CISA Domain 4B-1 Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain B-1 (Business Impact Analysis) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4B-1 Business Impact Analysis Practice Test 001

10 questions • Single best answer

Question 1

During a business continuity audit at a global logistics company, the IS auditor finds the business impact analysis was prepared solely by IT staff without input from business process owners. Recovery time objectives were derived from historical system uptime statistics rather than the criticality of business functions. Which finding is MOST significant?

A. The BIA does not document the detailed technical recovery procedures and configuration steps for each supporting application and database server. B. Recovery time objectives were based on system uptime data instead of business function criticality determined by process owners. C. The BIA was not independently reviewed by the external audit firm before management approval. D. The BIA did not include a cost-benefit analysis of alternate recovery site options.

Question 2

A financial services firm's business impact analysis assigns its online payment platform a recovery point objective of four hours, but the IS auditor observes that database backups run only once every 24 hours and no near-real-time transaction log replication is configured for the platform. Which conclusion is MOST appropriate?

A. The recovery point objective is met because daily backups preserve all committed transactions. B. The backup schedule is adequate because the recovery time objective, rather than the recovery point objective, is what governs how data restoration is performed. C. The current backup frequency cannot meet the defined recovery point objective, exposing the firm to data loss beyond tolerance. D. The recovery point objective is irrelevant because the payment platform operates in real time.

Question 3

An audit manager reviews the deliverables of a newly completed business impact analysis at a hospital network. The document lists external threats, their likelihood, and recommended safeguards, but does not quantify the operational impact of downtime for each clinical function. Which conclusion is MOST appropriate?

A. The deliverable resembles a risk assessment and does not fulfill the core purpose of a BIA, which is to quantify downtime impact. B. The BIA is complete because identifying threats and safeguards is its primary objective. C. The BIA is adequate provided the safeguards reduce the likelihood of each identified threat. D. The BIA meets requirements since the quantification of downtime impact is performed later during disaster recovery testing and recovery plan validation exercises.

Question 4

A manufacturing company is developing its first business continuity program. The steering committee asks the IS auditor which activity should be completed FIRST to establish recovery priorities, noting that several departments have already requested that their own systems be designated as most critical. What should be done FIRST?

A. Purchase and provision an alternate processing site sized to accommodate all of the departments that have requested to be treated as most critical. B. Assign recovery priorities based on each department's stated importance. C. Develop disaster recovery procedures for the systems the departments identified. D. Perform a business impact analysis to determine each function's criticality and downtime tolerance objectively.

Question 5

During a business impact analysis review at an insurance provider, the IS auditor finds that each business unit assessed its critical processes independently and set recovery objectives in isolation. Upstream and downstream dependencies between the claims, underwriting, and billing systems were not documented in the consolidated analysis. Which risk is MOST significant?

A. Each business unit will duplicate its recovery documentation, increasing administrative overhead across the units. B. Recovery sequencing may fail because a restored process could depend on another process that remains unavailable. C. The BIA will take longer to complete because the units performed their assessments separately. D. Business units may disagree over which department owns the recovery budget for shared systems.

Question 6

A business continuity audit at an e-commerce retailer reveals that the recovery time objective for the order-fulfillment system exceeds the maximum tolerable downtime the business defined for that process. Management states the recovery time objective was set by the IT recovery team. What is the IS auditor's BEST course of action?

A. Conclude the recovery time objective is acceptable because the IT recovery team is responsible for setting it. B. Recommend shortening the maximum tolerable downtime so that it matches the current recovery time objective. C. Report the finding, because a recovery time objective exceeding the maximum tolerable downtime means recovery would not restore operations in time to avoid unacceptable impact. D. Take no action because recovery time objective and maximum tolerable downtime are independent metrics.

Question 7

An IS auditor examines the business impact analysis at a regional bank that migrated its core banking platform to a cloud provider 18 months ago. The BIA still reflects the legacy on-premises architecture and its recovery objectives, and it has not been reviewed since the migration. Which finding is MOST significant?

A. The BIA no longer reflects the current environment, so recovery priorities and objectives may rest on outdated assumptions. B. The BIA should have been performed by the cloud provider rather than by the bank itself. C. The migration eliminated the need for a BIA because cloud services are inherently resilient. D. The BIA is acceptable because recovery objectives rarely change following a platform migration.

Question 8

An IS auditor is assessing whether the recovery time objectives documented in a utility company's business impact analysis are achievable rather than aspirational. Several objectives are shorter than any recovery the organization has previously demonstrated. Which of the following would provide the BEST evidence that the objectives are realistic?

A. A signed management attestation confirming that the recovery time objectives are appropriate. B. The BIA report showing the recovery time objectives were approved by the steering committee. C. Vendor marketing documentation stating the recovery capabilities of the backup solution. D. Results of recovery tests showing systems were restored within the documented recovery time objectives.

Question 9

During a business impact analysis at a government benefits agency, impacts of process disruption are recorded only as financial loss estimates. The IS auditor notes that reputational harm, statutory service obligations, and citizen safety impacts were excluded from the criteria used to rank process criticality. Which recommendation is MOST appropriate?

A. Remove the financial loss estimates because qualitative impacts are inherently more reliable. B. Expand the impact criteria to include non-financial factors so criticality reflects all relevant consequences. C. Defer the analysis until precise monetary values for reputational harm can be calculated. D. Base recovery priorities solely on the largest financial loss estimates already recorded in the analysis for each of the affected business processes.

Question 10

A newly appointed audit committee asks whether the organization's disaster recovery strategy is appropriately prioritized. The IS auditor finds recovery plans were built directly from IT's assessment of system value, with no business impact analysis performed to establish business-driven recovery priorities. Which conclusion is MOST appropriate?

A. The recovery strategy is sound because IT is best positioned to value the organization's systems. B. Recovery priorities may not align with business needs because the BIA that should drive them was never performed. C. The absence of a BIA is acceptable provided the disaster recovery tests complete successfully. D. The audit committee should approve the recovery plans before a BIA is considered.

Related Posts

Leave a Comment Cancel Reply