CISA Practice Test 24 — 15 Questions

Question 1

Refer to the exhibit. The organization is planning to achieve the target level. What is the MOST appropriate action?

Accepted Answer

Implement process metrics and statistical controls. To move from Level 3 (Established) to Level 4 (Predictable), the process must be measured and controlled using statistical techniques. Implementing metrics and statistical controls directly addresses the gap. Documentation, ownership, and training are earlier-level activities.

Answer

Assign a process owner

Answer

Conduct awareness training

Answer

Increase process documentation

Question 2

An organization's IT strategy is developed by the IT department without input from business stakeholders. Which of the following is the MOST significant risk?

Accepted Answer

IT strategy may not support business objectives.. Option D is correct because without business input, the strategy may not support business objectives, leading to misalignment. Option A is a possible outcome. Options B and C are less directly related.

Answer

Technology may become obsolete quickly.

Answer

IT projects may exceed budget.

Answer

IT staff may lack required skills.

Question 3

According to COBIT 2019, which design factor is MOST critical for tailoring a governance system?

Accepted Answer

Enterprise strategy. Option D is correct because enterprise strategy determines the governance objectives and risk appetite, making it the most critical design factor. Options A, B, and C are all important but secondary; they influence the system but are driven by strategy.

Answer

Regulatory environment

Answer

Technology complexity

Answer

Organizational size

Question 4

An auditor finds that access reviews have not been completed for two quarters. What is the MOST significant risk?

Accepted Answer

Unauthorized access may be granted and persist. Option A is correct because without regular reviews, unauthorized or inappropriate access may go undetected, increasing the risk of data breaches. Option B is incorrect because while audit findings will be reported, that is a consequence, not the primary risk. Option C is incorrect as system performance is unrelated. Option D is incorrect because data integrity may be at risk but is less direct than unauthorized access.

Answer

Data integrity may be compromised

Answer

System performance may degrade

Answer

Audit findings may be reported to management

Question 5

Which of the following is the PRIMARY purpose of an IT strategy committee?

Accepted Answer

To ensure IT investments support business objectives. Option B is correct because the committee's role is to align IT with business strategy. Option A is operational. Option C is project-specific. Option D is too narrow.

Answer

To monitor IT project timelines

Answer

To manage IT vendor contracts

Answer

To approve IT project budgets

Question 6

A company is considering restructuring its IT department from a centralized to a decentralized model to give business units more autonomy. What is a PRIMARY governance risk associated with this move?

Accepted Answer

Inconsistent IT policies and security controls across business units.. Option A is correct because decentralized IT can lead to inconsistent policies and standards across units. Option B is wrong because cost overruns can occur in any model. Option C is wrong because innovation may increase with autonomy. Option D is wrong because vendor management can be decentralized but still controlled.

Answer

Difficulty in managing vendor contracts due to decentralization.

Answer

Reduced innovation due to lack of central coordination.

Answer

Increased risk of project cost overruns.

Question 7

Refer to the exhibit. Which perspective shows the greatest deviation from target?

Accepted Answer

Learning & Growth. Learning & Growth is 30 hours short of 150 (20% deficit), while Financial is 10% short, Internal Process is 4% short, and Customer exceeds target. Thus, Learning & Growth has the largest negative gap.

Answer

Customer

Answer

Financial

Answer

Internal Process

Question 8

Which TWO of the following are key components of an IT governance framework?

Accepted Answer

IT strategy committee. Options A and E are correct. An IT governance framework includes structures like an IT strategy committee (A) and processes like IT risk management (E). B (project portfolio management) is a management practice, not a core governance component. C (help desk) and D (asset inventory) are operational.

Answer

IT asset inventory

Answer

IT project portfolio management

Answer

IT help desk ticketing system

Question 9

An organization outsources its data center operations. What is the BEST way to ensure the service provider's controls are effective?

Accepted Answer

Conduct periodic third-party audits. Option A is correct because independent third-party audits provide objective verification of controls. Option B is incorrect because relying solely on the provider's internal audit may lack independence. Option C is incorrect because requiring all controls may be impractical and expensive. Option D is incorrect because SLAs focus on performance, not control effectiveness.

Answer

Rely on the provider's internal audit reports

Answer

Monitor service level agreements only

Answer

Require the provider to implement all organizational controls

Question 10

Based on the exhibit, what is the default retention period for data?

Accepted Answer

365 days. Option B is correct because the JSON clearly shows 'retentionPeriodDays': 365. Option A is incorrect; 30 days is the extension for the Legal role. Option C is incorrect as the extension applies only to Legal. Option D is incorrect because the policy explicitly specifies the default period.

Answer

30 days for Legal role only

Answer

The policy does not specify a default period

Answer

30 days

Question 11

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

Performance measurement. Correct answers: A and D. Both are core governance elements. Option B is operational, not governance. Option C is a specific control. Option E is risk management, which is part of governance but not a framework component itself; frameworks include processes like risk management.

Answer

Configuration management database

Answer

Vulnerability assessment results

Answer

Firewall rules

Question 12

An organization has a policy requiring annual information security awareness training for all employees. During a recent audit, it was found that 20% of employees had not completed the training. What is the BEST course of action for the IT governance committee?

Accepted Answer

Require managers to ensure their teams complete training and escalate non-compliance to HR.. Option B is correct because enforcing compliance through HR and management reinforces the policy. Option A is wrong because extending the deadline does not address non-compliance. Option C is wrong because reducing training frequency weakens security. Option D is wrong because training is a mandatory policy, not optional.

Answer

Reduce the training frequency to biennial.

Answer

Extend the training deadline by three months.

Answer

Make the training optional for employees with high performance ratings.

Question 13

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. Which of the following BEST demonstrates that the proposal aligns with the organization's strategic goals?

Accepted Answer

The business case includes a clear link to the organization's five-year strategic plan.. Option C is correct because a clear link to the organization's strategic plan demonstrates alignment. Option A is about PM experience, not alignment. Option B is a feature that may not be strategic. Option D is a cost-saving tactic, not evidence of strategic alignment.

Answer

The project manager has extensive experience with CRM implementations.

Answer

The proposed system includes advanced analytics capabilities.

Answer

The vendor offers discounted licensing for the first year.

Question 14

An organization is adopting COBIT 2019. Which TWO of the following are components of the governance system?

Accepted Answer

Processes. Options A and B are correct. COBIT 2019 defines governance system components including processes (A) and organizational structures (B). C (hardware inventory) is an asset, not a component. D (information flows) is part of the information component but not a standalone component. E (employee satisfaction) is not a component.

Answer

IT hardware inventory

Answer

Information flows

Answer

Employee satisfaction surveys

Question 15

An organization's IT governance framework includes a policy that all system access must be reviewed quarterly. The internal audit finds that reviews are incomplete. What is the BEST action?

Accepted Answer

Reinforce accountability with managers. Option B is correct because reinforcing accountability with managers directly addresses the root cause of incomplete reviews. Option A is incorrect because increasing frequency does not solve the underlying issue. Option C is incorrect because automation may help but is a long-term solution. Option D is incorrect because disabling accounts may disrupt business operations without fixing the process.

Answer

Implement an automated access review tool

Answer

Disable all non-compliant accounts

Answer

Update the policy to require monthly reviews

CISA Practice Test 24 — 15 Questions

Exhibit

CISA Practice Test 24 — 15 Questions

Exhibit