Primary operations are shut down and all processing moves to the recovery site
- Recovery procedures are reviewed and discussed without any actual system activation
- Recovery systems are activated at the alternate site while primary operations continue normally (Correct answer)
- Only the communication and notification procedures are tested
Correct answer: Recovery systems are activated at the alternate site while primary operations continue normally
In a parallel test, the backup site is activated and processes data while the primary site continues to operate, validating recovery capability without operational risk.
CISA Business Continuity Planning 3
Which of the following is the CORRECT sequence for developing a Business Continuity Plan?