CISA Question 271

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  Question already mention those are Critical Systems, no need to BIA again. The most important thing should be assess the impact.

• Chose D1

  So while A is a reasonable step later, it’s not the correct next step in a CISA-aligned audit process. D is the proper choice because it ensures the auditor’s assessment is based on documented business priorities, not assumptions.

• Chose A1

  The auditor should evaluate the impact of not covering all critical systems and alert management. This will allow management to address the gaps in the DRP, potentially improving the plan and mitigating risks