CISA Practice Test 23 — 15 Questions

Question 1

A large financial institution is evaluating the effectiveness of its IT governance framework. The board has requested a review to ensure alignment with business objectives and regulatory requirements. Which of the following is the MOST important factor for the board to consider when assessing the IT governance framework?

Accepted Answer

The framework is integrated with enterprise governance and supports strategic objectives.. Option B is correct because a well-defined IT governance framework must integrate with enterprise governance to ensure alignment with business objectives and regulatory requirements. Option A is wrong because focusing solely on cost reduction may conflict with strategic priorities. Option C is wrong because incident response is operational, not governance-level. Option D is wrong because technical efficiency is a management concern, not board-level governance.

Answer

The framework includes a detailed incident response plan.

Answer

The framework focuses on achieving high technical efficiency.

Answer

The framework minimizes overall IT costs.

Question 2

Which TWO of the following are benefits of establishing an IT steering committee?

Accepted Answer

Enhanced prioritization of IT investments. Options B and D are correct because an IT steering committee provides strategic alignment and prioritization of IT initiatives. Option A is not a benefit; it may increase bureaucracy. Option C is not a direct benefit; operational efficiency is management's role. Option E is not a primary benefit; detailed technical decisions are outside committee scope.

Answer

Improved operational efficiency of IT systems

Answer

Reduction of management overhead

Answer

Direct control over technical IT decisions

Question 3

A large enterprise is assessing its IT governance maturity. Which THREE of the following are indicators of a mature governance process? (Select exactly three.)

Accepted Answer

There is a formal IT governance committee. Mature governance involves board-level review of IT strategy, linking IT metrics to business outcomes, and having a formal governance committee. Decisions in silos and historical budget allocation are signs of low maturity.

Answer

IT decisions are made in silos

Answer

IT budget is allocated based on historical spending

Question 4

An organization has decentralized IT management with each business unit making its own technology decisions. Which of the following is the BEST way to maintain enterprise-wide governance?

Accepted Answer

Establish an enterprise architecture review board with representatives from all business units.. Option A is correct because an enterprise architecture review board with unit representatives ensures alignment while respecting decentralization. Option B is too centralized. Option C forces a single system, which may not suit all units. Option D is budgeting, not governance of decisions.

Answer

Deploy a single enterprise resource planning (ERP) system across all units.

Answer

Require all IT projects to be approved by the corporate IT department.

Answer

Create a central IT budget that allocates funds to business units.

Question 5

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. What is the committee's MOST important role?

Accepted Answer

Ensuring alignment with business objectives. Option B is correct because the steering committee's primary role is to ensure that the proposed system aligns with business objectives. Option A is incorrect as technical specification approval is typically handled by technical teams. Option C is incorrect because budget management is a project management responsibility. Option D is incorrect because vendor selection is often a procurement function, though the committee may provide input.

Answer

Approving technical specifications

Answer

Selecting the vendor

Answer

Managing the project budget

Question 6

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Setting IT risk appetite. Options A, B, and C are correct because setting IT risk appetite, approving IT strategy, and reviewing IT performance are board-level responsibilities. Option D is incorrect as implementing controls is management's role. Option E is incorrect as designing network security is an operational task.

Answer

Designing network security architecture

Answer

Implementing IT controls

Question 7

A business continuity plan (BCP) includes a tabletop exercise once a year. An IS auditor finds that the exercise only involves IT staff. Which of the following is the BEST recommendation?

Accepted Answer

Invite business process owners to participate in future exercises. Option C is correct because exercises should include business units to validate integrated response. Option A is too narrow. Option B focuses on data, not participation. Option D tests technical skills but not coordination.

Answer

Perform a failover test of the production environment

Answer

Increase the frequency of IT-only exercises

Answer

Include a data restoration test in the exercise

Question 8

An organization is developing its IT strategy to align with the overall business strategy. The business strategy emphasizes rapid market expansion through digital products. Which of the following IT strategies would BEST support this business goal?

Accepted Answer

Adopt agile development methods and scalable cloud infrastructure.. Option C is correct because rapid market expansion requires agility and speed. Option A is wrong because strict standardization may slow down innovation. Option B is wrong because minimizing IT investment would hinder digital product development. Option D is wrong because outsourcing to the lowest-cost provider may compromise quality and speed.

Answer

Standardize all IT systems to reduce complexity.

Answer

Outsource all IT operations to a low-cost provider.

Answer

Minimize IT investment to preserve capital for business growth.

Question 9

Refer to the exhibit. Based on the governance status report, which component should be addressed as a priority?

Accepted Answer

Resource Optimization. Resource Optimization has a Red status, indicating critical risk or non-compliance, requiring immediate attention. Green and Yellow components are less urgent.

Answer

Strategy Alignment

Answer

Performance Measurement

Answer

Risk Management

Question 10

A company is implementing IT governance based on COBIT 2019. Which of the following design factors would have the GREATEST impact on the governance system design?

Accepted Answer

The industry and regulatory environment.. Option B is correct because according to COBIT 2019, the enterprise strategy and regulatory environment are key design factors that drive governance requirements. Option A (size) is a factor but less impactful than industry/regulatory. Options C and D are operational details.

Answer

The IT infrastructure complexity.

Answer

The size of the organization.

Answer

The number of IT staff.

Question 11

An IT department uses a balanced scorecard to measure performance. Which metric would BEST reflect the 'customer perspective'?

Accepted Answer

User satisfaction survey results. Option C is correct because the customer perspective focuses on user satisfaction and service responsiveness. Option A is incorrect as system uptime is an internal process metric. Option B is incorrect as project completion rate is an internal efficiency metric. Option D is incorrect as training hours relate to learning and growth perspective.

Answer

Training hours per employee

Answer

System uptime percentage

Answer

Project completion rate

Question 12

Based on the exhibit, which metric would be LEAST relevant to the 'Customer' perspective?

Accepted Answer

System Uptime Percentage. Option C is correct because system uptime is an operational metric typically aligned with the Internal Process perspective, not directly with customer satisfaction as measured by surveys and complaint resolution. Option A is incorrect because survey scores directly measure customer satisfaction. Option B is incorrect because complaint resolution time is a customer-facing metric. Option D is incorrect because number of new features may be customer-driven, but it is less directly related than the given metrics; however, it is still more relevant than uptime. Uptime is the least relevant.

Answer

Number of New Features Delivered

Answer

Satisfaction Survey Score

Answer

Complaint Resolution Time

Question 13

An organization's data classification policy defines 'Confidential' data as requiring encryption at rest. An IS auditor discovers that a database containing customer personal information is not encrypted. What is the auditor's BEST course of action?

Accepted Answer

Report the finding to the data owner and IT management. Option D is correct because reporting the non-compliance to management is the auditor's responsibility. Option A is not an audit action. Option B may be outside scope. Option C is after reporting.

Answer

Encrypt the database immediately

Answer

Recommend a compensating control

Answer

Verify the classification of the data

Question 14

A multinational corporation has defined its risk appetite as 'moderate' for IT investments. The IT steering committee is evaluating a new project with potential high returns but also significant cybersecurity risks. The project's risk profile is assessed as 'high' by the risk management team. What should the committee do FIRST?

Accepted Answer

Request the project team to identify risk mitigation measures.. Option D is correct because if the risk exceeds appetite, risk mitigation measures should be explored to bring it to an acceptable level. Option A is wrong because rejecting outright without considering mitigation may miss valuable opportunities. Option B is wrong because escalating to the board should be after mitigation options are considered. Option C is wrong because approving as is violates risk appetite.

Answer

Approve the project but increase monitoring.

Answer

Escalate the decision to the board of directors.

Answer

Reject the project immediately as it exceeds risk appetite.

Question 15

A retail company is merging with a competitor. The IT departments of both organizations have different IT governance structures: Company A uses a centralized model with strict change management, while Company B uses a decentralized model with autonomous business unit IT. The CIO has been tasked with integrating the IT functions post-merger. The board expects cost synergies and improved service levels. The integration team is facing resistance from Company B's business heads who fear loss of agility. The CIO needs to propose a governance model for the merged entity. Which approach would BEST meet the board's expectations while addressing resistance?

Accepted Answer

Implement a phased integration with a transitional governance structure that includes representatives from both sides.. Option B is correct because a phased integration with interim governance allows gradual convergence, managing change and resistance while building toward synergy. Option A is wrong because immediate full centralization may cause disruption and strong resistance. Option C is wrong because adopting the weaker model (decentralized) may not achieve synergies. Option D is wrong because maintaining both models permanently does not achieve integration.

Answer

Keep both models separate and allow business units to choose their preferred model.

Answer

Adopt Company B's decentralized model to preserve agility.

Answer

Immediately impose Company A's centralized model across the merged entity.