Disaster Recovery Testing Flashcards
7 cards from real CISA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Disaster Recovery Testing flashcards as text
An IS auditor finds that a company's DR plan has never been tested. What is the PRIMARY risk this creates?
Answer: Unknown gaps between documented procedures and actual recovery capability
Without testing, the organization cannot know whether recovery procedures will actually work, leaving critical gaps undetected until an actual disaster occurs.
Which statement BEST describes the purpose of a hot site in DR testing?
Answer: It is a fully equipped facility that can take over operations immediately
A hot site is a fully operational facility with hardware, software, and network connectivity pre-configured to assume production operations with minimal delay.
During DR test evaluation, an IS auditor should PRIMARILY assess whether:
Answer: Recovery objectives defined in the BCP were actually achieved
The core audit criterion is whether the test demonstrated the organization can meet its defined RTOs and RPOs, validating the effectiveness of the BCP.
A company uses a warm site for disaster recovery. Compared to a hot site, what is the PRIMARY trade-off?
Answer: Lower cost but longer recovery time
Warm sites have some pre-installed equipment and partial configurations, making them less expensive than hot sites but requiring additional setup time before operations can resume.
Which DR test metric measures the total time an organization can tolerate being without a critical system before suffering unacceptable business impact?
Answer: Maximum Tolerable Downtime
Maximum Tolerable Downtime (MTD) is the upper threshold of acceptable downtime; the RTO must always be less than the MTD.
An IS auditor recommends that DR test scenarios should include which of the following to be MOST effective?
Answer: A variety of realistic, risk-based scenarios including partial and full failures
Effective DR tests use diverse, realistic scenarios based on actual risk assessments, including partial outages, to surface a wider range of gaps.
After a DR test, which document should be updated FIRST to reflect lessons learned?
Answer: The disaster recovery plan
Lessons learned from DR tests must be incorporated directly into the DR plan to improve future recovery capability before the next incident or test.