CISA Domain 4B-1 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain B-1 (Business Impact Analysis) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4B-1 Business Impact Analysis Practice Test 002

10 questions • Single best answer

Question 1

A state transportation agency's internal audit team is reviewing a recently completed business impact analysis. The BIA rates the toll-collection process as critical, but it omits the third-party payment processor and the shared authentication service that the process relies on. What is the PRIMARY risk created by this omission?

A. Recovery time objectives for toll collection will be set more aggressively than IT can meet B. The agency will be unable to calculate annualized loss expectancy for toll-collection outages C. Recovery efforts may restore the toll application while its essential dependencies stay down D. The continuity steering committee will lack sufficient evidence to formally approve the BIA

Question 2

An IS auditor at a large public university is evaluating the business impact analysis supporting the institution's continuity program. The continuity coordinator states that recovery priorities were derived from stakeholder input across academic and administrative units. Which of the following provides the BEST evidence that the documented recovery priorities reflect actual business requirements?

A. Signed approval of impact ratings and recovery objectives by the responsible process owners B. IT's documented recovery capability for each system that is listed within the analysis C. A BIA template aligned with an internationally recognized business continuity standard D. Completed BIA questionnaires collected from all of the university's application administrators

Question 3

An IS auditor is planning an audit of a pharmaceutical distributor's disaster recovery capability. The recovery plan assigns its business applications to three recovery tiers, but during scoping the auditor cannot locate any documentation explaining how the tiers were determined. What should the auditor do FIRST?

A. Test whether the tier 1 applications can be recovered within their stated target times B. Recommend that management commission a new business impact analysis for all processes C. Report the absence of a documented tiering rationale as a significant audit finding D. Inquire with management whether a business impact analysis was performed and retained

Question 4

During a review of a tax preparation firm's business impact analysis, the IS auditor notes that the client-filing system was rated as moderate impact with a five-day recovery time objective. The rating was based on average monthly transaction volumes across the year. Which of the following is the auditor's GREATEST concern?

A. The recovery time objective was not expressed in hours for consistency with IT metrics B. The impact rating may not reflect the time-sensitive peak of the annual filing season C. The moderate rating may lead to insufficient cybersecurity investment in the system D. The monthly volume data used was not independently verified by the internal audit team

Question 5

An audit manager reviewing a telecommunications provider's business impact analysis observes that each process is assigned a single impact rating of high, medium, or low. The BIA does not show how financial, regulatory, or customer impacts change as an outage extends from hours into days. Which conclusion is MOST appropriate?

A. The BIA is adequate because qualitative impact ratings are an accepted industry practice B. The BIA should be replaced with a quantitative risk assessment performed for each process C. The BIA may not provide a defensible basis for setting process recovery time objectives D. The BIA should be supplemented with threat likelihood ratings assigned to each process

Question 6

A retail pharmacy chain's business impact analysis lists the applications each critical process depends on, based on questionnaires completed by department managers. The IS auditor is concerned that managers may be unaware of back-end integrations and shared services. Which audit procedure would provide the BEST assurance that the documented dependencies are complete?

A. Comparing the BIA to the configuration and interface inventories and tracing transactions B. Reissuing the questionnaires to managers with a request for signed written confirmation C. Reviewing the BIA against the prior year's version to identify changes in dependencies D. Interviewing the continuity coordinator about the questionnaire design and the responses

Question 7

During follow-up of a prior audit finding, management of a regional credit union asserts that its outdated business impact analysis has been fully refreshed. The updated document shows a new approval date, but its recovery objectives and list of critical processes are identical to the previous version. What is the IS auditor's BEST course of action?

A. Close the finding because the BIA now carries evidence of recent management approval B. Obtain evidence of the analysis performed to confirm the refresh was substantive C. Escalate the matter directly to the board as a failure to remediate the finding D. Reissue the original finding with a revised target date for full remediation

Question 8

A digital media company's business impact analysis shows that outage losses for its advertising platform remain minimal for the first 48 hours and then rise sharply. The IT director proposes a hot site that would restore the platform within two hours. What should the IS auditor recommend?

A. Approving the hot site because a shorter recovery time always reduces the overall risk B. Selecting a cold site because early outage losses for the platform were shown to be minimal C. Deferring the decision until a penetration test of the advertising platform is complete D. Choosing a recovery strategy that balances recovery cost against the impact of the outage

Question 9

An IS auditor at a national law firm finds that business impact analysis results were compiled by the continuity coordinator and forwarded directly to IT for recovery planning. No executive has reviewed or endorsed the resulting prioritization of the firm's practice-area processes. Which risk is MOST significant?

A. IT may lack sufficient technical detail to design detailed recovery procedures B. The continuity coordinator may exceed the authority granted by firm policy C. Recovery priorities may not reflect the firm's strategic objectives and risk appetite D. Practice-area staff may be unaware of the recovery sequence during a disruption

Question 10

An IS auditor is assessing an online brokerage firm's business impact analysis, which estimates that a one-day trading platform outage would cost $50,000. The auditor notes that the firm earned more than $2 million in average daily commission revenue last year. Which action should the auditor take FIRST?

A. Recommend raising the trading platform's criticality rating to the highest tier B. Obtain the assumptions and data used to derive the platform's impact estimate C. Report that the BIA materially understates the platform's financial impact D. Recalculate recovery time objectives for all of the trading-related processes

Related Posts

Leave a Comment Cancel Reply