CISA Governance and Management of IT Practice Test 2 — 15 Questions

Question 1

Scenario: A healthcare organization is implementing a new electronic health records (EHR) system. The project has been delayed due to scope creep and resource constraints. The project sponsor is pressuring the project manager to accelerate the timeline by skipping user acceptance testing (UAT) and going live immediately. The organization has a governance policy that requires all IT projects to complete UAT before deployment. The project manager is concerned about quality and patient safety. Which of the following is the BEST course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adhere to the governance policy and escalate the risk to the steering committee for a decision.. The governance policy mandates UAT before deployment, and skipping it could compromise patient safety and data integrity in the EHR system. By escalating the risk to the steering committee, the project manager ensures that the decision is made at the appropriate governance level, balancing project pressures with compliance and quality. This approach aligns with the CISA domain of Governance and Management of IT, where adherence to policies and risk escalation are key controls.

Answer

Compromise by conducting a limited UAT on only critical functionalities.

Answer

Resign from the project due to ethical concerns.

Answer

Accept the sponsor's request and skip UAT to meet the deadline.

Question 2

An organization's IT department implemented a new change management process that requires all changes to be approved by a change advisory board (CAB). A critical security patch needs to be deployed within 2 hours to address an active zero-day vulnerability. The change request was submitted but the CAB is not scheduled to meet for another 24 hours. What is the BEST course of action?

Accepted Answer

Use the emergency change process to obtain expedited approval from a designated CAB member.. It aligns with the ITIL-based emergency change process, which allows for expedited approval from a designated CAB member or emergency authority when a critical security patch must be deployed within hours to mitigate an active zero-day vulnerability. This ensures the change is authorized without waiting for the full CAB meeting, maintaining security while preserving governance and audit trails.

Answer

Deploy the patch and inform the CAB after the fact during the next meeting.

Answer

Wait for the next scheduled CAB meeting to approve the change.

Answer

Deploy the patch immediately without any approval as it is a critical security fix.

Question 3

During an IT audit, the auditor discovers that the IT department has not conducted a business impact analysis (BIA) for three years. The organization's disaster recovery plan (DRP) is based on the previous BIA. The IT manager argues that the DRP is still valid because no major changes have occurred. What should the auditor recommend?

Accepted Answer

Recommend that a new BIA be conducted to validate and update the DRP.. A business impact analysis (BIA) is the foundation of a valid disaster recovery plan (DRP). Without a current BIA, the DRP may not reflect the organization's current critical processes, recovery time objectives (RTOs), or recovery point objectives (RPOs). Even if no major changes are perceived, subtle shifts in dependencies, resource availability, or regulatory requirements can render the DRP ineffective. Therefore, the auditor should recommend conducting a new BIA to validate and update the DRP.

Answer

Accept the IT manager's rationale and close the finding.

Answer

Recommend terminating the current DRP until the BIA is completed.

Answer

Recommend accepting the risk and documenting the decision.

Question 4

An organization is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of using a framework like COBIT?

Accepted Answer

Aligning IT strategy with business goals.. COBIT is designed to bridge the gap between business objectives and IT operations by providing a framework that maps IT processes to business goals. The primary benefit is ensuring that IT strategy directly supports and enables business strategy, rather than focusing on cost reduction or risk elimination.

Answer

Reducing IT operational costs.

Answer

Eliminating all IT-related risks.

Answer

Ensuring compliance with all regulatory requirements.

Question 5

An IT manager is reviewing the service level agreements (SLAs) for a cloud-based email service. The SLA guarantees 99.9% uptime per month. The service experienced an outage of 45 minutes in a 30-day month. Did the service meet the SLA?

Accepted Answer

No, because the allowed downtime for 99.9% uptime is approximately 43 minutes.. The SLA guarantees 99.9% uptime per month. For a 30-day month (43,200 minutes), 99.9% uptime allows only 0.1% downtime, which is 43.2 minutes. The actual outage of 45 minutes exceeds this threshold, so the SLA was not met. Option D correctly identifies the allowed downtime as approximately 43 minutes.

Answer

Yes, because 45 minutes is within 0.1% of the total time.

Answer

Yes, because the SLA is calculated per day, not per month.

Answer

No, because any downtime exceeding 30 minutes is a violation.

Question 6

Which TWO of the following are key components of an IT governance framework?

Accepted Answer

Strategic alignment. Strategic alignment (B) is a key component of an IT governance framework because it ensures that IT strategies, investments, and operations are directly linked to business goals and objectives. This alignment is achieved through mechanisms such as balanced scorecards, IT steering committees, and portfolio management, which translate business strategy into IT priorities. Without strategic alignment, IT may operate in a silo, leading to wasted resources and missed opportunities for business value.

Answer

Resource management

Answer

Performance measurement

Answer

Risk management

Question 7

Which THREE of the following are commonly recognized benefits of implementing a formal IT service management (ITSM) framework such as ITIL?

Accepted Answer

Better alignment between IT services and business needs. A formal ITSM framework like ITIL explicitly focuses on aligning IT service delivery with business objectives through defined processes like service strategy and service design. This alignment ensures that IT investments and operations directly support business outcomes, such as improving customer satisfaction or enabling new revenue streams, rather than operating in a silo.

Answer

Guaranteed zero downtime for critical services

Answer

Elimination of the need for external IT audits

Question 8

You are the IT governance lead at a multinational corporation with a complex IT environment spanning multiple business units. The company has recently experienced a series of minor security incidents where unauthorized access was gained through unused user accounts that were not disabled after employees left the organization. Additionally, there have been delays in provisioning access for new hires, leading to productivity losses. The IT department currently uses a manual process for access management, with each business unit maintaining its own user lists. The company has a policy that requires access reviews every quarter, but these are often missed or performed superficially. The CIO has asked you to recommend a solution that addresses these issues while ensuring compliance with regulations such as GDPR and SOX. Which of the following is the BEST course of action?

Accepted Answer

Implement an identity governance and administration (IGA) tool that automates user provisioning and de-provisioning, integrates with HR systems, and enforces access reviews.. Implementing an Identity Governance and Administration (IGA) tool directly addresses the root causes: manual, decentralized access management and lack of automated de-provisioning. IGA integrates with HR systems (e.g., Workday, SAP SuccessFactors) to trigger automatic account creation for new hires and immediate deactivation upon termination, eliminating orphaned accounts. It also enforces scheduled, auditable access reviews with certification workflows, ensuring compliance with GDPR (right to erasure, data minimization) and SOX (segregation of duties, access controls). This automated approach resolves both the security incidents from unused accounts and the productivity losses from delayed provisioning.

Answer

Require each business unit to submit monthly reports of active users to IT, which will then manually disable accounts not on the list.

Answer

Develop a new policy that mandates quarterly access reviews and disciplinary action for non-compliance.

Answer

Increase the frequency of access reviews to monthly and assign a dedicated team to perform them.

Question 9

Which TWO of the following are key responsibilities of an IT steering committee?

Accepted Answer

Approving the annual IT budget and major capital expenditures. The IT steering committee is a senior-level governance body responsible for aligning IT strategy with business objectives. Approving the annual IT budget and major capital expenditures (A) is a core fiduciary duty, ensuring resources are allocated to approved projects and initiatives. Defining IT policies and standards (C) establishes the governance framework for security, compliance, and operational consistency across the enterprise.

Answer

Performing daily system monitoring and incident response

Answer

Writing application code for new software features

Answer

Configuring firewall rules and network access controls

Question 10

Based on the exhibit, which control is most likely missing to prevent this type of event?

Accepted Answer

Implementing account lockout after three failed attempts. The exhibit describes a brute-force attack against an SSH service, where an attacker repeatedly attempts to guess credentials. Implementing account lockout after three failed attempts is the most direct control to prevent this type of event, as it halts further login attempts after a threshold, stopping the attack in its tracks regardless of password strength or patching.

Answer

Applying the latest security patches to the SSH service

Answer

Disabling direct root login via SSH

Answer

Enforcing strong password complexity

Question 11

A mid-sized company is implementing a new IT service management (ITSM) tool to improve incident management. The IT manager wants to ensure that the tool aligns with ITIL best practices. The company has a dedicated service desk team that handles about 200 incidents per week. The IT manager is considering whether to implement a self-service portal for users to submit incidents and check status, or to continue using email-based incident reporting. The service desk team is concerned that a self-service portal might reduce their direct interaction with users and potentially lead to less personalized support. However, the IT manager believes that a portal could improve efficiency and tracking. The company's IT governance framework requires that any major IT investment be approved by the steering committee and that there be a clear business case. The IT manager has prepared a business case but the steering committee wants to ensure that the solution is aligned with ITIL and that it addresses key incident management processes. Which of the following is the most appropriate next step for the IT manager?

Accepted Answer

Conduct a process review with stakeholders to define requirements based on ITIL guidelines before selecting a tool.. ITIL best practices emphasize that process design should precede tool selection. Conducting a process review with stakeholders ensures the self-service portal aligns with defined incident management workflows, such as categorization, prioritization, and escalation, before committing to a specific tool. This step also satisfies the IT governance requirement for a clear business case by validating requirements against ITIL guidelines.

Answer

Implement the self-service portal immediately to improve efficiency, then present the business case later.

Answer

Proceed with the self-service portal without further review because it is clearly beneficial.

Answer

Abandon the self-service portal idea and continue with email-based reporting.

Question 12

Arrange the steps to perform a risk assessment in the correct order.

Accepted Answer

Asset identification, then Threat/vulnerability identification, then Risk analysis, then Prioritization, then Documentation of treatment. Risk assessment begins with asset identification, then threat/vulnerability identification, followed by risk analysis, prioritization, and documentation of treatment.

Answer

Threat/vulnerability identification, then Asset identification, then Risk analysis, then Prioritization, then Documentation of treatment

Answer

Asset identification, then Risk analysis, then Threat/vulnerability identification, then Prioritization, then Documentation of treatment

Answer

Documentation of treatment, then Asset identification, then Threat/vulnerability identification, then Risk analysis, then Prioritization

Question 13

Order the steps for performing a data backup in the correct sequence.

Accepted Answer

Identify data to be backed up, then choose backup method, then schedule the backup, then execute backup and verify integrity, then store backup offsite.. Backup process: identify data, choose method, schedule, execute/verify, and store offsite.

Answer

Identify data to be backed up, then schedule the backup, then choose backup method, then execute backup and verify integrity, then store backup offsite.

Answer

Choose backup method, then identify data to be backed up, then schedule the backup, then execute backup and verify integrity, then store backup offsite.

Answer

Identify data to be backed up, then choose backup method, then execute backup and verify integrity, then schedule the backup, then store backup offsite.

Question 14

Match each COBIT 5 domain to its description.

Accepted Answer

EDM: Ensures stakeholder needs are addressed, governance objectives are met, and the enterprise is directed and monitored.. COBIT 5 has five process domains: EDM (governance), APO (planning), BAI (acquisition/implementation), DSS (delivery/support), and MEA (monitoring). Correct matches are as above; common confusions involve swapping APO/MEA or DSS/APO.

Answer

MEA: Manages IT resources and capabilities to optimize performance.

Answer

DSS: Ensures alignment of IT strategy with business goals.

Question 15

Match each log type to its typical content.

Accepted Answer

Audit Log: Records user activities and changes for compliance.. Logs are essential for monitoring and forensics. Correct matches: Audit Log tracks user activities and compliance, Security Log tracks security events, System Log tracks OS events, Application Log tracks application events. Common confusions include mixing system events with audit logs and application errors with security logs.

Answer

Audit Log: Records system startup/shutdown events.

Answer

Security Log: Records application errors.