CISA Domain 4B Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain B (Business Resilience) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA Practice Test — 4B (Business Resilience)

10 questions • Single best answer

Question 1

A business continuity audit at a regional hospital reveals that the business impact analysis was last updated three years ago, before several clinical systems were migrated to a new electronic health record platform. Recovery time objectives still reference the retired legacy applications. Which of the following should be the auditor's MOST significant concern?

A. The recovery time objectives no longer reflect the criticality and dependencies of the current clinical systems, weakening recovery planning. B. The business impact analysis was not independently reviewed by external auditors during the system migration. C. The hospital has not purchased additional backup hardware for the new electronic health record platform. D. The legacy applications were decommissioned without formally notifying the internal audit team.

Question 2

During an audit of a financial services firm's data backup program, the IS auditor wants to confirm that critical databases can actually be recovered within stated objectives. Backup completion logs consistently show successful nightly jobs. Which of the following would provide the BEST evidence that the firm's recovery capabilities are effective?

A. Documentation confirming that scheduled backup jobs completed each night without any reported errors. B. Results of a recent restoration test showing the databases were recovered within the defined RTO. C. A signed policy statement requiring daily backups of all production database servers. D. Confirmation that backup media are routinely rotated to a secure offsite storage location.

Question 3

An audit of a government agency's disaster recovery plan finds that it documents detailed recovery procedures but has never been tested since it was approved two years ago. During that period, the designated recovery site was substantially reconfigured. Which of the following findings is MOST significant?

A. The plan does not list current contact details for the third-party recovery vendor. B. The plan was approved by IT management rather than by the agency's governing board. C. The plan has not been distributed in printed form to all agency personnel. D. The plan has never been tested, so there is no assurance it will actually work against the reconfigured recovery site.

Question 4

A manufacturing company is developing its business continuity program and has engaged the IS auditor for guidance. Management wants to prioritize recovery investments across dozens of interdependent business processes but lacks a structured basis for doing so. Which of the following should be performed FIRST to support these decisions?

A. Select and contract a hot site recovery provider to support the organization's most visible customer-facing operations. B. Conduct a business impact analysis to identify critical processes and their recovery requirements. C. Draft detailed disaster recovery procedures for each major production system. D. Schedule a full-interruption test of the organization's existing continuity arrangements.

Question 5

A cloud migration review at an e-commerce provider identifies that the customer-facing platform runs in a single availability zone with no automated failover. Management states that verified daily backups are sufficient to meet its resilience goals. Which of the following best supports the auditor's conclusion that operational resilience is inadequate?

A. Backup copies are stored within the same availability zone as the production platform. B. The platform lacks documented user acceptance testing for its most recent releases. C. A single-zone design with no failover means a zone outage would cause prolonged downtime despite backups being available. D. The provider has not published a formal capacity management plan for peak shopping seasons.

Question 6

During a data backup audit at an insurance company, the IS auditor notes that full backups are performed nightly and verified, but all backup media remain in a fireproof cabinet within the same data center. Management considers this arrangement adequate. Which of the following is the auditor's MOST appropriate recommendation?

A. Store backup copies at a geographically separate offsite location to protect against site-wide events. B. Increase the frequency of full backups from nightly to hourly across all critical and non-critical production systems. C. Encrypt the backup media before placing them into the on-site fireproof cabinet. D. Replace the fireproof cabinet with a higher-rated fire suppression system.

Question 7

An IS auditor is evaluating the backup strategy for a bank's core transaction processing system. The business has defined a recovery point objective of 15 minutes, but backups of the transaction database are taken only once every 24 hours. Which of the following conclusions is MOST appropriate?

A. The backup strategy exceeds requirements because daily full backups reflect a common industry norm. B. The recovery point objective is unrealistic and should simply be relaxed to match the current schedule. C. The current backup frequency cannot meet the RPO, exposing the bank to up to 24 hours of data loss. D. The gap is acceptable as long as the system's recovery time objective is being consistently met.

Question 8

A business resilience audit at a telecommunications firm reviews the disaster recovery testing approach. The organization has only ever performed checklist and walkthrough reviews of its recovery plan. Management asks which testing method would provide the strongest assurance that recovery will actually succeed. Which of the following should the auditor recommend?

A. A structured walkthrough involving all recovery team members and key stakeholders. B. A tabletop exercise simulating a regional outage scenario with senior management. C. A paper-based review of the recovery procedures by the disaster recovery coordinator. D. A full-interruption test that fails over production workloads to the recovery site.

Question 9

An internal audit team reviewing a logistics company's business continuity plan finds it comprehensive and well-structured. However, the organization has undergone two acquisitions and a major headquarters relocation in the past year, none of which are reflected in the plan. Which of the following findings should the auditor report as MOST significant?

A. The plan does not include a glossary defining the specialized business continuity and disaster recovery terminology used throughout the document. B. The plan is outdated and no longer reflects the organization's current structure and facility locations. C. The plan was formatted inconsistently with the organization's standard document template. D. The plan does not reference the specific brand of backup software currently in use.

Question 10

A post-implementation review of a new ERP system at a utility company finds that the disaster recovery plan addresses the ERP application servers but omits the interfaced middleware and database services on which the ERP depends. Which of the following is the auditor's MOST significant concern?

A. Recovering the ERP application without its dependent middleware and databases would fail to restore full business functionality. B. The disaster recovery plan does not specify the vendor support hotline for the ERP software. C. The middleware components were licensed separately from the core ERP application modules. D. The database services were hosted on newer hardware than the ERP application servers.

Related Posts

Leave a Comment Cancel Reply