CISA Business Continuity Planning 4 — Questions and Answers
Question 1: Which of the following is the PRIMARY responsibility of executive management regarding business continuity planning?
- Writing and maintaining detailed recovery procedures
- Sponsoring and approving the BCP program and providing adequate resources (Correct answer)
- Conducting annual BCP tests and drills
- Performing risk assessments and BIA studies
Correct answer: Sponsoring and approving the BCP program and providing adequate resources
Executive management's primary BCP role is governance: providing leadership commitment, funding, and policy approval for the overall program.
Question 2: An organization is selecting between cloud-based disaster recovery and a traditional hot site. A key ADVANTAGE of cloud-based DR is:
- Guaranteed lower cost in all scenarios
- Elimination of all recovery time objectives
- Scalable resources and reduced capital expenditure (Correct answer)
- Removal of the need to test recovery procedures
Correct answer: Scalable resources and reduced capital expenditure
Cloud-based DR offers on-demand scalable resources and shifts capital expenditure to operational expenditure, reducing upfront infrastructure costs.
Question 3: A company stores backup media at a facility 2 miles from the primary data center. An IS auditor's MAIN concern would be:
- The cost of transporting media to the offsite location
- The proximity may mean both sites are affected by the same regional disaster (Correct answer)
- The media may not be properly labeled for identification
- The backup facility may have different environmental controls
Correct answer: The proximity may mean both sites are affected by the same regional disaster
Offsite storage must be far enough away to avoid being impacted by the same disaster (flood, hurricane, earthquake) that affects the primary site.
Question 4: Which of the following components is MOST important to include in the emergency response phase of a BCP?
- Detailed IT recovery procedures
- Employee evacuation and immediate safety procedures (Correct answer)
- Financial loss estimation processes
- Vendor renegotiation protocols
Correct answer: Employee evacuation and immediate safety procedures
The emergency response phase prioritizes human safety and immediate crisis containment before addressing IT recovery or financial concerns.
Question 5: An IS auditor finds that a company's BCP does not address pandemics or widespread illness. Based on BCP best practices, this is:
- Acceptable because pandemics are extremely rare events
- A gap, since BCPs should address all threats identified in the risk assessment including people-centric disasters (Correct answer)
- Not a concern because IT systems remain operational during pandemics
- Adequate because government agencies are responsible for pandemic response
Correct answer: A gap, since BCPs should address all threats identified in the risk assessment including people-centric disasters
BCPs must address a range of disruption scenarios including pandemics, which primarily affect personnel availability rather than physical infrastructure.
Question 6: What is the role of the BCP coordinator during the plan maintenance phase?
- Approving the budget for recovery site contracts
- Ensuring the plan is regularly reviewed, updated, and tested after changes to the business (Correct answer)
- Activating the emergency response team when a disaster occurs
- Purchasing backup hardware for the recovery site
Correct answer: Ensuring the plan is regularly reviewed, updated, and tested after changes to the business
The BCP coordinator is responsible for keeping the plan current by scheduling reviews, incorporating organizational changes, and tracking test results.
Question 7: Which of the following BEST describes a 'cold site' recovery option?
- A site with all hardware, software, and data fully configured and ready for immediate use
- A site with basic infrastructure (power, cooling, network) but no pre-installed hardware or data (Correct answer)
- A site owned by a third party that is shared with other organizations
- A site where processing is permanently relocated after a disaster
Correct answer: A site with basic infrastructure (power, cooling, network) but no pre-installed hardware or data
A cold site provides only basic physical infrastructure; equipment must be procured and installed after a disaster, resulting in longer recovery times.
CISA Business Continuity Planning 4
Which of the following is the PRIMARY responsibility of executive management regarding business continuity planning?