CISA Governance and Management of IT Practice Test 3 — 15 Questions

Question 1

A multinational corporation is evaluating its IT governance structure. The board wants to ensure that IT investments are prioritized based on risk and value. Which framework component is MOST critical?

Accepted Answer

Portfolio management process. A portfolio management process systematically evaluates and prioritizes investments based on risk and value, aligning with board objectives. Steering committee provides oversight, but portfolio management is the mechanism for prioritization.

Answer

Service level agreements

Answer

Balanced scorecard

Answer

IT steering committee

Question 2

A small business lacks formal IT governance. What is the FIRST step to establish governance?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment identifies the most critical issues and guides the development of governance policies and structure. Defining policies or assigning roles without understanding risks may be premature.

Answer

Assign an IT manager

Answer

Define IT policies

Answer

Implement COBIT

Question 3

An IT department is struggling with project delays and budget overruns. Which governance practice would be MOST effective?

Accepted Answer

Establishing a project management office (PMO). Establishing a Project Management Office (PMO) provides standardized project management practices, oversight, and governance, addressing delays and overruns. Agile methodology alone may not provide governance; increasing staff or outsourcing may not solve underlying issues.

Answer

Outsourcing projects

Answer

Increasing IT staff

Answer

Adopting agile methodology

Question 4

A financial institution is required by regulators to demonstrate that IT controls are effective. Which of the following provides the BEST evidence?

Accepted Answer

Service organization control (SOC) reports. Service organization control (SOC) reports are independent audits of control effectiveness, highly regarded by regulators. Internal audit reports are valuable but may lack independence; risk register and balanced scorecard are not direct evidence of control effectiveness.

Answer

IT balanced scorecard

Answer

Internal audit reports

Answer

IT risk register

Question 5

An organization wants to ensure that IT performance is measured against strategic goals. Which tool is BEST suited?

Accepted Answer

Balanced scorecard. A balanced scorecard translates strategic goals into performance metrics across financial, customer, internal process, and learning perspectives. Gantt charts, SWOT analysis, and Pareto charts are not designed for this purpose.

Answer

Pareto chart

Answer

SWOT analysis

Answer

Gantt chart

Question 6

A company has multiple business units with conflicting IT priorities. Which governance body should resolve this?

Accepted Answer

IT steering committee. An IT steering committee, comprising business and IT leadership, is responsible for prioritizing IT initiatives and resolving conflicts. IT management may lack authority; board and audit committee have broader oversight roles.

Answer

Board of directors

Answer

IT management

Answer

Audit committee

Question 7

An organization's IT strategy is not aligned with business strategy due to lack of communication. Which of the following would BEST improve alignment?

Accepted Answer

Business-IT strategy mapping workshops. Business-IT strategy mapping workshops facilitate direct communication and collaboration, ensuring both sides understand and agree on priorities. Status reports, budget increases, or outsourcing do not address the communication gap.

Answer

Weekly IT status reports

Answer

Outsourcing non-core IT functions

Answer

IT budget increase

Question 8

An IT governance framework should include which TWO key components? (Select exactly two.)

Accepted Answer

Strategic alignment. Strategic alignment ensures IT supports business goals; performance measurement tracks achievement. Network firewall rules, user training, and vendor lock-in are operational or tactical, not core governance components.

Answer

User training

Answer

Vendor lock-in

Answer

Network firewall rules

Question 9

An organization is implementing IT governance based on COBIT. Which THREE of the following are enablers? (Select exactly three.)

Accepted Answer

Organizational structures. COBIT defines enablers as factors that influence the effectiveness of governance. Processes, organizational structures, and culture/ethics/behavior are key enablers. Network infrastructure and application software are resources, not enablers in the COBIT framework.

Answer

Application software

Answer

Network infrastructure

Question 10

A large enterprise is assessing its IT governance maturity. Which THREE of the following are indicators of a mature governance process? (Select exactly three.)

Accepted Answer

There is a formal IT governance committee. Mature governance involves board-level review of IT strategy, linking IT metrics to business outcomes, and having a formal governance committee. Decisions in silos and historical budget allocation are signs of low maturity.

Answer

IT decisions are made in silos

Answer

IT budget is allocated based on historical spending

Question 11

Refer to the exhibit. Based on the governance status report, which component should be addressed as a priority?

Accepted Answer

Resource Optimization. Resource Optimization has a Red status, indicating critical risk or non-compliance, requiring immediate attention. Green and Yellow components are less urgent.

Answer

Strategy Alignment

Answer

Performance Measurement

Answer

Risk Management

Question 12

Refer to the exhibit. The organization is planning to achieve the target level. What is the MOST appropriate action?

Accepted Answer

Implement process metrics and statistical controls. To move from Level 3 (Established) to Level 4 (Predictable), the process must be measured and controlled using statistical techniques. Implementing metrics and statistical controls directly addresses the gap. Documentation, ownership, and training are earlier-level activities.

Answer

Assign a process owner

Answer

Conduct awareness training

Answer

Increase process documentation

Question 13

Refer to the exhibit. Which perspective shows the greatest deviation from target?

Accepted Answer

Learning & Growth. Learning & Growth is 30 hours short of 150 (20% deficit), while Financial is 10% short, Internal Process is 4% short, and Customer exceeds target. Thus, Learning & Growth has the largest negative gap.

Answer

Customer

Answer

Financial

Answer

Internal Process

Question 14

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. Which of the following BEST demonstrates that the proposal aligns with the organization's strategic goals?

Accepted Answer

The business case includes a clear link to the organization's five-year strategic plan.. Option C is correct because a clear link to the organization's strategic plan demonstrates alignment. Option A is about PM experience, not alignment. Option B is a feature that may not be strategic. Option D is a cost-saving tactic, not evidence of strategic alignment.

Answer

The project manager has extensive experience with CRM implementations.

Answer

The proposed system includes advanced analytics capabilities.

Answer

The vendor offers discounted licensing for the first year.

Question 15

An organization has implemented a balanced scorecard (BSC) for IT performance measurement. Which of the following is the PRIMARY benefit of using a BSC?

Accepted Answer

It ensures IT metrics are aligned with business strategy.. Option B is correct because the balanced scorecard aligns IT metrics with business strategy across multiple perspectives. Option A is incorrect because BSC includes non-financial metrics. Option C is not the primary benefit; BSC does not simplify budgeting. Option D is not correct; data collection is not automated by BSC.

Answer

It simplifies the IT budgeting process.

Answer

It automates data collection for IT metrics.

Answer

It provides a single financial metric for IT performance.