CISA Business Continuity Planning 2 — Questions and Answers
Question 1: Which metric defines the maximum amount of data an organization can afford to lose in a disaster, measured in time?
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO) (Correct answer)
- Maximum Tolerable Downtime (MTD)
- Mean Time to Repair (MTTR)
Correct answer: Recovery Point Objective (RPO)
RPO defines the point in time to which data must be recovered, representing the maximum acceptable data loss.
Question 2: A hot site differs from a warm site primarily because a hot site:
- Has hardware installed but no current data
- Is fully operational with real-time data replication (Correct answer)
- Requires 24-48 hours to become operational
- Is owned by a third-party vendor only
Correct answer: Is fully operational with real-time data replication
A hot site is fully equipped, staffed, and has mirrored data so it can assume operations almost immediately.
Question 3: During a BCP audit, an IS auditor finds that the organization has not updated its BCP in three years. What is the MOST significant risk?
- The plan may not reflect current business processes and systems (Correct answer)
- Executive management may not have signed off on the plan
- The plan may be stored in an insecure location
- The BCP may not include a communication tree
Correct answer: The plan may not reflect current business processes and systems
An outdated BCP may fail to account for changes in infrastructure, personnel, and critical processes, making it ineffective during a real disaster.
Question 4: Which of the following BEST describes the purpose of a Business Impact Analysis (BIA)?
- To identify the probability of each type of disaster occurring
- To document recovery procedures for critical systems
- To quantify the impact of disruptions and prioritize recovery of critical functions (Correct answer)
- To test the effectiveness of existing backup procedures
Correct answer: To quantify the impact of disruptions and prioritize recovery of critical functions
A BIA quantifies financial and operational impacts of disruptions and prioritizes which functions must be restored first.
Question 5: An organization's BCP team is conducting an emergency response exercise. Which type of test involves actually moving operations to the recovery site?
- Tabletop exercise
- Parallel test
- Full interruption test (Correct answer)
- Checklist review
Correct answer: Full interruption test
A full interruption test shuts down primary operations and transfers them to the recovery site, providing the most realistic but disruptive test.
Question 6: Which element is MOST critical to include in a business continuity plan for an organization that relies heavily on third-party vendors?
- Vendor contact lists only
- Third-party vendor continuity and resilience requirements (Correct answer)
- A list of alternative vendors with no contract in place
- Vendor financial ratings
Correct answer: Third-party vendor continuity and resilience requirements
Organizations must ensure third-party vendors have adequate continuity plans and contractual obligations to support recovery objectives.
Question 7: When auditing a disaster recovery plan, which finding would be of GREATEST concern to an IS auditor?
- The DRP has not been tested in the past 18 months
- The DRP is stored only at the primary site (Correct answer)
- Recovery procedures are documented but not assigned to specific personnel
- The DRP does not include a budget estimate for recovery
Correct answer: The DRP is stored only at the primary site
A DRP stored only at the primary site would be inaccessible in a disaster that destroys or cuts off access to that location.
CISA Business Continuity Planning 2
Which metric defines the maximum amount of data an organization can afford to lose in a disaster, measured in time?