CISA Disaster Recovery Testing 3

Question 1

An IS auditor finds that a company's DR plan has never been tested. What is the PRIMARY risk this creates?

Accepted Answer

Unknown gaps between documented procedures and actual recovery capability

Answer

Without testing, the organization cannot know whether recovery procedures will actually work, leaving critical gaps undetected until an actual disaster occurs.

Question 2

Which statement BEST describes the purpose of a hot site in DR testing?

Accepted Answer

It is a fully equipped facility that can take over operations immediately

Answer

A hot site is a fully operational facility with hardware, software, and network connectivity pre-configured to assume production operations with minimal delay.

Question 3

During DR test evaluation, an IS auditor should PRIMARILY assess whether:

Accepted Answer

Recovery objectives defined in the BCP were actually achieved

Answer

The core audit criterion is whether the test demonstrated the organization can meet its defined RTOs and RPOs, validating the effectiveness of the BCP.

Question 4

A company uses a warm site for disaster recovery. Compared to a hot site, what is the PRIMARY trade-off?

Accepted Answer

Lower cost but longer recovery time

Answer

Warm sites have some pre-installed equipment and partial configurations, making them less expensive than hot sites but requiring additional setup time before operations can resume.

Question 5

Which DR test metric measures the total time an organization can tolerate being without a critical system before suffering unacceptable business impact?

Accepted Answer

Maximum Tolerable Downtime

Answer

Maximum Tolerable Downtime (MTD) is the upper threshold of acceptable downtime; the RTO must always be less than the MTD.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Disaster Recovery Testing 3