CISA Practice Test 41 — 15 Questions

Question 1

An organization's IT strategy is developed by the IT department without input from business stakeholders. Which of the following is the MOST significant risk?

Accepted Answer

IT strategy may not support business objectives.. Without business input, the strategy may not support business objectives, leading to misalignment. Option A is a possible outcome. Options B and C are less directly related.

Answer

Technology may become obsolete quickly.

Answer

IT projects may exceed budget.

Answer

IT staff may lack required skills.

Question 2

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

Performance measurement. The correct answers are B (Performance measurement) and D (Strategic alignment of IT with business). Both are key components of an IT governance framework as defined by COBIT and similar frameworks. Performance measurement enables monitoring of IT's contribution to business goals, while strategic alignment ensures IT initiatives support business objectives. Option A (Configuration management database) is an operational tool, not a governance component. Option C (Vulnerability assessment results) is a security control output. Option E (Firewall rules) is an operational security measure, not a governance framework element.

Answer

Configuration management database

Answer

Vulnerability assessment results

Answer

Firewall rules

Question 3

An organization has a policy requiring annual information security awareness training for all employees. During a recent audit, it was found that 20% of employees had not completed the training. What is the BEST course of action for the IT governance committee?

Accepted Answer

Require managers to ensure their teams complete training and escalate non-compliance to HR.. Enforcing compliance through HR and management reinforces the policy. Option A is wrong because reducing training frequency weakens security. Option C is wrong because extending the deadline does not address non-compliance. Option D is wrong because training is a mandatory policy, not optional.

Answer

Reduce the training frequency to biennial.

Answer

Extend the training deadline by three months.

Answer

Make the training optional for employees with high performance ratings.

Question 4

An organization's IT governance framework includes a policy that all system access must be reviewed quarterly. The internal audit finds that reviews are incomplete. What is the BEST action?

Accepted Answer

Reinforce accountability with managers. Reinforcing accountability with managers directly addresses the root cause of incomplete reviews—lack of responsibility and follow-through. Option A is incorrect because implementing an automated access review tool may improve efficiency but does not address the underlying accountability issue. Option C is incorrect because disabling all non-compliant accounts could disrupt business operations without solving the process failure. Option D is incorrect because updating the policy to require monthly reviews increases frequency but does not ensure reviews are completed.

Answer

Implement an automated access review tool

Answer

Disable all non-compliant accounts

Answer

Update the policy to require monthly reviews

Question 5

During a risk assessment, an IS auditor identifies that the IT department has not performed a business impact analysis (BIA) for critical systems. Which of the following is the MOST significant risk?

Accepted Answer

Uncertainty regarding recovery time objectives for critical systems. Without a BIA, recovery time objectives (RTOs) are uncertain, leading to potential unacceptable downtime. Option A is a consequence but not the primary risk. Option B is incorrect because BIA is for recovery, not cost. Option C is less direct.

Answer

Non-compliance with software licensing

Answer

Increased likelihood of security breaches

Answer

Inability to calculate total cost of ownership

Question 6

A company plans to outsource its data center operations to a cloud service provider. What is the MOST important governance consideration for the board before finalizing the contract?

Accepted Answer

Ensure the contract includes clauses for regulatory compliance and audit rights.. The most important governance consideration because the board must ensure that the contract enforces regulatory compliance and provides audit rights to meet legal and regulatory obligations. Option A is wrong because cost reduction is secondary to compliance and governance. Option B is wrong because transferring staff is an HR/operational issue, not a board-level governance priority. Option D is wrong while an exit strategy is important, contractually securing compliance and audit rights is more critical for governance oversight.

Answer

Select a provider with the lowest cost per transaction.

Answer

Negotiate the transfer of existing IT staff to the provider.

Answer

Define a detailed exit strategy for transitioning to another provider.

Question 7

Which TWO of the following are common objectives of an IT balanced scorecard? (Choose two.)

Accepted Answer

Enhancing IT staff skills and knowledge. The IT balanced scorecard translates the organization's strategy into objectives across four perspectives: customer, financial, internal process, and learning/growth. Option C (enhancing IT staff skills and knowledge) aligns with the learning and growth perspective, as it focuses on developing human capital. Option E (improving customer satisfaction with IT services) aligns with the customer perspective, measuring how IT meets user needs. Options A, B, and D are tactical or operational activities rather than strategic objectives spanning the balanced scorecard dimensions.

Answer

Deploying a new ERP system

Answer

Reducing the number of help desk tickets

Answer

Implementing a new firewall

Question 8

Which THREE of the following are indicators of mature IT governance?

Accepted Answer

IT risks are formally assessed and managed.. Options B, D, and E are correct. Mature IT governance is indicated by formal risk assessment and management (B), alignment of IT decisions with business strategy (D), and regular board reporting on IT performance (E). Option A (high staff retention) is an HR metric, not a governance indicator. Option C (on-time and within-budget projects) is a project management measure, not a governance maturity indicator.

Answer

The IT department has high staff retention.

Answer

IT projects are completed on time and within budget.

Question 9

An IT manager is developing a governance policy for change management. Which element is MOST important to include?

Accepted Answer

Roles and responsibilities. Clearly defined roles and responsibilities ensure accountability in the change process. Option A is incorrect because project management methodology is separate from governance policy. Option B is incorrect as detailed technical procedures are part of implementation, not governance. Option C is incorrect because a list of all applications is operational, not a governance element.

Answer

Project management methodology

Answer

Detailed technical procedures

Answer

List of all applications

Question 10

An organization is planning to outsource its data center operations. Which of the following governance practices should be implemented to ensure proper oversight?

Accepted Answer

Establish a service level agreement (SLA) with key performance indicators (KPIs).. Establishing a service level agreement (SLA) with key performance indicators (KPIs) provides measurable performance targets and accountability, ensuring proper oversight of outsourced data center operations. Option A (annual financial audits) addresses financial compliance but not operational oversight. Option B (ISO 27001 certification) is a certification, not an ongoing governance practice. Option D (allowing the outsourcer to manage all security controls independently) abdicates the organization's responsibility for oversight.

Answer

Conduct annual financial audits of the outsourcer.

Answer

Require the outsourcer to obtain ISO 27001 certification.

Answer

Allow the outsourcer to manage all security controls independently.

Question 11

Which TWO of the following are primary objectives of IT governance as defined by COBIT 5?

Accepted Answer

Resource optimization. Options A and D are correct because COBIT 5 defines primary IT governance objectives as stakeholder value delivery and resource optimization. Option B (cost reduction) is a management objective, not governance. Option C (incident response) is an operational activity. Option E (data encryption) is a security control.

Answer

Cost reduction

Answer

Incident response

Answer

Data encryption

Question 12

A company outsources its data center operations to a third-party provider. Which of the following is the MOST important control to include in the outsourcing contract?

Accepted Answer

Right to audit the provider's facilities and processes. The right to audit allows the company to verify the provider's compliance. Option A is important but less critical than audit rights. Option B is operational. Option C is a security control but not the most important contractual safeguard.

Answer

Detailed escalation procedures for incidents

Answer

Service level agreements with financial penalties

Answer

Requirements for encryption of data at rest

Question 13

Based on the log, what is the MOST likely root cause of the backup failure?

Accepted Answer

Insufficient storage capacity. The log clearly indicates the target directory is full. Options A, B, C are not indicated in the log.

Answer

Network connectivity issues

Answer

Incorrect backup schedule

Answer

Backup software corruption

Question 14

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

IT strategy. D and E are correct. An IT strategy (D) and an IT steering committee (E) are key components of an IT governance framework. A (network topology diagram) is a technical document, B (help desk procedures) is operational, and C (hardware inventory) is operational, so they are not governance components.

Answer

Network topology diagram

Answer

Help desk procedures

Answer

Hardware inventory

Question 15

Which THREE of the following are components of the COBIT 2019 governance system?

Accepted Answer

Organizational structures. Options A, B, and C are correct because COBIT 2019 defines governance system components as Organizational Structures, Information Items, and Processes. Option D (Service desk) is an operational process not a governance component. Option E (Project management office) is a management structure, not a governance component as defined in COBIT 2019.

Answer

Service desk

Answer

Project management office