CISA Business Continuity Planning 3

Question 1

Which of the following is the CORRECT sequence for developing a Business Continuity Plan?

Accepted Answer

Risk Assessment → BIA → Plan Development → Test

Answer

Risk assessment identifies threats, BIA quantifies their impact, plan development addresses the findings, and testing validates the plan.

Question 2

A reciprocal agreement for disaster recovery is BEST described as:

Accepted Answer

An arrangement between two organizations to use each other's facilities during a disaster

Answer

Reciprocal agreements allow two organizations to use each other's facilities in a disaster, though compatibility and capacity can be concerns.

Question 3

The Maximum Tolerable Downtime (MTD) for a critical process is 4 hours. The RTO is set at 6 hours. This situation indicates:

Accepted Answer

The RTO exceeds MTD, meaning recovery may not happen before unacceptable damage occurs

Answer

The RTO must always be less than or equal to the MTD; an RTO greater than MTD means the system may not be restored before irreversible damage occurs.

Question 4

During a BCP test, an organization discovers its backup tapes contain corrupted data. What control failure does this PRIMARILY represent?

Accepted Answer

Failure to validate backup integrity through regular restoration testing

Answer

Backups must be regularly tested through actual restoration to verify data integrity; storing backups without testing them is a critical control gap.

Question 5

Which of the following BEST supports an organization's ability to meet a very aggressive RPO of near zero?

Accepted Answer

Synchronous data replication to a secondary site

Answer

Synchronous replication writes data to both primary and secondary sites simultaneously, achieving near-zero RPO.

CISA - Certified Information Systems Auditor Practice Test