CISA Domain 4B-4 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain B-4 (Business Continuity Plan) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4B-4 Business Continuity Plan Practice Test 002

10 questions • Single best answer

Question 1

An audit manager at a regional credit union is planning an engagement to evaluate the business continuity plan. The plan was last rewritten two years ago, and since then the credit union has launched mobile lending and moved its core banking platform to a hosted provider. Which of the following should the audit team review FIRST?

A. Results of the most recent tabletop exercise and the related lessons-learned log B. Whether the business impact analysis reflects the new processes and hosting provider C. The hosting provider's SOC 2 report and the recovery commitments stated in its contract D. Call tree contact lists and alternate-site arrangements currently documented in the plan

Question 2

During a review of a pharmaceutical distributor's business continuity plan, the IS auditor learns that the annual test consisted of a walkthrough in which department heads read their sections aloud. All participants signed off that the plan was adequate, and no issues were recorded. Which recommendation is MOST appropriate?

A. Require department heads to formally re-attest to the accuracy of their sections each quarter B. Engage an independent consultant to benchmark the plan document against an industry standard C. Hold the walkthrough twice a year and expand attendance to include frontline supervisors D. Move to scenario-based simulation and parallel tests of critical processes

Question 3

A municipal water utility's business continuity plan was developed by the IT department, which also maintains and tests it. During the audit, the IS auditor notes that business unit managers have not reviewed their sections and senior management has never formally approved the plan. Which finding is MOST significant?

A. Senior management has not approved the plan or accepted ownership of continuity B. Business unit managers have not reviewed the recovery procedures for their areas C. The IT department both maintains the plan and performs its periodic testing D. The scope of the plan appears to be weighted heavily toward technology recovery

Question 4

An IS auditor at an online brokerage wants assurance that staff could execute the business continuity plan during an actual disruption. Management provides the approved plan, a signed endorsement memo from the CEO, and training attendance records for recovery team members. Which of the following is the BEST evidence that the plan would work?

A. The CEO's signed endorsement memo approving the current version of the plan B. Training records confirming all recovery team members completed BCP awareness C. Results of a recent simulation comparing actual recovery times against defined RTOs D. Interviews with process owners confirming they understand their assigned recovery roles

Question 5

A post-merger review at a regional healthcare network finds that the business continuity plan was updated to include the acquired clinics. However, recovery team rosters still list 14 employees who left the organization months ago. The plan owner explains that rosters are refreshed only during the annual plan review. What should the IS auditor recommend?

A. Link plan maintenance to HR and change processes so staff changes trigger updates B. Shorten the plan review cycle from annual to quarterly for every section of the plan C. Transfer ownership of the recovery team rosters from the plan owner to the HR department D. Schedule an immediate full-interruption test to identify any other outdated plan content

Question 6

A business continuity audit at a payroll services company identifies several gaps in the continuity program. The company processes payroll for 3,000 client employers and is contractually obligated to deliver employee payments on fixed dates. Several large clients have recently requested evidence of the company's continuity preparedness. Which finding is MOST significant?

A. The alternate processing site has not been physically inspected in the last 18 months B. Plan copies stored at the offsite location are one version behind the current plan C. BCP awareness training completion is 82 percent against a target of 95 percent D. The plan does not address recovery of the payment file transmission process to banks

Question 7

A manufacturing company's CIO asks the internal audit department to write the business continuity plan, arguing that auditors understand controls better than anyone else. The approved audit plan already includes an audit of business continuity next year. What is the IS auditor's BEST course of action?

A. Draft the plan as requested and assign a different auditor to perform next year's audit B. Offer leading-practice guidance while management retains plan ownership C. Accept the assignment and disclose the involvement in next year's audit report D. Decline the request entirely and refer the CIO to an external continuity consultant

Question 8

During a review of a retail chain's business continuity test results, the IS auditor notes that the exercise was declared successful. However, the test report shows that point-of-sale recovery for stores exceeded the RTO by six hours, which the recovery team attributed to a missing configuration script. What should the IS auditor do FIRST?

A. Report to the audit committee that the business continuity test should be classified as failed B. Recommend that the RTO for point-of-sale systems be extended to match demonstrated capability C. Determine whether the root cause was corrected and the affected procedures were retested D. Evaluate whether the test scope covered a representative sample of store locations

Question 9

An IS auditor reviewing a government benefits agency's business continuity plan notes that it documents system recovery steps in thorough technical detail. However, the plan does not describe how eligibility decisions and payments would be processed if core systems remained unavailable beyond their RTO. Which recommendation is MOST appropriate?

A. Reduce the recovery time objective for the benefits system to a shorter target B. Contract for a hot site so the benefits system can be restored more quickly C. Expand the technical recovery steps to cover additional failure scenarios D. Develop manual workaround procedures for critical processes and train staff on them

Question 10

Six months after a business continuity audit at an engineering consultancy, management reports that the recommendation to establish an alternate work-area arrangement for its design teams has been completed. The only supporting evidence is an email from facilities stating that two workspace providers were contacted. What should the IS auditor do?

A. Keep the finding open until a viable arrangement is in place and documented in the plan B. Close the finding based on management's representation and the email provided by facilities C. Escalate to the board that management has misrepresented the status of the remediation D. Schedule a complete re-audit of the business continuity program to validate all prior findings

Related Posts

Leave a Comment Cancel Reply