CISA Governance and Management of IT Practice Test 3 — 15 Questions

Question 1

A company is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of aligning IT strategy with business strategy?

Accepted Answer

Ensures IT investments support business objectives. Aligning IT strategy with business strategy ensures that IT investments support business objectives, delivering value and reducing waste. Reducing costs, improving morale, or simplifying architecture are secondary benefits.

Answer

Simplifies IT architecture

Answer

Improves IT staff morale

Answer

Reduces IT costs

Question 2

An organization has experienced several security incidents due to unauthorized changes to production systems. Which governance mechanism should be strengthened?

Accepted Answer

Change management process. A change management process ensures that all changes are authorized, tested, and approved, directly addressing unauthorized changes. Asset management, CMDB, and incident response are supportive but not the primary control.

Answer

IT asset management

Answer

Configuration management database

Answer

Incident response plan

Question 3

A multinational corporation is evaluating its IT governance structure. The board wants to ensure that IT investments are prioritized based on risk and value. Which framework component is MOST critical?

Accepted Answer

Portfolio management process. A portfolio management process systematically evaluates and prioritizes investments based on risk and value, aligning with board objectives. Steering committee provides oversight, but portfolio management is the mechanism for prioritization.

Answer

Service level agreements

Answer

Balanced scorecard

Answer

IT steering committee

Question 4

A small business lacks formal IT governance. What is the FIRST step to establish governance?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment identifies the most critical issues and guides the development of governance policies and structure. Defining policies or assigning roles without understanding risks may be premature.

Answer

Assign an IT manager

Answer

Define IT policies

Answer

Implement COBIT

Question 5

An IT department is struggling with project delays and budget overruns. Which governance practice would be MOST effective?

Accepted Answer

Establishing a project management office (PMO). Establishing a Project Management Office (PMO) provides standardized project management practices, oversight, and governance, addressing delays and overruns. Agile methodology alone may not provide governance; increasing staff or outsourcing may not solve underlying issues.

Answer

Outsourcing projects

Answer

Increasing IT staff

Answer

Adopting agile methodology

Question 6

A financial institution is required by regulators to demonstrate that IT controls are effective. Which of the following provides the BEST evidence?

Accepted Answer

Service organization control (SOC) reports. Service organization control (SOC) reports are independent audits of control effectiveness, highly regarded by regulators. Internal audit reports are valuable but may lack independence; risk register and balanced scorecard are not direct evidence of control effectiveness.

Answer

IT balanced scorecard

Answer

Internal audit reports

Answer

IT risk register

Question 7

An organization wants to ensure that IT performance is measured against strategic goals. Which tool is BEST suited?

Accepted Answer

Balanced scorecard. A balanced scorecard translates strategic goals into performance metrics across financial, customer, internal process, and learning perspectives. Gantt charts, SWOT analysis, and Pareto charts are not designed for this purpose.

Answer

Pareto chart

Answer

SWOT analysis

Answer

Gantt chart

Question 8

A company has multiple business units with conflicting IT priorities. Which governance body should resolve this?

Accepted Answer

IT steering committee. An IT steering committee, comprising business and IT leadership, is responsible for prioritizing IT initiatives and resolving conflicts. IT management may lack authority; board and audit committee have broader oversight roles.

Answer

Board of directors

Answer

IT management

Answer

Audit committee

Question 9

An organization's IT strategy is not aligned with business strategy due to lack of communication. Which of the following would BEST improve alignment?

Accepted Answer

Business-IT strategy mapping workshops. Business-IT strategy mapping workshops facilitate direct communication and collaboration, ensuring both sides understand and agree on priorities. Status reports, budget increases, or outsourcing do not address the communication gap.

Answer

Weekly IT status reports

Answer

Outsourcing non-core IT functions

Answer

IT budget increase

Question 10

An IT governance framework should include which TWO key components? (Select exactly two.)

Accepted Answer

Strategic alignment. Strategic alignment ensures IT supports business goals; performance measurement tracks achievement. Network firewall rules, user training, and vendor lock-in are operational or tactical, not core governance components.

Answer

User training

Answer

Vendor lock-in

Answer

Network firewall rules

Question 11

An organization is implementing IT governance based on COBIT. Which THREE of the following are enablers? (Select exactly three.)

Accepted Answer

Organizational structures. COBIT defines enablers as factors that influence the effectiveness of governance. Processes, organizational structures, and culture/ethics/behavior are key enablers. Network infrastructure and application software are resources, not enablers in the COBIT framework.

Answer

Application software

Answer

Network infrastructure

Question 12

A large enterprise is assessing its IT governance maturity. Which THREE of the following are indicators of a mature governance process? (Select exactly three.)

Accepted Answer

There is a formal IT governance committee. Mature governance involves board-level review of IT strategy, linking IT metrics to business outcomes, and having a formal governance committee. Decisions in silos and historical budget allocation are signs of low maturity.

Answer

IT decisions are made in silos

Answer

IT budget is allocated based on historical spending

Question 13

Refer to the exhibit. Based on the governance status report, which component should be addressed as a priority?

Accepted Answer

Resource Optimization. Resource Optimization has a Red status, indicating critical risk or non-compliance, requiring immediate attention. Green and Yellow components are less urgent.

Answer

Strategy Alignment

Answer

Performance Measurement

Answer

Risk Management

Question 14

Refer to the exhibit. The organization is planning to achieve the target level. What is the MOST appropriate action?

Accepted Answer

Implement process metrics and statistical controls. To move from Level 3 (Established) to Level 4 (Predictable), the process must be measured and controlled using statistical techniques. Implementing metrics and statistical controls directly addresses the gap. Documentation, ownership, and training are earlier-level activities.

Answer

Assign a process owner

Answer

Conduct awareness training

Answer

Increase process documentation

Question 15

Refer to the exhibit. Which perspective shows the greatest deviation from target?

Accepted Answer

Learning & Growth. Learning & Growth is 30 hours short of 150 (20% deficit), while Financial is 10% short, Internal Process is 4% short, and Customer exceeds target. Thus, Learning & Growth has the largest negative gap.

Answer

Customer

Answer

Financial

Answer

Internal Process