CISA Domain 4B-3 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain B-3 (Data Backup, Storage, and Restoration) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4B-3 Data Backup, Storage, and Restoration Practice Test 002

10 questions • Single best answer

Question 1

A state transportation agency's internal audit unit is evaluating backup practices for its electronic toll collection system. The business impact analysis sets a two-hour recovery point objective for toll transactions, but the database is backed up only once nightly, and IT reports a 100% backup job success rate. Which conclusion is MOST appropriate based on the evidence?

A. Backup controls are effective because every scheduled backup job completed successfully during the period. B. The recovery time objective should be lengthened to match the current nightly backup frequency. C. The backup frequency does not support the recovery point objective defined for toll transaction data. D. Additional testing of backup job logs is needed before the auditor can reach any conclusion.

Question 2

An external IS auditor is assessing whether an e-commerce retailer can recover its order management database after a data loss. The backup administrator provides job completion logs, the vendor's product certification, and media integrity checksum reports. Which of the following provides the BEST evidence that the data can actually be recovered?

A. Results of a recent restoration to a test environment, validated by the business data owner B. Checksum reports confirming that all backup media was written without any data integrity errors C. Backup job completion logs showing successful runs for the entire audit period under review D. Vendor certification confirming the backup software is compatible with the database version

Question 3

During an audit of a university's research data backups, the IS auditor confirms that nightly backups complete successfully and media is transported weekly to an offsite vault. The vault is four miles from the primary data center, and both facilities are located within the same river floodplain. Which risk is MOST significant?

A. Backup media may degrade over time if vault environmental conditions are not monitored B. Transport of media to the vault may expose sensitive research data to interception or loss C. Restoration times may exceed objectives because media must first be retrieved from the vault D. A single regional event could destroy both the primary data and its offsite backup copies

Question 4

An IS auditor at a national law firm finds that all client-matter backups are encrypted using AES-256. The encryption keys are stored only on the backup management server, which is located in the primary data center alongside the production file servers. Which recommendation is MOST appropriate?

A. Replace the current algorithm with a stronger encryption standard for all of the stored backup media B. Store copies of the encryption keys at a separate secured location with documented recovery steps C. Restrict administrative access on the backup server to a small group of named administrators D. Rotate the backup encryption keys on a regular schedule and log each key rotation event

Question 5

An IS auditor at a pharmaceutical manufacturer finds that clinical trial databases are backed up nightly with a 35-day retention period. The records management policy requires trial data to be retained for 15 years, and IT management asserts that the backup process satisfies this requirement. What should the IS auditor do FIRST?

A. Determine whether a separate archival process retains the trial data for the required period B. Recommend extending the backup retention period to fifteen years for all trial databases C. Report noncompliance with the records management policy to the audit committee without further delay D. Test whether the oldest available backup can still be restored and read by current systems

Question 6

An IS auditor at an electric utility wants to determine whether all business-critical servers are included in the enterprise backup schedule. The organization maintains a configuration management database (CMDB) that flags critical assets, and all backup jobs are configured in a centralized backup console. Which audit approach provides the MOST complete assurance?

A. Select a sample of critical servers and inspect their backup logs for recent completions B. Interview the backup administrator about how new servers are added to the backup schedule C. Use data analytics to match every CMDB critical asset against the configured backup jobs D. Review the backup policy to confirm that it requires coverage of all critical systems

Question 7

A health insurer's IT team performs monthly restoration tests by recovering randomly selected files from backup, and all tests have succeeded. The claims adjudication application relies on three databases that must remain synchronized, but no full system restoration has ever been attempted. Which concern is MOST significant to the IS auditor?

A. Monthly file restoration testing may not be frequent enough for claims processing data B. Randomly selected files may not include the most sensitive member health information C. Restoration tests are performed by IT staff rather than by independent business users or data owners D. Recovery of the interdependent databases to a consistent point has not been demonstrated

Question 8

During a SOC 2 examination of a cloud-based payroll provider, the IS auditor finds that backup jobs automatically retry after a failure. During the period, 14 jobs failed on every retry, and no evidence shows that anyone reviewed those failures or reran the missed backups. Which recommendation is MOST appropriate?

A. Increase the number of automatic retries so that transient failures resolve without any intervention B. Require daily review of backup exceptions, with escalation and tracking of failures to resolution C. Configure the backup system to send failure alerts to a shared operations mailbox every night D. Run a full backup of all payroll databases each weekend to compensate for any missed jobs

Question 9

A stock brokerage replicates its trading database in real time to a hot site 300 miles away and has discontinued point-in-time backups, citing real-time replication as its primary backup strategy. Management states that this approach fully meets a near-zero recovery point objective. Which conclusion is MOST appropriate?

A. The strategy is adequate because the secondary site is geographically separated from the primary B. The strategy is adequate provided that failover to the hot site is tested at least once a year C. The strategy is deficient because logical corruption or deletion would be replicated immediately D. The strategy is deficient because real-time replication sharply increases network bandwidth costs

Question 10

An audit manager at a multinational manufacturer is planning an audit of backup and restoration processes covering more than 400 applications across 12 countries. Audit resources are limited to six weeks of fieldwork. How should the audit manager BEST determine which systems to include in the audit scope?

A. Prioritize systems according to business criticality and recovery objectives from the BIA B. Select a statistical random sample of applications from the complete IT asset inventory C. Focus on applications with the largest data volumes and the highest backup storage costs D. Include the systems for which IT management reported the most backup job failures during the year

Related Posts

Leave a Comment Cancel Reply