CISA Information Systems Operations and Business Resilience: 129 practice questions

12 of the 129 Information Systems Operations and Business Resilience questions in the Certsqill CISA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISA? Take the free 5-min readiness check →

1. It abstracts physical hardware and allocates CPU: In a virtualized server environment, what is the PRIMARY fun

1. It abstracts physical hardware and allocates CPU, memory, and I/O resources among multiple virtual machines. ✓

   Correct. A hypervisor (virtual machine monitor) sits between hardware and guest operating systems, partitioning and scheduling physical resources so several isolated VMs can share one host.
2. It encrypts all data written to the storage area network before it reaches disk.

   Incorrect. Storage-level encryption is a function of the storage subsystem or an encryption appliance, not the hypervisor; the candidate is confusing resource abstraction with data-at-rest protection.
3. It provides the relational query engine that guest databases use to execute SQL.

   Incorrect. The query engine is part of the DBMS running inside a guest VM; the hypervisor has no knowledge of database queries and only manages the virtual hardware presented to that guest.
4. It performs application-layer load balancing across web front ends.

   Incorrect. Application load balancing is done by a load balancer or reverse proxy; this confuses distributing user requests with allocating hardware resources to VMs.

A hypervisor abstracts physical hardware and shares CPU, memory, and I/O among guest VMs.

2. To maintain an authoritative record of configuration items: What is the PRIMARY purpose of a configuration man

1. To maintain an authoritative record of configuration items and their relationships across the IT environment. ✓

   Correct. A CMDB is intended to be the single source of truth for configuration items (CIs), their attributes, and the dependencies among them, supporting change, incident, and asset processes.
2. To store the encrypted credentials and rotation schedules used by service accounts across every application, acting as the enterprise secrets vault.

   Incorrect. Secrets and service-account credentials belong in a vault or PAM system; the candidate confuses a repository of configuration items with a credential store.
3. To capture real-time performance metrics for capacity forecasting.

   Incorrect. Time-series performance data is held by monitoring/APM tools; a CMDB records the existence and relationships of CIs, not their moment-to-moment utilization.
4. To archive completed change tickets for regulatory retention.

   Incorrect. Change ticket history lives in the ITSM ticketing system; the CMDB may link to changes but its purpose is describing the current configuration, not archiving workflow records.

A CMDB is the authoritative inventory of configuration items and their relationships.

3. The number and type of software deployments do not exceed: In software asset management, 'license compliance'

1. The number and type of software deployments do not exceed the entitlements the organization has purchased. ✓

   Correct. License compliance means actual usage/deployment stays within the entitlements granted by the license agreements, avoiding both under-licensing (legal/financial exposure) and helping surface over-licensing (wasted spend).
2. All installed software is continuously running the latest available version and security patch level across every workstation and server in the estate.

   Incorrect. Keeping software current is patch/version management; the candidate confuses being up to date with being properly licensed. A fully patched product can still be over-deployed.
3. Every workstation runs endpoint protection before software is installed.

   Incorrect. Endpoint protection is a security control unrelated to entitlement counts; this mixes malware defense with contractual license usage.
4. Open-source software has been removed from the production estate.

   Incorrect. Open-source software is not inherently non-compliant; it carries its own license terms. Removing it is neither required for nor equivalent to compliance.

License compliance means deployed usage stays within purchased entitlements.

4. Sanitizing or destroying storage media so no recoverable: At the disposal stage of the IT asset lifecycle, whi

1. Applying the latest firmware update to the device.

   Incorrect. Patching a device being retired provides no value; the candidate is applying an operate-stage control to a disposal-stage decision.
2. Sanitizing or destroying storage media so no recoverable data remains. ✓

   Correct. Media sanitization or physical destruction prevents residual data from being recovered after the asset leaves control, which is the defining risk of the disposal stage.
3. Extending the vendor warranty for one additional year.

   Incorrect. Warranty is a procurement/operate concern and irrelevant to an asset being decommissioned, and it does nothing to address data remanence.
4. Re-imaging the device with the standard corporate build and reactivating its endpoint protection agent before it is handed off.

   Incorrect. A standard re-image does not guarantee prior data is unrecoverable and is a provisioning step; it does not meet the sanitization requirement for disposal.

Sanitize or destroy storage media before disposal so no recoverable data remains.

5. It enforces defined execution order and dependencies: What is the PRIMARY benefit of using an enterprise job s

1. It enforces defined execution order and dependencies consistently and reduces reliance on manual intervention. ✓

   Correct. A scheduler runs jobs on defined triggers and dependency conditions automatically and repeatably, reducing human error and missed runs while providing a controlled, auditable execution flow.
2. It guarantees that every batch job will complete without errors by automatically resolving any runtime exceptions it encounters during the run.

   Incorrect. A scheduler orchestrates when jobs run; it cannot guarantee error-free completion. The candidate overstates automation as a correctness guarantee.
3. It removes the need to retain batch processing logs.

   Incorrect. Logs remain essential for monitoring, troubleshooting, and audit; automation increases, not decreases, the need for reliable logging.
4. It eliminates the requirement to test changes to batch programs.

   Incorrect. Change and release controls still apply to scheduled jobs; scheduling does not replace testing of the underlying programs.

A job scheduler enforces execution order and dependencies automatically and repeatably, cutting manual error.

6. Running the job more than once with the same input: A batch job is described as 'idempotent.' What does this m

1. Running the job more than once with the same input produces the same end state as running it once. ✓

   Correct. Idempotency means repeated execution with identical input leaves the system in the same final state, which is what makes a job safe to rerun after a partial failure without duplicating effects.
2. The job cannot be interrupted once it has started.

   Incorrect. Non-interruptibility (atomicity of execution) is a different property; idempotency concerns the effect of repeated runs, not whether a run can be paused.
3. The job always runs faster on each subsequent execution.

   Incorrect. Idempotency says nothing about performance; the candidate confuses a correctness property with an efficiency claim.
4. The job encrypts its output before writing to disk.

   Incorrect. Output encryption is unrelated to idempotency, which is purely about the repeatability of end state under re-execution.

Idempotent means rerunning with the same input yields the same end state as a single run.

7. Job B does not start until Job A has finished successfully: In a production schedule, defining Job B as depend

1. If Job A fails, Job B still starts but processes Job A's most recent prior successful output instead.

   Incorrect. A completion dependency holds Job B when Job A fails; it does not silently substitute a previous run's output, which would risk processing stale data. The candidate confuses gating with a fallback mechanism.
2. Job B automatically corrects any errors produced by Job A.

   Incorrect. A dependency does not repair upstream errors; if A fails, a proper dependency prevents B from running, it does not fix A.
3. The scheduler will automatically re-run Job A until it succeeds so that Job B can proceed.

   Incorrect. A dependency only gates Job B on Job A's success; automatic retry of Job A is a separate retry policy that must be configured explicitly and is not implied by the dependency itself.
4. Job B does not start until Job A has finished successfully, preserving correct data sequencing. ✓

   Correct. A predecessor/successor dependency gates Job B on Job A's successful completion, so B never processes data that A was supposed to prepare but had not yet produced.

A dependency makes Job B wait for Job A's successful completion, preserving data sequence.

8. It provides connectivity and integration services that let: In a multi-tier application architecture, which st

1. It provides connectivity and integration services that let separate applications and components exchange data and requests. ✓

   Correct. Middleware (message queues, application servers, integration buses) sits between applications and provides the plumbing for communication, translation, and coordination between otherwise independent components.
2. It is the presentation layer that renders the user interface in the browser and executes all client-side input validation for the application.

   Incorrect. UI rendering is the presentation tier; the candidate confuses the integration/plumbing layer with the front end users see.
3. It is the physical disk subsystem that persists transactional data.

   Incorrect. Data persistence is provided by storage and the database tier; middleware moves and coordinates requests, it is not the storage layer.
4. It is the firewall that filters inbound network traffic to the application.

   Incorrect. Traffic filtering is a network security control; middleware enables application-to-application communication, not perimeter enforcement.

Middleware provides the connectivity and integration layer between separate applications and components.

9. The CMDB is populated manually and is not reconciled: Which finding should the IS auditor rate as the MOST sig

1. The CMDB is populated manually and is not reconciled against automated discovery, so it does not reflect the actual environment. ✓

   Correct. If the CMDB is not reconciled to authoritative discovery data, it drifts from reality; every downstream process that trusts it (change impact analysis) inherits the inaccuracy. Fixing reconciliation addresses the root cause.
2. The change advisory board meets weekly rather than daily.

   Incorrect. Meeting cadence does not explain why the CMDB omits servers and dependencies; the candidate targets process frequency instead of data accuracy.
3. Implementers are not senior enough to spot dependencies.

   Incorrect. Relying on individual expertise to catch gaps is a workaround, not a fix; the systemic issue is that the authoritative record is wrong.
4. The organization uses a single shared CMDB instead of one dedicated database per application team, forcing every group to compete over the same records.

   Incorrect. A single, well-reconciled CMDB is the goal (single source of truth); fragmenting it per team would worsen consistency, not improve it.

Undocumented CIs and missing dependencies stem from a CMDB that is not reconciled to automated discovery.

10. Unrestricted VM mobility can expose the product on more: What is the auditor's PRIMARY concern regarding licen

1. Unrestricted VM mobility can expose the product on more physical cores than are licensed, creating under-licensing liability. ✓

   Correct. Core-based licensing in a cluster where VMs can run on any host can require licensing all eligible cores; unrestricted mobility means the effective licensable footprint may far exceed entitlements, driving true-up and penalty exposure.
2. The virtualization cluster may reduce application response times during peak periods because of contention for shared CPU and memory across co-located VMs.

   Incorrect. Performance is a capacity concern, not a licensing exposure; the candidate drifts from the compliance question to an operational one.
3. Virtual machines cannot be backed up as reliably as physical servers.

   Incorrect. Backup reliability is unrelated to license entitlements; this substitutes a resilience worry for the compliance issue.
4. The database vendor may release a newer version the company has not deployed.

   Incorrect. Version currency is not license compliance; running an older supported version does not by itself breach entitlements.

Free VM mobility can spread a core-licensed product across more cores than licensed, causing under-licensing liability.

11. There is no process to update the asset register upon: Which control weakness should the auditor report as MOS

1. There is no process to update the asset register upon disposal, so the inventory no longer reflects the true asset population. ✓

   Correct. If disposal is not fed back into the register, the inventory overstates active assets, undermining license counts, support contracts, patch scope, and reconciliation. Closing the record is the missing lifecycle control.
2. The wiping vendor should be rotated annually to prevent collusion.

   Incorrect. Vendor rotation is a minor procurement hygiene point and does not address the register being out of date; the data proves wiping is happening.
3. Drives should be degaussed with a certified degausser and issued a destruction certificate rather than wiped with the currently approved software method.

   Incorrect. Approved wiping is an accepted sanitization method; debating the technique ignores the actual gap, which is the stale inventory record.
4. Retired hardware should be stored on-site indefinitely for spare parts.

   Incorrect. Indefinite retention is not a control improvement and does nothing for register accuracy; it may add cost and security risk.

Disposal must update the asset register; otherwise inventory overstates active assets long after retirement.

12. Require positive completion confirmation: Which control would MOST directly prevent recurrence?

1. Require positive completion confirmation, so a missing success signal within the expected window itself triggers an alert. ✓

   Correct. Alert-on-failure only fires when the job reports a failure; a silent early exit produces neither success nor failure. Requiring an explicit success confirmation (and alerting on its absence) closes the gap by treating 'no news' as bad news.
2. Increase the server's memory to reduce the chance of the job exiting early.

   Incorrect. Adding memory addresses one possible cause, not the detection gap; the job could fail silently for many other reasons and still go unnoticed.
3. Schedule the job to run twice each night for redundancy.

   Incorrect. Running it twice does not help if neither run reports outcome; both could silently fail and no one would know.
4. Move the reports to run earlier so empty output is seen sooner.

   Incorrect. This detects the problem only after empty reports are produced and consumed; it does not confirm the job actually completed successfully.

Alert-on-failure misses silent exits; require positive success confirmation and alert when it is absent.

Other CISA domains

• Protection of Information Assets — 129 questions →
• Information Systems Auditing Process — 89 questions →
• Governance and Management of IT — 89 questions →
• Information Systems Acquisition, Development and Implementation — 60 questions →
• All 496 CISA questions →