A company's BCP was last tested two years ago. Since then, the company migrated its customer database to a new cloud provider and changed its incident response team structure. Which of the following is the MOST appropriate action for the business continuity manager?

Update the BCP to reflect the new cloud provider and team structure, then conduct a tabletop exercise

Delay testing until the next scheduled annual review

Archive the old BCP and develop a new one from scratch

Conduct a full-scale exercise immediately to validate the current plan

A company's critical application is deployed on two servers in an active-active cluster. The application's RTO is 15 minutes. During a routine maintenance, one server is taken offline. Which of the following is the MOST significant risk?

The maintenance should have been performed during off-hours

The remaining server may not handle the full load, causing performance degradation

The application should have been deployed on three servers

The RTO cannot be met because the cluster is not fully redundant

Why is it important to regularly test data restoration procedures?

To improve the performance of production systems

To reduce the cost of backup storage

To comply with software licensing requirements

To verify that backups can be successfully restored and meet recovery objectives

A bank's core banking system is critical, and the BIA identified that a 1-hour outage could result in significant financial loss. The bank has implemented redundant servers and automated failover. Which of the following is the MOST important additional measure to ensure operational resilience?

Regularly testing the failover mechanism and updating the incident response plan

Increasing the number of backup tapes stored on-site

Delegating all recovery decisions to the IT help desk

Purchasing additional hardware for the primary site

A company's BIA determines that the order entry system has an MTD of 8 hours. The system's RTO is set at 6 hours, and the RPO is set at 4 hours. The backup strategy uses a full backup nightly and transaction log backups every 2 hours. Which of the following is the MOST significant risk?

The RTO is too close to the MTD, leaving little margin for error

The RPO of 4 hours is not achievable with transaction log backups every 2 hours

The backup strategy does not include off-site storage

The MTD should be less than the RTO

Certified Information Systems Auditor

Domain 4Objective 2

Business Resilience and Continuity CISA Practice Questions (Page 5)

Part of the Information Systems Operations and Business Resilience domain, which accounts for 26% of the CISA exam.

36questions here

8free pages

10concepts

26%of the exam

Questions 21–25

21application · medium
A company's BCP was last tested two years ago. Since then, the company migrated its customer database to a new cloud provider and changed its incident response team structure. Which of the following is the MOST appropriate action for the business continuity manager?
Select an answer first
22expert · hard
A company's critical application is deployed on two servers in an active-active cluster. The application's RTO is 15 minutes. During a routine maintenance, one server is taken offline. Which of the following is the MOST significant risk?
Select an answer first
23foundation · easy
Why is it important to regularly test data restoration procedures?
Select an answer first
24application · medium
A bank's core banking system is critical, and the BIA identified that a 1-hour outage could result in significant financial loss. The bank has implemented redundant servers and automated failover. Which of the following is the MOST important additional measure to ensure operational resilience?
Select an answer first
25expert · hard
A company's BIA determines that the order entry system has an MTD of 8 hours. The system's RTO is set at 6 hours, and the RPO is set at 4 hours. The backup strategy uses a full backup nightly and transaction log backups every 2 hours. Which of the following is the MOST significant risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.