CISA Governance and Management of IT Practice Test 2 — 15 Questions

Question 1

According to COBIT 2019, which design factor is MOST critical for tailoring a governance system?

Accepted Answer

Enterprise strategy. According to COBIT 2019, the most critical design factor for tailoring a governance system is the enterprise strategy. COBIT 2019 identifies 11 design factors, and enterprise strategy is considered the most important because it drives the goals, risk appetite, and overall direction of the governance system. All other factors should align with the enterprise strategy.

Answer

Regulatory environment

Answer

Technology complexity

Answer

Organizational size

Question 2

Based on the exhibit, which metric would be LEAST relevant to the 'Customer' perspective?

Accepted Answer

System Uptime Percentage. (System Uptime Percentage) is the least relevant to the Customer perspective because system uptime is an operational metric that primarily supports the Internal Process perspective (e.g., reliability and availability). In contrast, the other options directly measure customer satisfaction and engagement: Number of New Features (customer-driven innovation), Satisfaction Survey Score (direct feedback), and Complaint Resolution Time (service responsiveness). While uptime may indirectly affect customer satisfaction, it is not a direct measure of the customer perspective as defined by balanced scorecard frameworks.

Answer

Number of New Features Delivered

Answer

Satisfaction Survey Score

Answer

Complaint Resolution Time

Question 3

Based on the exhibit, what is the default retention period for data?

Accepted Answer

365 days. The exhibit shows a data retention policy where the default retention period is explicitly set to 365 days. This is the baseline period applied when no other specific retention rule (e.g., for legal holds or specific data types) overrides it. In CISA governance contexts, a default retention period ensures that data is not kept indefinitely without justification, aligning with privacy and records management principles. The 365-day default is a common baseline in many policy templates, representing one full calendar year.

Answer

30 days for Legal role only

Answer

The policy does not specify a default period

Answer

30 days

Question 4

An IS auditor is reviewing the balanced scorecard for IT. Which of the following metrics BEST aligns with the 'customer perspective'?

Accepted Answer

Average system uptime for critical applications. The balanced scorecard's customer perspective measures how customers perceive the organization's products and services, so availability of critical applications — which directly affects user experience and satisfaction — is the best fit. Uptime is a customer-facing service quality metric that maps cleanly to the customer perspective.

Answer

Percentage of IT projects under budget

Answer

Number of change requests completed on time

Answer

Percentage of staff with ITIL certification

Question 5

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

Performance measurement. Option B (Performance measurement) is correct because an IT governance framework must define metrics, KPIs, and reporting mechanisms (e.g., balanced scorecards, COBIT goals and metrics) to monitor whether IT delivers value and complies with objectives. Option D (Strategic alignment of IT with business) is correct because aligning IT investments, services, and priorities with business strategy is a core governance principle in frameworks such as COBIT and ISO/IEC 38500. The unmarked options do not belong: a configuration management database (A) is a CMDB used in ITIL service transition/configuration management, vulnerability assessment results (C) are technical security findings from scanning, and firewall rules (E) are operational security controls—all are tactical artifacts rather than governance framework components.

Answer

Configuration management database

Answer

Vulnerability assessment results

Answer

Firewall rules

Question 6

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Approving the IT strategy. Option B is correct because the board of directors is responsible for approving the organization's IT strategy, ensuring it aligns with business objectives and long-term goals. Option C is correct because reviewing and approving IT policies is a core governance duty that sets the direction and boundaries for how IT is managed and controlled. Option E is correct because the board must ensure that IT risks are managed within acceptable levels, which is a fundamental element of IT governance and risk oversight. Option A is incorrect because implementing IT security controls is an operational/management responsibility, typically carried out by IT staff, not the board. Option D is incorrect because monitoring daily IT operations is an operational task performed by IT management and staff, not a board-level governance responsibility.

Answer

Implementing IT security controls

Answer

Monitoring daily IT operations

Question 7

An organization uses the policy shown. Which of the following is an omission in the policy?

Accepted Answer

No specification of data disposal methods after retention periods. The policy excerpt (not fully shown, but implied to cover data retention) explicitly addresses retention periods but fails to specify how data should be disposed of once those periods expire. For CISA, a complete data retention policy must include secure disposal methods (e.g., shredding, degaussing, cryptographic erasure) to prevent unauthorized recovery of sensitive information. Without this, the policy leaves a critical gap in the information lifecycle, violating the principle that data must be securely destroyed when no longer needed. Thus, the omission is the lack of disposal methods after retention.

Answer

No definition of authorized users

Answer

No mention of backup frequency

Answer

Missing encryption requirement for log data

Question 8

Based on the log, what is the MOST likely root cause of the backup failure?

Accepted Answer

Insufficient storage capacity. The log entry shows a backup failure with an error indicating that the destination volume has insufficient free space to complete the operation. This is a classic symptom of insufficient storage capacity, where the backup job cannot write additional data because the target disk or tape is full. The error message typically includes phrases like 'not enough space' or 'disk full', directly pointing to storage exhaustion as the root cause. Therefore, option D is the most likely root cause.

Answer

Network connectivity issues

Answer

Incorrect backup schedule

Answer

Backup software corruption

Question 9

Which TWO of the following are primary objectives of IT governance as defined by COBIT 5?

Accepted Answer

Resource optimization. Options A and D are correct because COBIT 5 defines primary IT governance objectives as stakeholder value delivery and resource optimization. Option B (cost reduction) is a management objective, not governance. Option C (incident response) is an operational activity. Option E (data encryption) is a security control.

Answer

Cost reduction

Answer

Incident response

Answer

Data encryption

Question 10

A government agency has an IT governance framework that includes an IT strategy committee, an IT steering committee, and a project management office. Despite this, there is a lack of transparency regarding IT spending and resource allocation. The agency's annual audit found that several IT initiatives were not approved by the steering committee and were funded out of operational budgets. The CFO is frustrated because IT costs are unpredictable. The agency's chief information officer (CIO) reports to the CFO but the IT steering committee is chaired by the CIO. The auditor's best recommendation to improve governance is to:

Accepted Answer

Change the steering committee chair to a senior business executive independent of IT. The core governance issue is that the IT steering committee is chaired by the CIO, who also reports to the CFO, creating a conflict of interest and lack of independent oversight. For effective IT governance, the steering committee should be chaired by a senior business executive independent of IT to ensure that IT investments are aligned with business strategy and that spending is transparent. This change addresses the root cause of unapproved initiatives and unpredictable costs.

Answer

Establish a chargeback system to allocate IT costs to business units

Answer

Require all IT projects to submit a business case to the steering committee for approval

Answer

Implement a policy that prohibits funding IT projects from operational budgets without steering committee approval

Question 11

Based on the exhibit, which control deficiency is most critical for the IS auditor to address?

Accepted Answer

The system lacks a policy to lock accounts after repeated failed login attempts. The most critical deficiency because without an account lockout policy, the system is vulnerable to brute-force password guessing attacks. Even if other controls like SSH key authentication are missing, a lockout policy is a fundamental defense that directly mitigates repeated login attempts, which is a primary attack vector for gaining unauthorized access.

Answer

SSH is configured to allow root login

Answer

The admin user logged in successfully with a password

Answer

Public key authentication is not being used

Question 12

An IS auditor is reviewing an organization's IT governance structure. The IT steering committee, composed of business unit leaders and the CIO, meets quarterly to prioritize IT investments. However, the auditor finds that the committee has no authority to enforce decisions, and project funding is often overridden by individual executives. Which of the following is the MOST significant governance weakness?

Accepted Answer

The IT steering committee lacks decision-making authority, undermining IT governance.. The IT steering committee's primary role is to prioritize and govern IT investments. If it lacks the authority to enforce its decisions, it cannot fulfill its governance mandate. This leads to misalignment between IT and business strategy, potential resource waste, and reduced accountability. The other issues, while relevant, are secondary to the fundamental lack of decision-making power.

Answer

The committee includes business unit leaders, which dilutes IT expertise.

Answer

The committee meets only quarterly, which is too infrequent for effective oversight.

Answer

Individual executives can override funding decisions, which indicates a lack of executive support.

Question 13

An IS auditor is evaluating an organization's IT governance maturity using COBIT 2019. The organization has defined IT processes and roles, but performance is not consistently measured, and there is no continuous improvement mechanism. Which of the following maturity levels BEST describes this organization?

Accepted Answer

Defined. COBIT 2019 defines maturity levels from 0 to 5. The Defined level (Level 2) is where processes are documented and standardized, but performance is not consistently measured, and continuous improvement is absent. The scenario describes an organization with defined processes and roles but no consistent measurement or improvement, which aligns with Defined. The auditor should use this to recommend moving toward Managed by implementing performance metrics and improvement mechanisms.

Answer

Optimized

Answer

Managed

Answer

Initial

Question 14

An IS auditor is reviewing an organization's IT governance. The board of directors has delegated IT oversight to the audit committee, which meets twice a year. The CIO reports to the CFO, and there is no separate IT strategy committee. Which of the following is the MOST significant governance concern?

Accepted Answer

The audit committee may lack the necessary IT expertise to oversee IT governance effectively.. Effective IT governance requires oversight bodies to have sufficient IT knowledge to evaluate IT risks and strategic alignment. Delegating IT oversight to an audit committee without IT expertise can lead to inadequate governance. While reporting lines and meeting frequency are relevant, the most significant concern is the committee's ability to understand and challenge IT decisions.

Answer

Meeting only twice a year is insufficient for effective IT oversight.

Answer

The CIO reporting to the CFO may dilute IT's strategic focus.

Answer

The absence of a separate IT strategy committee means IT strategy is not aligned with business strategy.

Question 15

A large enterprise recently experienced a data breach due to an insider threat. The IT governance committee is reviewing the incident and considering measures to prevent recurrence. Which of the following is the BEST course of action to address the root cause?

Accepted Answer

Implement a privileged access management (PAM) solution to control and monitor elevated access.. A privileged access management (PAM) solution directly addresses the root cause of an insider threat by controlling, monitoring, and auditing elevated access rights. Since the breach was caused by an insider, limiting and tracking privileged accounts prevents unauthorized or excessive use of administrative credentials, which is the most effective preventive measure against recurrence.

Answer

Increase logging and auditing of all user activities.

Answer

Deploy a security information and event management (SIEM) tool.

Answer

Terminate the employment of the insider who caused the breach.