CISA - Certified Information Systems Auditor Disaster Recovery Testing Questions and Answers — Questions and Answers
Question 1: An organization performs a disaster recovery test in which the alternate processing site is brought online and used to process non-critical transactions. Meanwhile, the primary site continues to handle the full production workload. Which type of disaster recovery test does this scenario describe?
- Simulation test
- Full interruption test
- Parallel test (Correct answer)
- Walkthrough test
Correct answer: Parallel test
A parallel test involves activating the disaster recovery facility and processing data in parallel with the primary site. This allows for testing of the recovery site's capabilities with a real workload without impacting the live production environment, which is exactly what the scenario describes.
Question 2: An IS auditor is reviewing the results of a recent disaster recovery test. The test report shows that while all systems were recovered, the time taken exceeded the Recovery Time Objective (RTO) by several hours. Which of the following is the MOST important recommendation for the auditor to make?
- Schedule more frequent disaster recovery tests.
- Update the disaster recovery plan to reflect the actual recovery time.
- Perform a root cause analysis of the delays and revise recovery procedures. (Correct answer)
- Increase the IT budget for more advanced recovery technologies.
Correct answer: Perform a root cause analysis of the delays and revise recovery procedures.
The primary goal of DR testing is to verify that recovery objectives, such as the RTO, can be met. When a test fails to meet the RTO, the most critical next step is to understand why the failure occurred. A root cause analysis will identify the specific bottlenecks or procedural flaws that caused the delay, allowing the organization to make targeted improvements to the recovery plan. Simply updating the plan to match the failed time (B) accepts failure, while recommending more tests (A) or more budget (D) without understanding the problem is premature.
Question 3: Which of the following provides the GREATEST assurance that a disaster recovery plan (DRP) will function as intended when required?
- A recent review and sign-off by senior management.
- A full interruption test conducted at the alternate site. (Correct answer)
- A comprehensive tabletop exercise with all key personnel.
- The use of a hot site with mirrored data.
Correct answer: A full interruption test conducted at the alternate site.
A full interruption test, also known as a full-scale test, is the most rigorous and realistic testing method. It involves shutting down the primary production environment and failing over completely to the recovery site. This type of test provides the highest level of assurance because it is the most accurate simulation of an actual disaster, validating that all components of the plan work together effectively in a real-world scenario.
Question 4: An IS auditor notes that a company's disaster recovery plan has not been tested since a major cloud migration project was completed one year ago. The PRIMARY risk associated with this finding is that the:
- employees may be unaware of their roles and responsibilities.
- DRP may not be aligned with the current technology infrastructure. (Correct answer)
- cost of a future test will be significantly higher.
- organization may be out of compliance with industry regulations.
Correct answer: DRP may not be aligned with the current technology infrastructure.
Disaster recovery plans must be tested regularly, especially after significant changes to the IT environment, such as a cloud migration. The primary risk of not testing after such a change is that the documented recovery procedures are likely outdated and will not work for the new infrastructure, rendering the plan ineffective in a real disaster.
Question 5: An organization is planning its annual disaster recovery testing strategy. Management is concerned about the high cost and potential business disruption of a full interruption test. Which type of test would be the BEST alternative to validate the technical recovery procedures with high assurance but minimal production impact?
- A walkthrough test
- A simulation test
- A parallel test (Correct answer)
- A checklist review
Correct answer: A parallel test
A parallel test provides a high degree of assurance by activating the recovery systems and processing real data or transactions, but it does so without taking the primary systems offline. This approach allows for thorough technical validation while avoiding the disruption and risk associated with a full interruption test, making it the best alternative in this scenario.
Question 6: During a review of disaster recovery test documentation, an IS auditor's PRIMARY objective is to verify that:
- all members of the recovery team participated in the test.
- the test was completed within the allocated budget.
- the test results were analyzed and the DRP was updated with lessons learned. (Correct answer)
- senior management was present to observe the test execution.
Correct answer: the test results were analyzed and the DRP was updated with lessons learned.
Disaster recovery testing is not a one-time event but an iterative process designed for continuous improvement. The primary objective from an audit perspective is to ensure that the organization learns from the test. This involves analyzing the results, identifying any weaknesses or discrepancies, and updating the disaster recovery plan (DRP) accordingly to enhance its effectiveness for future incidents.
CISA - Certified Information Systems Auditor Disaster Recovery Testing Questions and Answers
An organization performs a disaster recovery test in which the alternate processing site is brought online and used to process non-critical transactions.
Meanwhile, the primary site continues to handle the full production workload.
Which type of disaster recovery test does this scenario describe?