CISA Governance and Management of IT Practice Test 4 — 15 Questions

Question 1

An IT manager is reviewing the service level agreements (SLAs) for a cloud-based email service. The SLA guarantees 99.9% uptime per month. The service experienced an outage of 45 minutes in a 30-day month. Did the service meet the SLA?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No, because the allowed downtime for 99.9% uptime is approximately 43 minutes.. The SLA guarantees 99.9% uptime per month. For a 30-day month (43,200 minutes), 99.9% uptime allows only 0.1% downtime, which is 43.2 minutes. The actual outage of 45 minutes exceeds this threshold, so the SLA was not met. Option D correctly identifies the allowed downtime as approximately 43 minutes.

Answer

Yes, because 45 minutes is within 0.1% of the total time.

Answer

Yes, because the SLA is calculated per day, not per month.

Answer

No, because any downtime exceeding 30 minutes is a violation.

Question 2

Which THREE of the following are commonly recognized benefits of implementing a formal IT service management (ITSM) framework such as ITIL?

Accepted Answer

Better alignment between IT services and business needs. Option A is correct because ITSM frameworks like ITIL are built around service-level alignment, using practices such as Service Level Management and Demand Management to ensure IT services directly support business objectives and outcomes. Option D is correct because ITIL's Service Design and Continual Service Improvement practices, along with Availability Management and Incident Management, are specifically designed to raise service quality and availability through defined SLAs, OLAs, and KPIs. Option E is correct because standardizing processes such as Change Enablement, Incident Management, and Problem Management reduces ad hoc work, eliminates duplication, and lowers cost through repeatable, measurable workflows. Option B is not correct because no framework can guarantee zero downtime; ITIL only improves availability through resilience and recovery practices, and outages can still occur. Option C is not correct because adopting ITSM does not remove the need for external IT audits; regulatory, statutory, and third-party audit requirements (e.g., SOX, ISO 27001) remain independent of ITIL adoption.

Answer

Guaranteed zero downtime for critical services

Answer

Elimination of the need for external IT audits

Question 3

You are the IT governance lead at a multinational corporation with a complex IT environment spanning multiple business units. The company has recently experienced a series of minor security incidents where unauthorized access was gained through unused user accounts that were not disabled after employees left the organization. Additionally, there have been delays in provisioning access for new hires, leading to productivity losses. The IT department currently uses a manual process for access management, with each business unit maintaining its own user lists. The company has a policy that requires access reviews every quarter, but these are often missed or performed superficially. The CIO has asked you to recommend a solution that addresses these issues while ensuring compliance with regulations such as GDPR and SOX. Which of the following is the BEST course of action?

Accepted Answer

Implement an identity governance and administration (IGA) tool that automates user provisioning and de-provisioning, integrates with HR systems, and enforces access reviews.. Implementing an Identity Governance and Administration (IGA) tool directly addresses the root causes: manual, decentralized access management and lack of automated de-provisioning. IGA integrates with HR systems (e.g., Workday, SAP SuccessFactors) to trigger automatic account creation for new hires and immediate deactivation upon termination, eliminating orphaned accounts. It also enforces scheduled, auditable access reviews with certification workflows, ensuring compliance with GDPR (right to erasure, data minimization) and SOX (segregation of duties, access controls). This automated approach resolves both the security incidents from unused accounts and the productivity losses from delayed provisioning.

Answer

Require each business unit to submit monthly reports of active users to IT, which will then manually disable accounts not on the list.

Answer

Develop a new policy that mandates quarterly access reviews and disciplinary action for non-compliance.

Answer

Increase the frequency of access reviews to monthly and assign a dedicated team to perform them.

Question 4

Based on the exhibit, which control is most likely missing to prevent this type of event?

Accepted Answer

Implementing account lockout after three failed attempts. The exhibit describes a brute-force attack against an SSH service, where an attacker repeatedly attempts to guess credentials. Implementing account lockout after three failed attempts is the most direct control to prevent this type of event, as it halts further login attempts after a threshold, stopping the attack in its tracks regardless of password strength or patching.

Answer

Applying the latest security patches to the SSH service

Answer

Disabling direct root login via SSH

Answer

Enforcing strong password complexity

Question 5

A mid-sized company is implementing a new IT service management (ITSM) tool to improve incident management. The IT manager wants to ensure that the tool aligns with ITIL best practices. The company has a dedicated service desk team that handles about 200 incidents per week. The IT manager is considering whether to implement a self-service portal for users to submit incidents and check status, or to continue using email-based incident reporting. The service desk team is concerned that a self-service portal might reduce their direct interaction with users and potentially lead to less personalized support. However, the IT manager believes that a portal could improve efficiency and tracking. The company's IT governance framework requires that any major IT investment be approved by the steering committee and that there be a clear business case. The IT manager has prepared a business case but the steering committee wants to ensure that the solution is aligned with ITIL and that it addresses key incident management processes. Which of the following is the most appropriate next step for the IT manager?

Accepted Answer

Conduct a process review with stakeholders to define requirements based on ITIL guidelines before selecting a tool.. ITIL best practices emphasize that process design should precede tool selection. Conducting a process review with stakeholders ensures the self-service portal aligns with defined incident management workflows, such as categorization, prioritization, and escalation, before committing to a specific tool. This step also satisfies the IT governance requirement for a clear business case by validating requirements against ITIL guidelines.

Answer

Implement the self-service portal immediately to improve efficiency, then present the business case later.

Answer

Proceed with the self-service portal without further review because it is clearly beneficial.

Answer

Abandon the self-service portal idea and continue with email-based reporting.

Question 6

Arrange the steps to perform a risk assessment in the correct order.

Accepted Answer

Asset identification, then Threat/vulnerability identification, then Risk analysis, then Prioritization, then Documentation of treatment. Risk assessment begins with asset identification, then threat/vulnerability identification, followed by risk analysis, prioritization, and documentation of treatment.

Answer

Threat/vulnerability identification, then Asset identification, then Risk analysis, then Prioritization, then Documentation of treatment

Answer

Asset identification, then Risk analysis, then Threat/vulnerability identification, then Prioritization, then Documentation of treatment

Answer

Documentation of treatment, then Asset identification, then Threat/vulnerability identification, then Risk analysis, then Prioritization

Question 7

Order the steps for performing a data backup in the correct sequence.

Accepted Answer

Identify data to be backed up, then choose backup method, then schedule the backup, then execute backup and verify integrity, then store backup offsite.. Backup process: identify data, choose method, schedule, execute/verify, and store offsite.

Answer

Identify data to be backed up, then schedule the backup, then choose backup method, then execute backup and verify integrity, then store backup offsite.

Answer

Choose backup method, then identify data to be backed up, then schedule the backup, then execute backup and verify integrity, then store backup offsite.

Answer

Identify data to be backed up, then choose backup method, then execute backup and verify integrity, then schedule the backup, then store backup offsite.

Question 8

A company is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of aligning IT strategy with business strategy?

Accepted Answer

Ensures IT investments support business objectives. Aligning IT strategy with business strategy ensures that technology investments, projects, and resources are directed toward achieving the organization's business goals, which is the fundamental purpose of IT governance frameworks like COBIT. This alignment translates business objectives into IT priorities so that every dollar and hour spent on IT delivers measurable business value.

Answer

Simplifies IT architecture

Answer

Improves IT staff morale

Answer

Reduces IT costs

Question 9

An organization has experienced several security incidents due to unauthorized changes to production systems. Which governance mechanism should be strengthened?

Accepted Answer

Change management process. Unauthorized changes to production systems indicate a failure in the change management process, which is designed to control and authorize modifications. Strengthening change management ensures that all changes are reviewed, approved, and documented, reducing the risk of unauthorized alterations. The other mechanisms address asset inventory, configuration data, or incident response, but do not directly prevent unauthorized changes.

Answer

IT asset management

Answer

Configuration management database

Answer

Incident response plan

Question 10

A multinational corporation is evaluating its IT governance structure. The board wants to ensure that IT investments are prioritized based on risk and value. Which framework component is MOST critical?

Accepted Answer

Portfolio management process. A portfolio management process systematically evaluates and prioritizes investments based on risk and value, aligning with board objectives. Steering committee provides oversight, but portfolio management is the mechanism for prioritization.

Answer

Service level agreements

Answer

Balanced scorecard

Answer

IT steering committee

Question 11

An IT department is struggling with project delays and budget overruns. Which governance practice would be MOST effective?

Accepted Answer

Establishing a project management office (PMO). A PMO provides centralized governance, standardizes project management processes, and enforces oversight across all projects. This directly addresses the root causes of delays and overruns—lack of consistent methodology, resource coordination, and performance monitoring. By establishing a PMO, the IT department gains the structure needed to plan, execute, and control projects effectively, making it the most comprehensive governance practice.

Answer

Outsourcing projects

Answer

Increasing IT staff

Answer

Adopting agile methodology

Question 12

An organization wants to ensure that IT performance is measured against strategic goals. Which tool is BEST suited?

Accepted Answer

Balanced scorecard. A balanced scorecard measures organizational performance across four perspectives — financial, customer, internal business processes, and learning and growth — and explicitly links operational metrics to strategic objectives. This makes it the best tool for ensuring IT performance is measured against strategic goals, since it translates strategy into measurable KPIs.

Answer

Pareto chart

Answer

SWOT analysis

Answer

Gantt chart

Question 13

A company has multiple business units with conflicting IT priorities. Which governance body should resolve this?

Accepted Answer

IT steering committee. An IT steering committee is the governance body composed of senior business and IT leaders that prioritizes IT investments and resolves conflicts between business units' competing IT priorities. It exists precisely to arbitrate cross-functional prioritization and align IT initiatives with business strategy, making it the correct forum for resolving conflicting priorities among business units.

Answer

Board of directors

Answer

IT management

Answer

Audit committee

Question 14

An organization's IT strategy is not aligned with business strategy due to lack of communication. Which of the following would BEST improve alignment?

Accepted Answer

Business-IT strategy mapping workshops. Business-IT strategy mapping workshops bring business and IT stakeholders together to explicitly map IT initiatives to business goals, which directly addresses the lack of communication and misalignment. This collaborative exercise creates shared understanding and a documented linkage between IT investments and business outcomes, which is the most effective way to improve alignment. It is a governance and communication mechanism, not just a reporting or budgeting action.

Answer

Weekly IT status reports

Answer

Outsourcing non-core IT functions

Answer

IT budget increase

Question 15

An IT governance framework should include which TWO key components? (Select exactly two.)

Accepted Answer

Strategic alignment. Strategic alignment (C) is a core component of any IT governance framework because governance must ensure that IT investments, priorities, and initiatives directly support the organization's business goals and objectives. Performance measurement (E) is equally essential, as governance requires metrics, KPIs, and monitoring mechanisms (such as balanced scorecards or COBIT goals) to verify that IT delivers value, manages risk, and meets agreed service levels. Together, these two components reflect the dual governance mandate of directing IT toward business strategy while measuring whether it actually delivers. The other options do not belong: user training (A) is an operational capability rather than a governance component, vendor lock-in (B) is a risk to be avoided, not a framework element, and network firewall rules (D) are technical security controls, not governance-level components.

Answer

User training

Answer

Vendor lock-in

Answer

Network firewall rules