CISA Domain 4B-4 Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain B-4 (Business Continuity Plan) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4B-4 Business Continuity Plan Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor is reviewing the business continuity plan of a global manufacturing firm following a recent internal audit request. The plan lists recovery procedures and staff contact lists but was last updated three years ago, before a major corporate reorganization and two business acquisitions were completed. Which finding is MOST significant?

A. The staff contact lists still include personal mobile phone numbers for several former employees. B. The plan does not reflect the newly acquired entities or the reorganized business units. C. The plan is maintained only in electronic form rather than in printed copies. D. The plan does not include a standardized page-numbering convention throughout.

Question 2

An IS auditor finds that a commercial bank's business continuity plan assigns recovery priorities to business processes, but these priorities were established by IT staff without reference to any business impact analysis. Senior management approved the plan without independent review. What should the IS auditor recommend FIRST?

A. Recommend that a business impact analysis be performed to establish and validate recovery priorities. B. Recommend that recovery priorities be reviewed and approved by the IT steering committee. C. Recommend that the existing recovery priorities be tested more frequently each year. D. Recommend that the recovery procedures be documented in greater technical detail.

Question 3

During a business continuity audit at an insurance company, the IS auditor learns that the BCP has been validated only through annual tabletop walkthroughs. Management states the plan is fully reliable because these walkthroughs have consistently passed without any issues. Which conclusion is MOST appropriate?

A. The plan is adequately validated and requires no additional testing at this time. B. Tabletop walkthroughs provide the strongest available assurance of recovery capability. C. Tabletop walkthroughs do not confirm that recovery procedures will actually function under real disruption conditions. D. Testing frequency should be reduced because the walkthroughs have consistently passed.

Question 4

An IS auditor begins an engagement to evaluate whether an e-commerce company can continue operations after a significant disruption. Management provides a lengthy BCP document, prior incident logs, and several test result summaries for the auditor to review. What should the IS auditor do FIRST?

A. Identify the organization's critical business processes and their defined recovery requirements. B. Immediately test the failover of the production web servers to the backup site. C. Recommend that additional backup infrastructure be purchased before the audit proceeds. D. Review individual employee job descriptions for completeness and accuracy.

Question 5

A business continuity audit at a telecommunications provider reveals a comprehensive and up-to-date BCP. However, most operational staff are unaware that the plan exists, and several key recovery roles have never been formally assigned to named individuals across the organization. Which finding represents the GREATEST risk?

A. The plan document exceeds one hundred pages in its total length. B. Recovery roles have not been assigned to named individuals, so the plan cannot be executed reliably. C. The plan is reviewed annually rather than on a semi-annual basis. D. The plan is stored on the corporate intranet rather than a shared drive.

Question 6

An IS auditor wants to conclude on whether a national retailer's business continuity plan will actually function during a real disruption. The auditor has access to several types of documentation and test artifacts. Which of the following provides the BEST evidence of the plan's effectiveness?

A. Management's signed written attestation confirming that the plan is fully adequate and complete for recovery. B. The version-control history showing the plan has been updated regularly. C. The number of employees who have received a printed copy of the plan. D. Results of a recent full-interruption or simulation test of the continuity plan.

Question 7

During an audit, the IS auditor notes that a utility company's business continuity program has no assigned executive owner, and plan updates occur only when individual managers happen to volunteer changes. As a result, the plan is inconsistently maintained over time. Which recommendation is MOST appropriate?

A. Assign clear executive ownership and accountability for maintaining the continuity program. B. Require each department manager to sign the plan on an annual basis. C. Move the plan to a cloud storage location so that staff can more easily access it during an event. D. Expand the plan with additional pages of detailed recovery steps.

Question 8

An IS auditor reviews a financial services firm's recovery documentation and finds a detailed IT disaster recovery plan that restores servers within four hours. However, there is no plan describing how business units will continue to operate during that recovery window. Which finding is MOST significant?

A. The disaster recovery plan restores servers within four hours rather than within the two-hour target window. B. The disaster recovery plan is maintained solely by the IT department in isolation. C. Business continuity procedures for sustaining operations during the recovery window are absent. D. The recovery documentation is stored within a single central repository location.

Question 9

An IS auditor is assessing the reliability of a logistics company's BCP. The plan appears thorough and well organized, but the auditor wants to determine whether it accurately reflects the current operating environment. Which review procedure would provide the BEST assurance that the plan is current?

A. Confirm that the plan document displays a recent revision date printed clearly on its front cover page. B. Compare the plan's recovery assumptions against recent changes in systems, staffing, and processes. C. Verify that the plan was approved by the board of directors at some point. D. Count the total number of business processes that are listed within the plan.

Question 10

Following a business continuity audit at a government agency, management agreed to remediate several gaps in its BCP within ninety days. The agreed remediation period has now fully elapsed, and a new reporting cycle has begun. What is the IS auditor's BEST course of action?

A. Close all of the audit findings on the basis that management has already formally agreed to remediate each of them. B. Issue a new audit report covering unrelated control areas instead. C. Re-perform the entire business continuity audit from the beginning. D. Perform follow-up to determine whether the agreed BCP remediation was implemented and is effective.

Related Posts

Leave a Comment Cancel Reply