Disaster Recovery Testing Flashcards
7 cards from real CISA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Disaster Recovery Testing flashcards as text
A company's DR test reveals that the recovery site network bandwidth is insufficient for peak transaction volumes. This finding MOST likely indicates a gap in:
Answer: Capacity planning for the recovery environment
Insufficient bandwidth at the recovery site is a capacity planning failure; the recovery environment must be sized to handle actual production workloads.
Which party should APPROVE the final DR test plan before testing begins?
Answer: Senior management or the steering committee
Senior management or the steering committee must approve DR test plans to ensure organizational alignment, resource commitment, and accountability.
During a DR test, the team successfully restores data but discovers the restored database is missing two hours of transactions. Which control failure does this MOST directly indicate?
Answer: Replication or backup frequency not meeting the RPO
Missing two hours of transactions means the backup or replication interval was too long, causing the RPO to be exceeded.
An IS auditor notes that DR tests are only conducted by the IT department without business unit participation. The GREATEST risk of this approach is:
Answer: Failure to validate recovery of business processes, not just technical systems
Without business unit involvement, DR tests may confirm technical recovery but miss whether business processes, workflows, and outputs are actually restored correctly.
Which of the following is the BEST evidence that a DR test was successful from an IS audit perspective?
Answer: Recovery objectives were met and results were documented and signed off by management
Documented results showing that RTOs and RPOs were achieved, with formal management sign-off, provide the most auditable evidence of test success.
A cold site differs from a warm or hot site in that it:
Answer: Provides only physical space and basic utilities, requiring equipment to be installed before use
A cold site provides the physical facility but no pre-installed hardware or software, requiring the organization to procure and configure equipment after declaring a disaster.
When an IS auditor reviews the frequency of DR tests, the MOST appropriate benchmark is that tests should be conducted:
Answer: Based on the criticality of systems and regulatory or contractual requirements
DR test frequency should be driven by business criticality, regulatory mandates (e.g., SOX, HIPAA), and the rate of change in the IT environment.