CISA—Certified Information Systems Auditor - Part 370

1. Which of the following is the MOST important consideration when defining recovery point objectives (RPOs)?

A) Minimum operating requirements
B) Acceptable data loss
C) Mean time between failures
D) Acceptable time for recovery



2. A structured walk-through test of a disaster recovery plan involves:

A) representatives from each of the functional areas coming together to go over the plan.
B) all employees who participate in the day-to-day operations coming together to practice executing the plan.
C) moving the systems to the alternate processing site and performing processing operations.
D) distributing copies of the plan to the various functional areas for review.



3. In a contract with a hot, warm or cold site, contractual provisions should cover which of the following considerations?

A) Physical security measures
B) Total number of subscribers
C) Number of subscribers permitted to use a site at one time
D) References by other users



4. During a follow-up audit, an IS auditor finds that the auditee has updated virus scanner definitions without adopting the original audit recommendation to increase the frequency of using the scanner. The MOST appropriate action for the auditor is to:

A) prepare a follow-up audit report reiterating the recommendation.
B) escalate the issue to senior management.
C) modify the audit opinion based on the new information available.
D) conclude that the residual risk is beyond tolerable levels of risk.



5. When developing a business continuity plan, business unit management's involvement is MOST important during the:

A) performance of a business impact analysis.
B) development of business recovery procedures.
C) implementation of a document repository.
D) performance of an IT risk assessment.