CISA Governance and Management of IT — All Questions With Answers

> cobit process-capability EDM01
Process: EDM01 - Ensure Governance Framework Setting and Maintenance
Current Level: 3 (Established Process)
Target Level: 4 (Predictable Process)
Gap: 1

IT BSC Report Q1 2025:
- Financial: Actual 80% of plan (Target 90%)
- Customer: Satisfaction score 4.2/5 (Target 4.0)
- Internal Process: SLA compliance 95% (Target 99%)
- Learning & Growth: Training hours 120 (Target 150)

Refer to the exhibit.
The following is a RACI matrix for the change management process:
Activity: Change request approval
Responsible: Change Manager (R)
Accountable: IT Director (A)
Consulted: Business Process Owner (C)
Informed: IT Operations (I)

Refer to the exhibit.
The following is an excerpt from an IT control self-assessment report:
Control: Segregation of duties in system development
Finding: In 3 out of 10 projects, the same developer who wrote code also performed code review.
Risk: High
Planned Remediation: Implement automated code review tool by Q3.

Refer to the exhibit.

IT Balanced Scorecard – Customer Perspective:
- Objective: Improve customer satisfaction
- Metrics:
  - Satisfaction Survey Score (target: >90%)
  - Complaint Resolution Time (target: <24 hours)
- Other perspectives: Internal Process, Learning & Growth, Financial

Refer to the exhibit.

{
  "policyName": "Data Retention",
  "retentionPeriodDays": 365,
  "enforcement": "automatic",
  "exceptions": [
    {
      "role": "Legal",
      "extendDays": 30
    }
  ]
}

Refer to the exhibit.

```json
{
  "policy": "DataRetention",
  "rules": [
    {"dataType": "PII", "retentionDays": 365, "encryptionRequired": true},
    {"dataType": "Financial", "retentionDays": 2555, "encryptionRequired": true},
    {"dataType": "Log", "retentionDays": 90, "encryptionRequired": false}
  ]
}
```

Refer to the exhibit.

```
[2025-03-01 02:00:00] ERROR: Backup job 'DailyFullBackup' failed.
[2025-03-01 02:00:05] INFO: Target directory '/mnt/backup' is full.
[2025-03-01 02:00:10] WARN: No space left on device.
```

Refer to the exhibit.
```
# cat /var/log/auth.log
Mar 10 08:12:34 srv01 sshd[1234]: Accepted password for admin from 192.168.1.10 port 22
Mar 10 08:15:22 srv01 sshd[1235]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:15:25 srv01 sshd[1236]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:15:28 srv01 sshd[1237]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:15:31 srv01 sshd[1238]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:15:34 srv01 sshd[1239]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:15:37 srv01 sshd[1240]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:18:01 srv01 sudo: admin : TTY=pts/0 ; PWD=/home/admin ; USER=root ; COMMAND=/bin/su -
```

Refer to the exhibit.

syslog output:
Mar 15 10:23:45 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Mar 15 10:23:46 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Mar 15 10:23:47 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Mar 15 10:23:48 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Mar 15 10:23:49 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2

Refer to the exhibit.
The following is an excerpt from an IT balanced scorecard:
Perspective: Customer
Objective: Improve user satisfaction
KPI: User satisfaction survey score
Target: >85%
Actual: 82%

Refer to the exhibit.

Access Control Policy (Excerpt):
- All system access requests must be approved by the data owner.
- Access reviews must be performed quarterly.
- Non-compliant access will be revoked within 24 hours of detection.

Refer to the exhibit.

```
access-list 101 permit tcp any host 192.168.1.100 eq 80
access-list 101 permit tcp any host 192.168.1.100 eq 443
access-list 101 deny ip any host 192.168.1.100
access-list 101 permit ip any any
```