Discuss Isaca CISA Exam Topic 1 Question 33

An IS auditor determines that a business continuity plan has not been reviewed and approved by management. Which of the following is the MOST significant risk associated with this situation?

AContinuity planning may be subject to resource constraints.

BThe plan may not be aligned with industry best practice.

CCritical business processes may not be addressed adequate.

DThe plan has not been reviewed by risk management

Suggested Answer: C

Get Premium CISA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Noe 11 months ago

A could be a problem too, but not as urgent as C.

Janna 12 months ago

D seems like a huge oversight, can't believe it wasn't done.

Anastacia 12 months ago

Surprised that management hasn't reviewed it at all!

Allene 12 months ago

I think B is more critical. Best practices matter!

Ilene 1 year ago

C is definitely the biggest risk here.

Georgeanna 1 year ago

I recall that risk management review is crucial, but I wonder if the bigger issue is really about critical processes not being addressed. Maybe D isn't the most significant risk after all.

Alethea 1 year ago

I practiced a similar question where the focus was on resource constraints. But in this case, I feel like the lack of management review could really impact critical processes, so C seems right.

Mattie 1 year ago

I'm not entirely sure, but I think if management hasn't reviewed the plan, it might not align with best practices. That makes me lean towards option B.

Carline 1 year ago

I remember we discussed how unapproved plans could lead to critical processes being overlooked. So, I think option C might be the most significant risk.

Callie 1 year ago

Hmm, I'm a little unsure about this one. I know we covered the variable levels in class, but I can't quite remember where the env: composer_auth variable would be located. I'll have to think this through carefully.

Lavera 1 year ago

I think the key here will be identifying the relationships between the VMs, VNETs, and security groups, and then determining how traffic would be allowed or denied based on those configurations. I'll need to map that out step-by-step.

Fernanda 1 year ago

Okay, let's see. The question mentions that the gateway is in Ottawa, Canada and the calling user has a +1613 number. I think the answer has to do with how the calling party number is transformed based on that information.

Jarvis 1 year ago

I remember studying the stages of change, and I feel like this could relate to Contemplation too. They might be thinking about exercising more but haven't fully committed yet.

Isaca CISA Exam - Topic 1 Question 33 Discussion