CISA Business Continuity Planning 5

Question 1

Which of the following BEST explains why a business continuity plan must be treated as a living document?

Accepted Answer

Business processes, systems, personnel, and risks change over time, making static plans obsolete

Answer

Organizations constantly change, so BCPs must be updated to reflect new systems, staff, processes, and threat landscapes to remain effective.

Question 2

An IS auditor is evaluating the adequacy of an organization's BCP. Which of the following would provide the MOST assurance that the plan is effective?

Accepted Answer

Documented results from a recent successful full-scale test

Answer

Actual test results demonstrating that recovery objectives were met provide the strongest evidence of BCP effectiveness.

Question 3

A financial services firm determines that its trading system has an MTD of 30 minutes. Which recovery strategy is MOST appropriate?

Accepted Answer

Hot site with synchronous replication and automated failover

Answer

A 30-minute MTD requires near-instant failover capability, only achievable through a hot site with real-time synchronous replication and automated switchover.

Question 4

When performing a BCP audit, an IS auditor discovers that critical recovery procedures are known only to a single IT administrator. This represents a risk of:

Accepted Answer

Single point of failure in human knowledge—key-person dependency

Answer

If critical recovery knowledge resides with only one person, that person's unavailability during a disaster could prevent successful recovery.

Question 5

Which of the following BEST demonstrates integration between information security and business continuity planning?

Accepted Answer

Recovery procedures include requirements to maintain security controls and access restrictions during restoration

Answer

True integration means security controls—authentication, encryption, access controls—are actively maintained and enforced throughout the recovery process.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Business Continuity Planning 5