CISA Disaster Recovery Testing 5 — Questions and Answers
Question 1: An organization's DR plan calls for restoring systems from tape, but the most recent tape is three days old. The BEST control to address this gap is:
- Purchasing additional tape drives
- Implementing real-time or near-real-time replication to the recovery site (Correct answer)
- Training staff to restore from tape more quickly
- Keeping physical copies of transactions at the primary site
Correct answer: Implementing real-time or near-real-time replication to the recovery site
Real-time or near-real-time replication eliminates the data-age problem by continuously mirroring production data to the recovery site.
Question 2: Which of the following BEST describes a structured walkthrough in the context of DR testing?
- A live failover to the recovery site with production traffic
- A review where team members individually verify their portions of the DR plan for accuracy (Correct answer)
- An unannounced test to evaluate team readiness
- A vendor-led audit of the recovery facility
Correct answer: A review where team members individually verify their portions of the DR plan for accuracy
A structured walkthrough has each team member review their section of the DR plan and confirm it is accurate and feasible, without activating any systems.
Question 3: An IS auditor is evaluating DR test documentation. Which finding would be MOST concerning?
- Test results include minor deviations from the plan
- Test results are undated and lack signatures from responsible parties (Correct answer)
- The test took slightly longer than the RTO
- One minor system was not included in the scope
Correct answer: Test results are undated and lack signatures from responsible parties
Undated and unsigned test records lack the basic governance controls needed to demonstrate accountability and cannot serve as reliable audit evidence.
Question 4: Which of the following scenarios would MOST likely require an immediate, unplanned update to the DR plan?
- Annual review cycle is due next month
- A major application is migrated to a new cloud platform (Correct answer)
- A junior employee joins the IT team
- The company leases additional office space
Correct answer: A major application is migrated to a new cloud platform
Migrating a critical application to a new platform fundamentally changes recovery dependencies, procedures, and RTO/RPO assumptions, requiring immediate DR plan updates.
Question 5: During a DR test, a member of the recovery team cannot locate the call tree and is unable to notify key stakeholders. This BEST highlights a gap in:
- Network redundancy
- DR plan accessibility and communication procedures (Correct answer)
- Server backup frequency
- Encryption of recovery media
Correct answer: DR plan accessibility and communication procedures
Recovery team members must be able to access communication tools and call trees immediately; failure to do so indicates the plan is not accessible or communication procedures are inadequate.
Question 6: An IS auditor recommends that DR tests should include which of the following to address supply chain risk?
- Testing recovery of systems that depend on third-party vendors and cloud providers (Correct answer)
- Limiting tests to internally hosted systems only
- Excluding vendor systems to simplify test scope
- Testing only systems managed by the internal IT team
Correct answer: Testing recovery of systems that depend on third-party vendors and cloud providers
Modern IT environments depend heavily on third-party vendors and cloud providers; DR tests must validate that these dependencies can be recovered or worked around.
Question 7: After completing a DR test, management decides the results do not need to be shared with the board. An IS auditor should flag this because:
- The board is responsible for approving all technical configurations
- Board-level oversight of DR program effectiveness is a governance best practice (Correct answer)
- DR test results must be published publicly under US law
- The board needs to personally restore backup systems
Correct answer: Board-level oversight of DR program effectiveness is a governance best practice
Governance frameworks such as COBIT and ISO 22301 require that DR program results be reported to senior leadership and the board to ensure appropriate oversight of organizational resilience.
CISA Disaster Recovery Testing 5
An organization's DR plan calls for restoring systems from tape, but the most recent tape is three days old.
The BEST control to address this gap is: