- When reviewing a company's offsite backup storage arrangements, which of the following would be the most significant finding?
Answer: The offsite facility is located in the same geographic flood zone as the primary data center.
An offsite facility in the same flood zone as the primary data center could be damaged by the same event, defeating the purpose of offsite storage. Geographic diversity is essential for disaster recovery. Answer C is correct. 25-mile distance (A) is generally acceptable. 24-hour retrieval (B) affects RTO but is manageable. Storage fees (D) are a business arrangement, not a control concern.
- During a backup controls review, an auditor discovers that the organization performs nightly backup jobs but never monitors the job completion logs. Which control is missing?
Answer: A monitoring control that reviews backup job results and escalates failures for prompt remediation.
Unmonitored backup jobs may fail silently - backups that appear scheduled but actually fail create a false sense of security. Monitoring completion logs and escalating failures is an essential detective control. Answer C is correct. A daily backup policy likely exists (A). Encryption (B) addresses confidentiality. A BCP (D) is a separate planning document.
- A company's backup policy states that all backups must be encrypted. An auditor tests this control by requesting evidence of encryption for a sample of backup files. The auditor finds that 30% of backup files are unencrypted. This finding should be classified as:
Answer: A control deficiency - the backup encryption control is not operating effectively, and unencrypted backups expose sensitive data to potential loss or theft.
A 30% failure rate in an encryption control means a significant portion of backup media is unencrypted - a material control deficiency exposing sensitive data if media is lost or stolen. Answer A is correct. A 30% deviation is not acceptable (B). Many regulations and policies do require backup encryption (C). The root cause may be a configuration issue, but the finding is a control deficiency (D).
- An organization retains backup data for 90 days as per policy. An auditor verifies that backups older than 90 days are automatically deleted. What additional verification should the auditor perform?
Answer: Confirm that the 90-day retention period meets all applicable regulatory and legal requirements for the types of data being backed up.
The auditor must verify that the retention period complies with applicable regulations (SEC, IRS, HIPAA, SOX, etc.) since some financial and health data must be retained for years, not months. Answer C is correct. Vendor support (A) and industry norms (B) are less critical than regulatory compliance. Software flexibility (D) does not confirm current compliance.
- Which of the following backup control deficiencies poses the greatest risk to an organization's ability to recover from a cyberattack?
Answer: Backup files are stored on the same network as production systems and are accessible to the same user accounts.
Network-accessible backups using the same credentials as production are vulnerable to the same ransomware or cyberattack that compromises production - destroying both data and recovery capability. Answer B is correct. Log retention (A), backup timing (C), and report distribution (D) are minor operational issues that do not threaten recovery capability.
- A financial services firm has an RPO of 15 minutes for its trading system. Which backup configuration would best meet this requirement?
Answer: Continuous data protection (CDP) that captures every write operation to a secondary system in real time or near real time.
CDP replicates every write operation continuously, achieving near-zero RPO - appropriate for a 15-minute RPO requirement. Answer A is correct. Hourly incrementals (B) can lose up to 60 minutes of data. Daily differentials (C) could lose a full day. Weekly full backups (D) could lose a week.
- Which of the following most directly evaluates whether recovery time objectives (RTOs) are achievable?
Answer: Conducting a timed recovery exercise that measures how long it actually takes to restore systems from backup.
Only a timed recovery test can confirm whether systems can actually be restored within the RTO - documentation and offsite storage confirm preparedness but do not prove execution capability. Answer D is correct. Plan review (A) and offsite storage (B) are preparedness checks. RPO alignment (C) addresses data loss, not downtime duration.
- An organization's disaster recovery plan designates a warm site for system recovery. During an audit, the auditor finds the warm site has not been tested in three years and the hardware at the warm site is significantly outdated compared to production. The most significant risk is:
Answer: In a real disaster, recovery may fail or significantly exceed the RTO because untested, outdated hardware may be incompatible with current production configurations.
Untested, outdated disaster recovery infrastructure is a critical risk - hardware incompatibilities and untested procedures can result in recovery failures or delays well beyond the RTO. Answer C is correct. Provider fees (A), employee awareness (B), and network speed (D) are minor concerns compared to the risk of recovery failure.
- Which of the following represents the most effective control to ensure that recovery time objectives are met during an actual disaster?
Answer: Regularly training the recovery team, maintaining updated recovery runbooks, and conducting realistic timed recovery exercises.
Meeting RTOs in a real disaster requires a practiced team with current procedures and demonstrated capability through regular timed exercises - preparation that builds muscle memory and identifies gaps before they matter. Answer B is correct. Documentation alone (A) does not build capability. Insurance (C) covers costs but does not reduce downtime. Consultants on standby (D) introduce delays and lack organizational knowledge.
- An organization's backup policy requires that critical system backups be tested quarterly. An auditor finds that tests were performed in Q1 but not in Q2 or Q3. The most appropriate audit finding is:
Answer: A control deficiency - the required backup restoration testing was not performed as specified in policy, creating unknown recovery capability gaps for six months.
Missing two of four required quarterly test cycles means the organization went six months without verifying recovery capability - a material policy non-compliance and control deficiency. Answer D is correct. Policy requirements exist for good reason and should not be relaxed (A). A single passing test does not fulfill ongoing requirements (B). Six months of missed testing is not minor (C).
- When evaluating the adequacy of an organization's backup controls, which of the following is the most important consideration?
Answer: Whether the organization has tested its backups by performing actual restoration exercises to confirm data is recoverable.
A backup that has never been tested may be corrupted, incomplete, or technically unrestorable. Restoration testing is the only way to confirm that backups actually work when needed. Answer A is correct. Completion timing (B), vendor certification (C), and software version (D) are operational details that do not confirm recoverability.
- An auditor evaluating recovery controls at a cloud-hosted company should verify which of the following in addition to the company's own controls?
Answer: The cloud provider's SOC 2 Type II report, which provides independent assurance over the provider's backup and recovery controls.
A SOC 2 Type II report provides independent auditor assurance over the cloud provider's controls over a period of time, including backup and recovery. This is the most reliable third-party evidence of cloud provider control effectiveness. Answer D is correct. Employee counts and financials (A) and marketing materials (B) do not provide control assurance. ISP uptime (C) is unrelated to backup controls.
- An auditor reviewing backup controls finds that full backups are performed weekly but no incremental or differential backups are performed between full backups. The primary risk of this configuration is:
Answer: A system failure between full backups could result in up to one week of data loss, potentially exceeding the organization's RPO.
Without daily incrementals or differentials, any failure between Sunday and the following Saturday could result in up to six days of lost data - a potentially unacceptable RPO for most organizations. Answer D is correct. Storage consumption (A) and restore time (C) are operational concerns. Software compatibility (B) is unrelated.
- Which of the following recovery control test types provides evidence of recoverability with the least operational risk?
Answer: Parallel testing - running both primary and recovery systems simultaneously and comparing outputs, without switching production traffic to the recovery environment.
Parallel testing validates recovery capability by running both environments and comparing results without risking production disruption - a good balance of assurance and operational safety. Answer A is correct. Full cutover (B) risks production disruption if recovery fails. No testing (C) provides no assurance. Destructive testing (D) is high-risk and rarely appropriate.
- An auditor evaluating backup controls requests the backup job history for the past 90 days and finds that backup jobs failed on 15 of those days. The IT team has no documentation of these failures being investigated or remediated. This finding indicates:
Answer: A significant control deficiency - backup failures were not detected and remediated, creating unknown data loss exposure for those 15 days.
Uninvestigated backup failures mean the organization does not know what data is unprotected. Fifteen days of unexplained failures represents a serious gap in the backup control environment that requires immediate attention. Answer C is correct. Software upgrades (A) may be needed but are not the finding. A 17% failure rate with no remediation is not minor (B) or acceptable (D).
- An auditor is evaluating backup controls for a company's payroll system. Which of the following procedures would provide the most relevant evidence that backup controls are effective?
Answer: Selecting a sample of backup job logs and verifying successful completion, then requesting evidence that restoration testing has been performed.
Backup control testing requires examining job completion logs (evidence backups ran) and restoration test results (evidence data is actually recoverable). Answer B is correct. Access control policy (A), vendor capabilities (C), and change management (D) are unrelated to backup control effectiveness.
- A company performs backup restoration tests on a development server rather than production hardware. What limitation does this introduce when evaluating recovery controls?
Answer: Tests on development hardware may not reflect the actual time and complexity of restoring full-scale production systems, making RTO validation less reliable.
Development servers typically have different hardware specs, storage, and configurations than production. Tests on development hardware may significantly understate the time and complexity of a real production restoration, making RTO measurements unreliable. Answer B is correct. Development tests do not provide equivalent evidence (A). Audit standards do not prohibit development testing (C). Backups can technically be restored to development environments (D).
- A company implements immutable backups using object storage with write-once, read-many (WORM) technology. The primary control objective of immutable backups is:
Answer: Preventing backup data from being modified or deleted by ransomware or malicious insiders during the retention period.
Immutable backups cannot be altered or deleted once written - even by administrators or ransomware - making them a critical control for ransomware resilience and insider threat protection. Answer B is correct. WORM is not primarily a performance technology (A). Immutability does not equal verification (C). Compression is a separate feature (D).
- When evaluating recovery controls, an auditor should verify that recovery procedures address which of the following scenarios?
Answer: A range of scenarios including hardware failures, software failures, cyberattacks, natural disasters, and human error.
Comprehensive recovery controls must address all types of disruptive events - technology failures, cyber incidents, natural disasters, and human error - since each may require different recovery procedures and resources. Answer D is correct. Limiting recovery planning to one type of event (A, B, C) leaves the organization unprepared for other disruptions.
- Which of the following is the most significant deficiency in an organization's backup controls if the organization processes financial transactions 24 hours a day, 7 days a week?
Answer: Backups are performed only on weekday nights, leaving weekend transactions unprotected and potentially creating multi-day data loss exposure.
A 24/7 transaction processor needs continuous or near-continuous backup protection. Weeknight-only backups leave significant gaps on weekends when transactions are still occurring. Answer A is correct. Interface usability (B), notification distribution (C), and storage capacity (D) are operational concerns that do not represent a significant control deficiency for 24/7 operations.
