CISA Domain 4B-3 Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain B-3 (Data Backup, Storage, and Restoration) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4B-3 Data Backup, Storage, and Restoration Practice Test 001

10 questions • Single best answer

Question 1

During an audit of a regional hospital's clinical systems backup program, the IS auditor observes that nightly backups complete successfully and monitoring logs show no errors. However, restoration from backup media has never been tested, and no recovery time objective has been formally defined. Which finding is MOST significant?

A. Backup monitoring logs are reviewed but not signed off by management. B. The recovery time objective has not been formally documented by IT. C. Backups have never been restore-tested, so recoverability cannot be assured. D. Backup jobs run nightly rather than in real time for clinical systems.

Question 2

A manufacturing firm performs a full backup of its ERP database every Sunday night and takes no additional backups during the week. Management states that the agreed recovery point objective for the ERP system is four hours. The IS auditor is evaluating backup frequency. Which conclusion is MOST appropriate?

A. Backup frequency cannot meet the four-hour RPO and must be increased. B. Weekly full backups are sufficient because they capture all ERP data. C. The RPO should be relaxed to match the current weekly backup schedule. D. Backups should be switched to differential mode to satisfy the RPO.

Question 3

An IS auditor at a financial services company finds that all production backups are stored on the same storage array that hosts the primary data, replicated to a second volume in the same data center. No copies are kept offsite or offline. Which risk is of GREATEST concern?

A. Storage array performance may degrade when backups and production coexist. B. Backup replication between volumes may increase storage licensing costs. C. A site-wide event or ransomware could destroy primary and backup data together. D. Restoration from a second volume may take longer than from tape media.

Question 4

During a review of an insurer's backup process, the IS auditor notes that backup tapes containing customer financial records are transported to an offsite vault by a third-party courier. The tapes themselves are not encrypted, though the courier maintains chain-of-custody logs. Which recommendation is MOST appropriate?

A. Encrypt backup media so data remains protected if tapes are lost or stolen. B. Require the courier to sign a stronger confidentiality and liability agreement. C. Reduce transport frequency to limit the exposure window during transit. D. Store an additional unencrypted copy in the primary data center for backup.

Question 5

An IS auditor wants assurance that a government agency can actually recover its case-management database from backups following a failure. Management provides successful backup completion reports and a documented restoration procedure signed by the operations manager. Which of the following would provide the BEST evidence of recoverability?

A. Reviewing the signed restoration procedure for completeness and approval. B. Confirming that backup completion reports show no errors over time. C. Interviewing operations staff about how restorations are normally performed. D. Observing a test restoration of the database to a validated, usable state.

Question 6

A retailer's IT department overwrites all backup media on a 30-day rotation to reduce storage costs, and no long-term archival copies are produced. The IS auditor notes that applicable regulations require certain financial transaction records to be retained for seven years. Which finding is MOST significant?

A. Overwriting media every 30 days accelerates physical wear on the tapes. B. The retention schedule cannot satisfy the seven-year regulatory requirement. C. Backup rotation decisions were made by IT rather than by data owners. D. Archival copies would increase offsite storage and handling costs.

Question 7

A SaaS-based HR platform is used to store employee records. During an audit, management assumes the cloud provider automatically backs up all data and can restore it on request, though no contractual terms have been verified. The IS auditor is evaluating backup coverage. What should the auditor do FIRST?

A. Review the service agreement to confirm backup and restoration responsibilities. B. Recommend the organization implement its own independent backup solution. C. Test a restoration by asking the provider to recover a sample record. D. Report that backups are adequate because the provider is a major vendor.

Question 8

An IS auditor examines a bank's backup operations and finds that backup jobs are scheduled and generate completion emails, but no one verifies whether the emails indicate success or failure. Several recent jobs failed silently and went unnoticed for weeks. Which control weakness is MOST significant?

A. Completion notifications are sent by email rather than through a dashboard. B. Backup jobs are automated on a schedule rather than triggered manually. C. Backup job outcomes are not monitored, so failures go undetected. D. The bank retains backup completion emails instead of formal reports.

Question 9

A logistics company uses incremental backups every weekday and a full backup each weekend. Following a Thursday failure, restoration required the last full backup plus every intervening incremental, extending recovery well beyond the RTO. The IS auditor is assessing the backup strategy. Which recommendation is MOST appropriate?

A. Adopt differential backups to reduce the number of sets needed to restore. B. Increase the frequency of incremental backups to every few hours instead. C. Retain incremental backups longer so more restore points are available. D. Replace weekend full backups with additional weekday incremental backups.

Question 10

After a ransomware incident, an enterprise discovered that its online backups were encrypted by the attacker along with production systems because both were reachable from the same network. The IS auditor is recommending improvements. Which control would BEST protect backup data from a similar attack?

A. Encrypt all backups so attackers cannot read the recovered data. B. Increase backup frequency to shorten the recovery point objective. C. Store additional online backup copies on a separate production server. D. Maintain immutable or air-gapped backup copies isolated from production networks.

Related Posts

Leave a Comment Cancel Reply