Business Continuity Planning Flashcards
7 cards from real CISA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Business Continuity Planning flashcards as text
Which of the following is the CORRECT sequence for developing a Business Continuity Plan?
Answer: Risk Assessment → BIA → Plan Development → Test
Risk assessment identifies threats, BIA quantifies their impact, plan development addresses the findings, and testing validates the plan.
A reciprocal agreement for disaster recovery is BEST described as:
Answer: An arrangement between two organizations to use each other's facilities during a disaster
Reciprocal agreements allow two organizations to use each other's facilities in a disaster, though compatibility and capacity can be concerns.
The Maximum Tolerable Downtime (MTD) for a critical process is 4 hours. The RTO is set at 6 hours. This situation indicates:
Answer: The RTO exceeds MTD, meaning recovery may not happen before unacceptable damage occurs
The RTO must always be less than or equal to the MTD; an RTO greater than MTD means the system may not be restored before irreversible damage occurs.
During a BCP test, an organization discovers its backup tapes contain corrupted data. What control failure does this PRIMARILY represent?
Answer: Failure to validate backup integrity through regular restoration testing
Backups must be regularly tested through actual restoration to verify data integrity; storing backups without testing them is a critical control gap.
Which of the following BEST supports an organization's ability to meet a very aggressive RPO of near zero?
Answer: Synchronous data replication to a secondary site
Synchronous replication writes data to both primary and secondary sites simultaneously, achieving near-zero RPO.
An IS auditor is reviewing crisis communication procedures in a BCP. Which finding is MOST critical?
Answer: There is no designated spokesperson authorized to communicate with the media and stakeholders
Without a designated spokesperson, inconsistent or unauthorized communications during a crisis can cause legal liability and reputational damage.
A parallel test of the business continuity plan is conducted. Which statement BEST describes this type of test?
Answer: Recovery systems are activated at the alternate site while primary operations continue normally
In a parallel test, the backup site is activated and processes data while the primary site continues to operate, validating recovery capability without operational risk.