CISA Governance and Management of IT — 50 Questions

Question 1

A company's IT governance policy requires that all critical systems have a documented business continuity plan (BCP). During an audit, an IT auditor finds that the BCP for a critical financial system has not been updated in three years. Which of the following is the BEST recommendation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the BCP to reflect current processes and conduct a test.. IT governance policies require that BCPs remain current to reflect actual operational processes. An outdated BCP (three years stale) may contain obsolete recovery procedures, contact information, or dependencies, rendering it ineffective during a real incident. Updating the BCP and then testing it validates that the documented steps align with the current system architecture and can be executed successfully, which is a core requirement of the BCP lifecycle per ISACA guidelines.

Answer

Archive the outdated BCP and develop a new one from scratch.

Answer

Accept the risk because the system has been stable.

Answer

Implement a new system with built-in redundancy.

Question 2

Which TWO of the following are key components of an IT governance framework?

Accepted Answer

Strategic alignment. Strategic alignment (B) is a key component of an IT governance framework because it ensures that IT strategies, investments, and operations are directly linked to business goals and objectives. This alignment is achieved through mechanisms such as balanced scorecards, IT steering committees, and portfolio management, which translate business strategy into IT priorities. Without strategic alignment, IT may operate in a silo, leading to wasted resources and missed opportunities for business value.

Answer

Resource management

Answer

Performance measurement

Answer

Risk management

Question 3

Which TWO of the following are key responsibilities of an IT steering committee?

Accepted Answer

Approving the annual IT budget and major capital expenditures. An IT steering committee is a governance body that provides strategic direction and oversight, so option A (approving the annual IT budget and major capital expenditures) is correct because allocating and authorizing funding for IT investments is a core governance responsibility that ensures projects align with business strategy. Option C (defining IT policies and standards) is also correct because the steering committee sets the high-level rules, standards, and priorities that guide the IT organization and ensure consistency, compliance, and risk management. The remaining options are operational or hands-on technical tasks: B (daily system monitoring and incident response) belongs to IT operations or a SOC, D (writing application code) belongs to software developers, and E (configuring firewall rules and network access controls) belongs to network or security engineers, none of which are steering-committee responsibilities.

Answer

Performing daily system monitoring and incident response

Answer

Writing application code for new software features

Answer

Configuring firewall rules and network access controls

Question 4

Match each COBIT 5 domain to its description.

Accepted Answer

EDM: Ensures stakeholder needs are addressed, governance objectives are met, and the enterprise is directed and monitored.. COBIT 5 has five process domains: EDM (governance), APO (planning), BAI (acquisition/implementation), DSS (delivery/support), and MEA (monitoring). Correct matches are as above; common confusions involve swapping APO/MEA or DSS/APO.

Answer

MEA: Manages IT resources and capabilities to optimize performance.

Answer

DSS: Ensures alignment of IT strategy with business goals.

Question 5

Match each log type to its typical content.

Accepted Answer

Audit Log: Records user activities and changes for compliance.. Logs are essential for monitoring and forensics. Correct matches: Audit Log tracks user activities and compliance, Security Log tracks security events, System Log tracks OS events, Application Log tracks application events. Common confusions include mixing system events with audit logs and application errors with security logs.

Answer

Audit Log: Records system startup/shutdown events.

Answer

Security Log: Records application errors.

Question 6

A small business lacks formal IT governance. What is the FIRST step to establish governance?

Accepted Answer

Conduct a risk assessment. The first step in establishing IT governance is to conduct a risk assessment, because governance decisions (policies, roles, controls) must be driven by an understanding of the organization's risks and objectives. Without knowing what risks exist, any policies or structures created would be arbitrary. Risk assessment informs the scope and priorities of the governance framework.

Answer

Assign an IT manager

Answer

Define IT policies

Answer

Implement COBIT

Question 7

A financial institution is required by regulators to demonstrate that IT controls are effective. Which of the following provides the BEST evidence?

Accepted Answer

Service organization control (SOC) reports. Service organization control (SOC) reports are independent audits of control effectiveness, highly regarded by regulators. Internal audit reports are valuable but may lack independence; risk register and balanced scorecard are not direct evidence of control effectiveness.

Answer

IT balanced scorecard

Answer

Internal audit reports

Answer

IT risk register

Question 8

An organization is implementing IT governance based on COBIT. Which THREE of the following are enablers? (Select exactly three.)

Accepted Answer

Organizational structures. In COBIT 2019, governance is implemented through seven enablers, and the correct answers here are B, C, and E. Organizational structures (B) are an enabler because COBIT defines them as the formal decision-making and accountability arrangements (e.g., boards, committees, roles) that direct and monitor governance activities. Culture, ethics, and behavior (C) are an enabler because COBIT recognizes that individual and organizational values, ethics, and behavioral patterns are essential to making governance work in practice. Processes (E) are an enabler because COBIT describes processes as organized sets of practices and activities that achieve governance and management objectives. Options A and D are not COBIT enablers: application software and network infrastructure are specific technology assets or resources, which COBIT addresses under the broader enabler of 'information, technology, and infrastructure' rather than as separate enablers.

Answer

Application software

Answer

Network infrastructure

Question 9

Refer to the exhibit. Based on the governance status report, which component should be addressed as a priority?

Accepted Answer

Resource Optimization. Resource Optimization is the correct answer because the governance status report likely shows it as the component with the most critical gaps or lowest maturity, making it the priority for improvement. In IT governance frameworks like COBIT, resource optimization ensures that IT resources (applications, information, infrastructure, and people) are allocated and managed efficiently to support business objectives. When this area is deficient, it directly impacts the organization's ability to deliver value and can lead to wasted investments, making it a high-priority concern.

Answer

Strategy Alignment

Answer

Performance Measurement

Answer

Risk Management

Question 10

Refer to the exhibit. The organization is planning to achieve the target level. What is the MOST appropriate action?

Accepted Answer

Implement process metrics and statistical controls. To move from Level 3 (Established) to Level 4 (Predictable), the process must be measured and controlled using statistical techniques. Implementing metrics and statistical controls directly addresses the gap. Documentation, ownership, and training are earlier-level activities.

Answer

Assign a process owner

Answer

Conduct awareness training

Answer

Increase process documentation

Question 11

Refer to the exhibit. Which perspective shows the greatest deviation from target?

Accepted Answer

Learning & Growth. The Learning & Growth perspective shows the greatest deviation from target, as indicated in the exhibit (likely a balanced scorecard dashboard). This perspective focuses on employee training, culture, and innovation, which are leading indicators for future performance.

Answer

Customer

Answer

Financial

Answer

Internal Process

Question 12

Which TWO of the following are key components of an IT governance framework?

Accepted Answer

IT strategy committee. An IT governance framework defines the decision-making structures and processes that ensure IT supports and enables business strategy, and the IT strategy committee (A) is a core structural component because it provides executive-level direction, oversight, and accountability for aligning IT investments with organizational objectives. IT risk management (C) is likewise a key component, since governance requires identifying, assessing, and mitigating technology-related risks to acceptable levels in line with the organization's risk appetite. By contrast, an IT asset inventory (B) is an operational/configuration-management artifact, IT project portfolio management (D) is a delivery and prioritization discipline that supports but does not itself constitute the governance framework, and an IT help desk ticketing system (E) is a service-management tool, none of which are the defining components of governance.

Answer

IT asset inventory

Answer

IT project portfolio management

Answer

IT help desk ticketing system

Question 13

An organization is adopting COBIT 2019. Which TWO of the following are components of the governance system?

Accepted Answer

Processes. In COBIT 2019, the governance system is built from a set of governance system components (formerly called enablers), and Processes (A) is one of them — it covers the defined practices and activities that achieve governance and management objectives. Organizational structures (D) is also a core component, describing the decision-making entities such as boards, committees, and roles that carry out governance. The other listed items are not COBIT 2019 governance system components: IT hardware inventory (B) is an asset/infrastructure detail, Information flows (C) is not one of the defined components (COBIT addresses information as part of the 'Information' component, not 'information flows'), and Employee satisfaction surveys (E) are a measurement/feedback tool rather than a governance system component.

Answer

IT hardware inventory

Answer

Information flows

Answer

Employee satisfaction surveys

Question 14

Which of the following is a potential risk in this RACI matrix?

Accepted Answer

The Change Manager is responsible but lacks authority to approve.. In a RACI matrix, the 'Responsible' party does the work, while the 'Accountable' party has final decision authority. If the Change Manager is marked Responsible but lacks authority to approve changes, this creates a governance risk: the person executing the change cannot ensure proper approval, leading to unauthorized or poorly vetted changes. This is a classic segregation-of-duties issue.

Answer

The IT Director is accountable but not informed of all changes.

Answer

IT Operations is informed, but should be responsible for implementation.

Answer

The Business Process Owner is consulted, which may delay approvals.

Question 15

What is the MOST significant weakness in the planned remediation?

Accepted Answer

The remediation may not eliminate the segregation of duties issue.. The remediation's core purpose is to resolve a segregation of duties (SoD) conflict, so the most significant weakness is whether it actually eliminates that conflict. If the remediation merely reassigns or masks the conflicting access without truly separating the incompatible duties, the underlying SoD risk persists. CISA exam logic prioritizes whether the root cause is addressed over scope, technology choice, or compensating controls.

Answer

The remediation only addresses a subset of projects.

Answer

The remediation relies on technology rather than process.

Answer

The remediation does not include a compensating control.

Question 16

According to COBIT 2019, which design factor is MOST critical for tailoring a governance system?

Accepted Answer

Enterprise strategy. According to COBIT 2019, the most critical design factor for tailoring a governance system is the enterprise strategy. COBIT 2019 identifies 11 design factors, and enterprise strategy is considered the most important because it drives the goals, risk appetite, and overall direction of the governance system. All other factors should align with the enterprise strategy.

Answer

Regulatory environment

Answer

Technology complexity

Answer

Organizational size

Question 17

Based on the exhibit, which metric would be LEAST relevant to the 'Customer' perspective?

Accepted Answer

System Uptime Percentage. (System Uptime Percentage) is the least relevant to the Customer perspective because system uptime is an operational metric that primarily supports the Internal Process perspective (e.g., reliability and availability). In contrast, the other options directly measure customer satisfaction and engagement: Number of New Features (customer-driven innovation), Satisfaction Survey Score (direct feedback), and Complaint Resolution Time (service responsiveness). While uptime may indirectly affect customer satisfaction, it is not a direct measure of the customer perspective as defined by balanced scorecard frameworks.

Answer

Number of New Features Delivered

Answer

Satisfaction Survey Score

Answer

Complaint Resolution Time

Question 18

Based on the exhibit, what is the default retention period for data?

Accepted Answer

365 days. The exhibit shows a data retention policy where the default retention period is explicitly set to 365 days. This is the baseline period applied when no other specific retention rule (e.g., for legal holds or specific data types) overrides it. In CISA governance contexts, a default retention period ensures that data is not kept indefinitely without justification, aligning with privacy and records management principles. The 365-day default is a common baseline in many policy templates, representing one full calendar year.

Answer

30 days for Legal role only

Answer

The policy does not specify a default period

Answer

30 days

Question 19

An IS auditor is reviewing the balanced scorecard for IT. Which of the following metrics BEST aligns with the 'customer perspective'?

Accepted Answer

Average system uptime for critical applications. The balanced scorecard's customer perspective measures how customers perceive the organization's products and services, so availability of critical applications — which directly affects user experience and satisfaction — is the best fit. Uptime is a customer-facing service quality metric that maps cleanly to the customer perspective.

Answer

Percentage of IT projects under budget

Answer

Number of change requests completed on time

Answer

Percentage of staff with ITIL certification

Question 20

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

Performance measurement. Option B (Performance measurement) is correct because an IT governance framework must define metrics, KPIs, and reporting mechanisms (e.g., balanced scorecards, COBIT goals and metrics) to monitor whether IT delivers value and complies with objectives. Option D (Strategic alignment of IT with business) is correct because aligning IT investments, services, and priorities with business strategy is a core governance principle in frameworks such as COBIT and ISO/IEC 38500. The unmarked options do not belong: a configuration management database (A) is a CMDB used in ITIL service transition/configuration management, vulnerability assessment results (C) are technical security findings from scanning, and firewall rules (E) are operational security controls—all are tactical artifacts rather than governance framework components.

Answer

Configuration management database

Answer

Vulnerability assessment results

Answer

Firewall rules