Inspirational journeys

Follow the stories of academics and their research expeditions

CISA—Certified Information Systems Auditor - Part 316

Mary Smith

Wed, 15 Apr 2026

CISA—Certified Information Systems Auditor - Part 316

1. The PRIMARY purpose of a business impact analysis (BIA) is to:

A) provide a plan for resuming operations after a disaster.
B) identify the events that could impact the continuity of an organization's operations.
C) publicize the commitment of the organization to physical and logical security.
D) provide the framework for an effective disaster recovery plan.



2. After implementation of a disaster recovery plan, pre-disaster and post-disaster operational costs for an organization will:

A) decrease.
B) not change (remain the same).
C) increase.
D) increase or decrease depending upon the nature of the business.



3. Which of the following is the MOST reasonable option for recovering a noncritical system?

A) Warm site
B) Mobile site
C) Hot site
D) Cold site



4. An organization's disaster recovery plan should address early recovery of:

A) all information systems processes.
B) all financial processing applications.
C) only those applications designated by the IS manager.
D) processing in priority order, as defined by business management.



5. Am advantage of the use of hot sites as a backup alternative is that:

A) the costs associated with hot sites are low.
B) hot sites can be used for an extended amount of time.
C) hot sites can be made ready for operation within a short period of time.
D) they do not require that equipment and systems software be compatible with the primary site.



1. Right Answer: B
Explanation: A business impact analysis (BIA) is one of the key steps in the development of a business continuity plan (BCP). A BIA will identify the diverse events that could impact the continuity of the operations of an organization.

2. Right Answer: C
Explanation: There are costs associated with all activities and disaster recovery planning (DRP) is not an exception. Although there are costs associated with a disaster recovery plan, there are unknown costs that are incurred if a disaster recovery plan is not implemented.

3. Right Answer: D
Explanation: Generally, a cold site is contracted for a longer period at a lower cost. Since it requires more time to make a cold site operational, it is generally used for noncritical applications. A warm site is generally available at a medium cost, requires less time to become operational and is suitable for sensitive operations. A mobile site is a vehicle ready with all necessary computer equipment that can be moved to any cold or warm site depending upon the need. The need for a mobile site depends upon the scale of operations. A hot site is contracted for a shorter time period at a higher cost and is better suited for recovery of vital and critical applications.

4. Right Answer: D
Explanation: Business management should know which systems are critical and when they need to process well in advance of a disaster. It is management's responsibility to develop and maintain the plan. Adequate time will not be available for this determination once the disaster occurs. IS and the information processing facility are service organizations that exist for the purpose of assisting the general user management in successfully performing their jobs.

5. Right Answer: C
Explanation: Hot sites can be made ready for operation normally within hours. However, the use of hot sites is expensive, should not be considered as a long-term solution, and requires that equipment and systems software be compatible with the primary installation being backed up.

0 Comments

Leave a comment