CISA Governance and Management of IT Practice Test 4 — 15 Questions

Question 1

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. Which of the following BEST demonstrates that the proposal aligns with the organization's strategic goals?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The business case includes a clear link to the organization's five-year strategic plan.. A clear link to the organization's five-year strategic plan demonstrates that the proposal aligns with strategic goals. Option B is about the project manager's experience, which does not indicate strategic alignment. Option C describes a feature that may be beneficial but is not inherently tied to strategic goals. Option D is a cost-saving tactic, not evidence of strategic alignment.

Answer

The project manager has extensive experience with CRM implementations.

Answer

The proposed system includes advanced analytics capabilities.

Answer

The vendor offers discounted licensing for the first year.

Question 2

An organization has implemented a balanced scorecard (BSC) for IT performance measurement. Which of the following is the PRIMARY benefit of using a BSC?

Accepted Answer

It ensures IT metrics are aligned with business strategy.. The primary benefit of a balanced scorecard (BSC) is to align IT metrics with business strategy across multiple perspectives (financial, customer, internal processes, learning and growth). Option A is incorrect because BSC does not simplify budgeting; it includes both financial and non-financial metrics. Option C is incorrect because BSC does not automate data collection; it is a framework for measurement, not automation. Option D is incorrect because BSC does not provide a single financial metric; it uses a balanced set of metrics from multiple perspectives.

Answer

It simplifies the IT budgeting process.

Answer

It automates data collection for IT metrics.

Answer

It provides a single financial metric for IT performance.

Question 3

During an IT audit, the auditor discovers that the IT strategy is not formally documented. Which of the following is the MOST significant risk associated with this finding?

Accepted Answer

Lack of alignment between IT investments and business goals.. Without a formally documented IT strategy, IT investments may not be aligned with business goals, leading to misalignment and wasted resources. This is the most significant risk as it directly impacts the organization's ability to achieve its objectives. Option A is possible but less direct. Option B is a consequence but not the most significant. Option D is a potential outcome but not as critical as misalignment with business goals.

Answer

Difficulty in recruiting qualified IT staff.

Answer

Inability to measure the performance of IT systems.

Answer

Increased operational costs due to unplanned IT initiatives.

Question 4

An organization is planning to outsource its data center operations. Which of the following governance practices should be implemented to ensure proper oversight?

Accepted Answer

Establish a service level agreement (SLA) with key performance indicators (KPIs).. Establishing a service level agreement (SLA) with key performance indicators (KPIs) provides measurable performance targets and accountability, ensuring proper oversight of outsourced data center operations. Option A (annual financial audits) addresses financial compliance but not operational oversight. Option B (ISO 27001 certification) is a certification, not an ongoing governance practice. Option D (allowing the outsourcer to manage all security controls independently) abdicates the organization's responsibility for oversight.

Answer

Conduct annual financial audits of the outsourcer.

Answer

Require the outsourcer to obtain ISO 27001 certification.

Answer

Allow the outsourcer to manage all security controls independently.

Question 5

An IT governance framework has been implemented, but the board is not receiving regular reports on IT performance. Which of the following is the BEST course of action?

Accepted Answer

Develop a dashboard that presents key IT metrics to the board.. The best course of action because a dashboard provides a regular, concise view of key IT metrics for the board, directly addressing the lack of reporting. Option A (risk assessment) focuses on risk rather than reporting. Option C (balanced scorecard) is a broader strategic alignment tool. Option D (assigning a CIO) changes reporting structure but does not ensure regular reports.

Answer

Conduct an IT risk assessment to identify critical areas.

Answer

Implement an IT balanced scorecard that aligns with corporate strategy.

Answer

Assign a chief information officer (CIO) to report directly to the board.

Question 6

An IT audit revealed that the organization's IT steering committee has not met in the past six months. Which of the following is the MOST likely consequence of this situation?

Accepted Answer

Delayed decision-making on IT investments.. The IT steering committee is responsible for approving and prioritizing IT investments; without meetings, decisions on investments are delayed. Option A is less direct, as turnover is influenced by many factors. Option B is incorrect because security incidents are typically addressed by operational security teams. Option C is incorrect because IT policies are usually set by separate governance processes, not solely by the steering committee.

Answer

Higher IT staff turnover.

Answer

Increased number of security incidents.

Answer

Inconsistent IT policies across departments.

Question 7

An organization has decentralized IT management with each business unit making its own technology decisions. Which of the following is the BEST way to maintain enterprise-wide governance?

Accepted Answer

Establish an enterprise architecture review board with representatives from all business units.. An enterprise architecture review board with representatives from all business units ensures alignment with enterprise-wide standards and governance while respecting decentralized decision-making. Option A is too prescriptive and may not fit all units. Option B centralizes approval, which undermines decentralization. Option C addresses budgeting, not governance of IT decisions.

Answer

Deploy a single enterprise resource planning (ERP) system across all units.

Answer

Require all IT projects to be approved by the corporate IT department.

Answer

Create a central IT budget that allocates funds to business units.

Question 8

A company is implementing IT governance based on COBIT 2019. Which of the following design factors would have the GREATEST impact on the governance system design?

Accepted Answer

The industry and regulatory environment.. According to COBIT 2019, the industry and regulatory environment is a key design factor that significantly influences the governance system design, as it dictates compliance and risk management requirements. Options A, B, and C are factors but have a lesser impact compared to industry and regulatory considerations.

Answer

The IT infrastructure complexity.

Answer

The size of the organization.

Answer

The number of IT staff.

Question 9

An organization's IT strategy is developed by the IT department without input from business stakeholders. Which of the following is the MOST significant risk?

Accepted Answer

IT strategy may not support business objectives.. Without business input, the strategy may not support business objectives, leading to misalignment. Option A is a possible outcome. Options B and C are less directly related.

Answer

Technology may become obsolete quickly.

Answer

IT projects may exceed budget.

Answer

IT staff may lack required skills.

Question 10

Which TWO of the following are key components of an IT governance framework?

Accepted Answer

IT strategy committee. Options A and C are correct. An IT governance framework includes structures like an IT strategy committee (A) and processes like IT risk management (C). B (IT asset inventory) is an operational practice, D (IT project portfolio management) is a management practice, and E (IT help desk ticketing system) is operational. None of these are core governance components.

Answer

IT asset inventory

Answer

IT project portfolio management

Answer

IT help desk ticketing system

Question 11

An organization is adopting COBIT 2019. Which TWO of the following are components of the governance system?

Accepted Answer

Processes. The correct answers are A (Processes) and D (Organizational structures). COBIT 2019 defines governance system components that include processes and organizational structures, among others. Processes describe the organized sets of practices, while organizational structures define roles and responsibilities. Option B (IT hardware inventory) is a resource or asset, not a component of the governance system. Option C (Information flows) is related to the Information component but is not a standalone component; information itself is a component, but flows are part of processes. Option E (Employee satisfaction surveys) is an HR activity, not a governance component.

Answer

IT hardware inventory

Answer

Information flows

Answer

Employee satisfaction surveys

Question 12

Which THREE of the following are indicators of mature IT governance?

Accepted Answer

IT risks are formally assessed and managed.. Options B, D, and E are correct. Mature IT governance is indicated by formal risk assessment and management (B), alignment of IT decisions with business strategy (D), and regular board reporting on IT performance (E). Option A (high staff retention) is an HR metric, not a governance indicator. Option C (on-time and within-budget projects) is a project management measure, not a governance maturity indicator.

Answer

The IT department has high staff retention.

Answer

IT projects are completed on time and within budget.

Question 13

Based on the exhibit, what is the MOST appropriate action for IT management?

Accepted Answer

Investigate the reasons for the shortfall and implement corrective actions.. The actual score (82%) is below the target (85%), so IT management should investigate the reasons for the shortfall and implement corrective actions to close the gap. Option B (ignoring the variance) is not acceptable because the performance is below target and not within the acceptable range. Option C (adjusting the target to 80%) is premature without first understanding the root cause. Option D (replacing the survey) is an overreaction without evidence that the measurement tool is flawed.

Answer

Ignore the variance as it is within acceptable range.

Answer

Adjust the target to 80% to match actual performance.

Answer

Replace the survey with a different measurement tool.

Question 14

Which of the following is a potential risk in this RACI matrix?

Accepted Answer

The Change Manager is responsible but lacks authority to approve.. The Change Manager is responsible but lacks authority to approve. In a RACI matrix, the Responsible (R) party performs the work, while the Accountable (A) party is ultimately answerable and has approval authority. If the Change Manager is marked as Responsible for change approval without being Accountable, there is a risk that they may not have the proper authority to approve changes, leading to potential unauthorized changes. Option A is not necessarily a risk because being Accountable does not require being informed of all changes. Option B: IT Operations being informed is appropriate; they do not need to be Responsible for implementation. Option C: The Business Process Owner being consulted is normal and may cause delays but is not as critical as the authority issue. Thus, D is the most significant risk.

Answer

The IT Director is accountable but not informed of all changes.

Answer

IT Operations is informed, but should be responsible for implementation.

Answer

The Business Process Owner is consulted, which may delay approvals.

Question 15

What is the MOST significant weakness in the planned remediation?

Accepted Answer

The remediation may not eliminate the segregation of duties issue.. The planned remediation (e.g., an automated code review tool) does not ensure that the developer who writes the code is different from the person who reviews it. This fails to address the root cause of segregation of duties, making it the most significant weakness. Options A, C, and D are either less critical or not as directly related to the core issue.

Answer

The remediation only addresses a subset of projects.

Answer

The remediation relies on technology rather than process.

Answer

The remediation does not include a compensating control.