CISA Disaster Recovery Testing 2 — Questions and Answers
Question 1: Which type of DR test involves actually switching operations to the recovery site and running production workloads from it?
- Tabletop exercise
- Parallel test
- Full interruption test (Correct answer)
- Structured walkthrough
Correct answer: Full interruption test
A full interruption test shuts down the primary site and moves all production operations to the recovery site, making it the most realistic but highest-risk test type.
Question 2: An IS auditor reviewing DR test results notes that the RTO was met but several critical transactions were lost. Which metric was NOT achieved?
- Recovery Time Objective
- Recovery Point Objective (Correct answer)
- Maximum Tolerable Downtime
- Mean Time to Repair
Correct answer: Recovery Point Objective
RPO defines the maximum acceptable data loss measured in time; lost transactions indicate the RPO was not met even though the system came back within the RTO.
Question 3: During a DR tabletop exercise, the team discovers the backup media restoration procedure references a tool no longer installed on recovery servers. This finding BEST illustrates the importance of:
- Offsite media rotation schedules
- Keeping DR documentation current with production changes (Correct answer)
- Encrypting backup media
- Testing during off-peak hours
Correct answer: Keeping DR documentation current with production changes
The gap between documented procedures and the actual recovery environment shows that DR documentation must be updated whenever production systems change.
Question 4: Which DR test approach allows both the primary and recovery sites to process transactions simultaneously to compare output accuracy?
- Full interruption test
- Parallel test (Correct answer)
- Checklist review
- Simulation test
Correct answer: Parallel test
A parallel test runs the recovery site alongside the primary site so outputs can be compared without interrupting live operations.
Question 5: When scheduling DR tests, the MOST important factor an IS auditor should verify is that tests are:
- Conducted only during weekends to minimize impact
- Approved by senior management and aligned with business risk (Correct answer)
- Limited to IT staff to avoid business disruption
- Performed at least once every five years
Correct answer: Approved by senior management and aligned with business risk
DR tests should have management approval and be scheduled based on business risk tolerance, criticality of systems, and regulatory requirements.
Question 6: After a successful DR test, which action is MOST critical before closing out the test?
- Archiving all test logs for ten years
- Returning all systems to the primary site and verifying normal operations (Correct answer)
- Publishing the test results on the company intranet
- Ordering new backup hardware
Correct answer: Returning all systems to the primary site and verifying normal operations
Restoring systems to the primary site and confirming normal operations ensures the recovery environment is reset and production integrity is maintained after the test.
Question 7: An organization conducts a DR simulation where team members respond to a hypothetical scenario without touching live systems. This is BEST described as a:
- Full interruption test
- Parallel test
- Tabletop exercise (Correct answer)
- Technical recovery test
Correct answer: Tabletop exercise
A tabletop exercise is a discussion-based session where participants walk through a disaster scenario verbally without activating recovery systems.
CISA Disaster Recovery Testing 2
Which type of DR test involves actually switching operations to the recovery site and running production workloads from it?