CISA - Certified Information Systems Auditor Business Continuity Planning Questions and Answers — Questions and Answers
Question 1: An IS auditor is reviewing an organization's business continuity plan (BCP). The Business Impact Analysis (BIA) identifies a critical sales processing system with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 15 minutes. Which of the following is the MOST appropriate recovery strategy for this system?
- Daily tape backups stored at an off-site facility.
- A cold site with hardware available for installation.
- Electronic vaulting to a remote location every 2 hours.
- High-availability system with data replication. (Correct answer)
Correct answer: High-availability system with data replication.
A high-availability system with data replication is the only option that can meet the stringent RTO of 4 hours and RPO of 15 minutes. Data replication ensures that data loss is minimal (meeting the RPO), and a high-availability setup allows for rapid failover (meeting the RTO). Tape backups, a cold site, and bi-hourly electronic vaulting would not be able to restore service or data within the required timeframes.
Question 2: What is the PRIMARY output of the Business Impact Analysis (BIA) phase in the business continuity planning process?
- A list of emergency contact information for all key personnel.
- The selection of an off-site recovery facility.
- A prioritization of critical business processes and their recovery time objectives. (Correct answer)
- A detailed procedure for restoring the IT data center.
Correct answer: A prioritization of critical business processes and their recovery time objectives.
The primary purpose of a Business Impact Analysis (BIA) is to identify the organization's critical business processes and determine the impact a disruption would have on them. This analysis results in a prioritized list of these processes and the establishment of Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for each, which guides the rest of the BCP strategy.
Question 3: An organization conducts a business continuity test where key team members gather in a conference room to discuss their roles and responsibilities in response to a simulated disaster scenario presented by a facilitator. Which type of test does this scenario describe?
- Full interruption test
- Parallel test
- Tabletop exercise (Correct answer)
- Walk-through test
Correct answer: Tabletop exercise
This scenario describes a tabletop exercise. A tabletop exercise is a discussion-based session where team members review and discuss their roles and responses to a particular emergency situation, without any actual activation of recovery systems. It's used to validate plans and confirm team members' understanding of their roles.
Question 4: During a review of a company's business continuity plan, an IS auditor notes that the plan has not been updated in over three years, despite significant changes in business processes and IT infrastructure. Which of the following is the GREATEST risk associated with this finding?
- The plan may not comply with outdated regulatory requirements.
- The cost of maintaining the outdated plan is wasted.
- The plan may be ineffective in recovering critical operations after a disruption. (Correct answer)
- New employees may not be aware of the plan's existence.
Correct answer: The plan may be ineffective in recovering critical operations after a disruption.
The greatest risk is that the plan is no longer aligned with the current business environment and will fail when executed. Business processes, technology, and personnel change over time, and a BCP must be regularly updated and tested to ensure it remains relevant and effective for recovering the organization's critical functions.
Question 5: Which of the following BEST defines the Recovery Point Objective (RPO)?
- The time required to restore a system to full operation after a failure.
- The maximum amount of data loss an organization can tolerate, measured in time. (Correct answer)
- The point in time when the business declares a disaster.
- The minimum frequency for testing the disaster recovery plan.
Correct answer: The maximum amount of data loss an organization can tolerate, measured in time.
The Recovery Point Objective (RPO) is a measure of the maximum acceptable amount of data loss after a disruptive event. It's measured in time and looks backward from the moment of disruption to the last successful data backup or replication point. For example, an RPO of one hour means the organization can tolerate losing up to one hour of data.
Question 6: An IS auditor is evaluating the business continuity preparedness of a large financial institution. Which of the following provides the MOST assurance that the business continuity plan (BCP) is effective and will function as intended in a real disaster?
- Annual review and approval of the BCP by senior management.
- A recent, successful tabletop exercise with key stakeholders.
- A comprehensive business impact analysis (BIA) that is updated quarterly.
- A full-scale interruption test conducted at the alternate processing site. (Correct answer)
Correct answer: A full-scale interruption test conducted at the alternate processing site.
A full-scale interruption test, where actual operations are failed over to the alternate site, provides the highest level of assurance that the BCP is effective. This type of test validates not just the documentation and the team's understanding (like a tabletop), but also the technical capabilities, procedures, and personnel readiness in a simulated real-world scenario.
CISA - Certified Information Systems Auditor Business Continuity Planning Questions and Answers
An IS auditor is reviewing an organization's business continuity plan (BCP).
The Business Impact Analysis (BIA) identifies a critical sales processing system with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 15 minutes.
Which of the following is the MOST appropriate recovery strategy for this system?