CISA Domain 4B-5 Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain B-5 (Disaster Recovery Plans) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4B-5 Disaster Recovery Plans Practice Test 001

10 questions • Single best answer

Question 1

During a disaster recovery test at a regional bank, the IS auditor observes that critical applications were restored at the alternate site within the recovery time objective, but transaction data was recovered only up to the previous night's backup. Business units require near-zero data loss. Which finding is MOST significant?

A. The recovery point objective is not being met, exposing the bank to unacceptable transaction data loss. B. The recovery time objective was met, so the test should be considered fully successful. C. The alternate site may lack sufficient processing capacity to sustain peak transaction volumes throughout an extended recovery period. D. The nightly backup schedule should be changed to weekly to reduce storage costs.

Question 2

A government agency is selecting an alternate processing facility for its disaster recovery strategy. The agency must resume mission-critical citizen services within two hours of a disruption, and management wants to minimize recovery delay while controlling ongoing costs. Which type of recovery site BEST supports the two-hour recovery requirement?

A. A cold site, providing space and utilities but requiring hardware installation and configuration. B. A warm site, offering partial equipment and connectivity that still requires data restoration and configuration before operations can resume. C. A hot site, fully equipped and continuously synchronized, enabling recovery within the required timeframe. D. A reciprocal agreement, relying on another agency's spare capacity during the disruption.

Question 3

An IS auditor reviewing a hospital's disaster recovery plan finds that the document identifies recovery teams and procedures but does not specify the sequence in which systems should be restored. Several interdependent clinical applications exist, and restoring them out of order could corrupt data. What is the auditor's BEST recommendation?

A. Increase the frequency of full and incremental data backups across all clinical systems to reduce potential data loss. B. Define a system recovery priority sequence based on criticality and interdependencies. C. Assign additional staff to the recovery teams to accelerate restoration. D. Relocate the alternate processing site closer to the primary facility.

Question 4

An organization wants to validate its disaster recovery plan without disrupting live production systems. Management seeks reasonable assurance that recovery procedures work and that the alternate site can actually process transactions, while avoiding any impact on ongoing operations. Which disaster recovery testing approach BEST meets this objective?

A. A full interruption test, where production processing is shut down entirely and all operations are shifted to the recovery site. B. A structured walkthrough, where the recovery team reviews the plan in a meeting. C. A checklist review, where responsible parties confirm required resources are available. D. A parallel test, where recovery systems process transactions alongside production without taking over.

Question 5

During a review of a company's disaster recovery plan, the IS auditor notes that recovery time objectives were defined by the IT department without input from business process owners. Some critical business functions may have shorter tolerances than the current RTOs. Which finding is MOST significant?

A. RTOs were set without business input, so they may not reflect actual business recovery requirements. B. The IT department lacks the technical expertise to define recovery time objectives. C. The plan should also define recovery point objectives for each critical system. D. Business process owners, rather than the IT department, should be made responsible for executing the documented recovery procedures.

Question 6

An IS auditor finds that an organization's disaster recovery plan is comprehensive and well documented but has never been tested since it was written two years ago. The IT environment has changed considerably since then. What should the IS auditor be MOST concerned about regarding the plan?

A. The plan should be reformatted to comply with the latest documentation standards. B. The plan was written by internal IT staff rather than an external consultant. C. The untested plan may fail during an actual disaster because its effectiveness is unverified. D. The plan does not include a detailed budget for recovery operations.

Question 7

During a regulatory examination, an IS auditor wants to determine whether a payment processor can actually recover its critical systems within the stated recovery time objective following a major disruption. Which of the following would provide the BEST evidence that the recovery time objective can be met?

A. The documented disaster recovery plan approved by senior management. B. Results of a recent full recovery test showing systems restored within the RTO. C. Interviews confirming that recovery team members understand their assigned roles. D. A service level agreement with the alternate site provider specifying the RTO.

Question 8

An IS auditor reviewing a disaster recovery arrangement finds that the organization's alternate processing site is located in the same industrial park as the primary data center, approximately two kilometers away. Both facilities draw power from the same regional substation. Which finding is MOST significant?

A. The two-kilometer distance increases network latency between the two sites. B. The alternate site may have insufficient physical security controls in place. C. The organization should negotiate a lower lease cost for the nearby facility. D. The alternate site shares regional risks with the primary, so one event could disable both.

Question 9

A recent disaster recovery test at an insurance company failed because several server configurations at the recovery site did not match those in production, preventing critical applications from starting. Management attributed this to recent unlogged production changes. What is the auditor's BEST recommendation to prevent recurrence?

A. Integrate the recovery site into the organization's change and configuration management process. B. Increase the frequency of disaster recovery testing to twice per year. C. Replace the recovery site hardware with newer, identical equipment. D. Assign additional staff to manually verify configurations before each test.

Question 10

An IS auditor is evaluating the data recovery component of a disaster recovery plan. Backups are performed nightly and stored on-site, with copies shipped to an offsite vault weekly. The organization's recovery point objective is four hours, but backups run only once daily. Which conclusion is MOST appropriate?

A. The weekly offsite rotation fully satisfies the four-hour recovery point objective. B. On-site backup storage is the most significant weakness in the recovery strategy. C. The nightly backup frequency cannot meet the four-hour RPO, risking data loss beyond tolerance. D. The recovery point objective should be lengthened to match the current backup schedule.

Related Posts

Leave a Comment Cancel Reply