ASI 5

An IS auditor has completed an audit of the IT department of an organization. Which of the following findings should be considered the MOST critical?:

• Workstation operating system (OS) patch levels are not consistent on each machine.

• The business continuity plan (BCP) is current, but is not tested annually.

• The password change policy is not being actively enforced.

• Servers are not backed up on a regular basis.

Which of the following is the MOST critical element of an effective disaster recovery plant (DRP)?

• Off-site storage of backup data.

• Up-to-date list of key disaster recovery contacts.

• Availability of a replacement data center.

• Clearly defined recovery time objective (RTO).

In the event of a disaster, which of the following elements would be MOST critical to the degree of success of the disaster recovery plan (DRP)/business continuity plan (BCP)?

• Current operating system (OS) software.

• Current operational data.

• Packaged application software.

• System utility software.

To determine the criticality of application systems in order to conduct a business impact analysis (BIA), which is the MOST important group with which to consult?

• Business processes owners

• IT management

• Senior business management

• Industry experts

An IS auditor is reviewing an organization’s disaster recovery plan (DRP) implementation. The project was completed on time and on budget. During the review, the auditor uncovers several areas of concern. Which of the following presents the GREATEST risk?

• Testing of the DRP has not been performed.

• The disaster recovery strategy does not specify use of a hot site.

• The BIA was conducted, but the results were not used.

• The disaster recovery project manager for the implementation has recently left the organization.

An IS auditor is tasked to review the adequacy of an organization’s technology recovery strategy. Which of the following factors would the auditor PRIMARILY review?

• Recovery time objective (RTO)

• Business impact analysis (BIA)

• Ability to recover from severe disaster.

• Recovery point objective (RPO)

What impact does the passage of time have on downtime cost and cost of alternative recovery strategies?

• Both cost increase with the passage of time.

• Downtime cost increases and the cost of alternate recovery strategies decreases with the passage of time.

• Both costs decrease with the passage of time.

• Passage of time does not have an impact on the two costs.

During an IS audit of the disaster recovery plan (DRP) of a global enterprise, the auditor observes that some remote offices have very limited local IT resources. Which of the following observations would be the MOST critical for the IS auditor?

• A test has not been made to ensure that local resources could maintain security and quality standards when recovering from a disaster or incident.

• The corporate business continuity plan (BCP) does not accurately document the systems that exist at remote offices.

• Corporate security measures have not been incorporated into the test plan.

• A test has not been made to ensure that tape backups from the remote offices are usable.

The selection of a recovery strategy should MOST likely depend on the:

• Restoration cost for the infrastructure and systems.

• Availability of a recovery site.

• Criticality of the business process.

• Incident response process.

An auditor is reviewing an organization’s recovery from a disaster in which all the critical data needed to resume business operations were not retained. Which of the following was incorrectly defined?

• The interruption window.

• The recovery time objective (RTO).

• The service delivery objective.

• The recovery point objective (RPO).