CISA Question 115

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  “Business continuity management” is displayed in the center of the figure, surrounded by five labelled boxes connected with arrows forming a complete cycle. Beginning from the first box at the top of the figure, and moving in a clockwise fashion, the boxes display the following terms: Business Impact Analysis, Business Continuity Plans, Awareness and Training, Testing, Monitoring & Corrective Actions. Business continuity management is about ensuring that in a time of disaster, or after a time of disaster, we are able to continue operation of our most critical business functions or restore them back to a working state. To prioritize the recovery of critical functions, you can conduct a business impact analysis (BIA) to identify the most critical business functions. The most critical functions that have the highest financial impacts should be prioritized in business continuity plans.

• Chose A3

  The BIA is explicitly designed to identify and prioritize critical business functions and their required recovery times. This is a strategic assessment that informs both the Business Continuity Plan (BCP) and the Disaster Recovery Plan (DRP). DRP testing is a tactical exercise that ensures the recovery procedures for IT systems work as intended. It verifies that the systems prioritized by the BIA can be recovered within the required timeframes. Again, another question I cannot agree with results

• 2

  Completely agree with you sentiments. Disaster recovery plan (DRP) testing tests the procedures for recovering IT systems and infrastructure but does not prioritize overall business functions without considering their criticality as identified in a BIA.