CISA Governance and Management of IT Practice Test 5 — 15 Questions

Question 1

A large enterprise is assessing its IT governance maturity. Which THREE of the following are indicators of a mature governance process? (Select exactly three.)

Accepted Answer

There is a formal IT governance committee. Option C is correct because a formal IT governance committee establishes clear accountability, decision rights, and oversight structures, which are hallmarks of a mature governance process rather than ad hoc or siloed decision-making. Option D is correct because linking IT performance metrics to business outcomes demonstrates that governance is aligned with enterprise strategy and value delivery, a key maturity indicator in frameworks such as COBIT. Option E is correct because regular board-level review of IT strategy, such as quarterly, shows sustained executive engagement, strategic alignment, and proactive oversight rather than reactive or infrequent attention. Options A and B do not belong because siloed IT decision-making and budget allocation based solely on historical spending reflect immature, reactive governance practices that lack integration, strategic alignment, and value-based prioritization.

Answer

IT decisions are made in silos

Answer

IT budget is allocated based on historical spending

Question 2

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. Which of the following BEST demonstrates that the proposal aligns with the organization's strategic goals?

Accepted Answer

The business case includes a clear link to the organization's five-year strategic plan.. The business case including a clear link to the organization's five-year strategic plan directly demonstrates alignment with strategic goals. This shows that the CRM proposal is not just a tactical IT purchase but is explicitly tied to the long-term objectives of the organization, which is the best evidence of strategic alignment.

Answer

The project manager has extensive experience with CRM implementations.

Answer

The proposed system includes advanced analytics capabilities.

Answer

The vendor offers discounted licensing for the first year.

Question 3

An organization has implemented a balanced scorecard (BSC) for IT performance measurement. Which of the following is the PRIMARY benefit of using a BSC?

Accepted Answer

It ensures IT metrics are aligned with business strategy.. A balanced scorecard (BSC) translates an organization's mission and strategy into a comprehensive set of performance measures across four perspectives: financial, customer, internal business processes, and learning and growth. Its primary benefit in an IT context is ensuring that IT metrics and activities are directly linked to and driven by business strategy, rather than being measured in isolation. This strategic alignment is the defining purpose of the BSC framework as developed by Kaplan and Norton.

Answer

It simplifies the IT budgeting process.

Answer

It automates data collection for IT metrics.

Answer

It provides a single financial metric for IT performance.

Question 4

During an IT audit, the auditor discovers that the IT strategy is not formally documented. Which of the following is the MOST significant risk associated with this finding?

Accepted Answer

Lack of alignment between IT investments and business goals.. An undocumented IT strategy means there is no formal link between technology investment decisions and business objectives, so IT spending, projects, and priorities can drift away from what the organization is actually trying to achieve. This strategic misalignment is the most significant risk because it undermines value delivery across the entire IT portfolio, not just one operational area. Auditors treat the IT strategy as the governing document that translates business goals into IT direction, so its absence is a governance-level finding.

Answer

Difficulty in recruiting qualified IT staff.

Answer

Inability to measure the performance of IT systems.

Answer

Increased operational costs due to unplanned IT initiatives.

Question 5

An organization is planning to outsource its data center operations. Which of the following governance practices should be implemented to ensure proper oversight?

Accepted Answer

Establish a service level agreement (SLA) with key performance indicators (KPIs).. Establishing an SLA with KPIs is a fundamental governance practice for outsourcing because it defines measurable performance expectations and provides a basis for monitoring and enforcing the provider's obligations. It ensures the outsourcer is accountable for service delivery and aligns with business objectives.

Answer

Conduct annual financial audits of the outsourcer.

Answer

Require the outsourcer to obtain ISO 27001 certification.

Answer

Allow the outsourcer to manage all security controls independently.

Question 6

An IT governance framework has been implemented, but the board is not receiving regular reports on IT performance. Which of the following is the BEST course of action?

Accepted Answer

Develop a dashboard that presents key IT metrics to the board.. The gap identified is that the board is not receiving regular IT performance reports — a communication and reporting deficiency, not a risk identification or organizational design problem. Developing a dashboard that presents key IT metrics to the board (B) directly closes that gap by establishing a repeatable, structured reporting mechanism that gives the board visibility into IT performance. It is the most targeted, proportionate response to the stated deficiency.

Answer

Conduct an IT risk assessment to identify critical areas.

Answer

Implement an IT balanced scorecard that aligns with corporate strategy.

Answer

Assign a chief information officer (CIO) to report directly to the board.

Question 7

An IT audit revealed that the organization's IT steering committee has not met in the past six months. Which of the following is the MOST likely consequence of this situation?

Accepted Answer

Delayed decision-making on IT investments.. The IT steering committee is responsible for strategic IT governance, including prioritizing and approving IT investments. If it does not meet, decisions on IT investments are delayed because there is no forum to review, prioritize, and approve them. This directly impacts the organization's ability to align IT with business goals and can stall critical projects.

Answer

Higher IT staff turnover.

Answer

Increased number of security incidents.

Answer

Inconsistent IT policies across departments.

Question 8

An organization has decentralized IT management with each business unit making its own technology decisions. Which of the following is the BEST way to maintain enterprise-wide governance?

Accepted Answer

Establish an enterprise architecture review board with representatives from all business units.. Establishing an enterprise architecture review board with representatives from all business units is the best way to maintain enterprise-wide governance in a decentralized IT management structure. This board provides a collaborative forum where business units can align their technology decisions with enterprise-wide standards and strategic goals, ensuring consistency and compliance without centralizing decision-making. It balances autonomy with governance by involving stakeholders from all units in the review and approval of architectural decisions.

Answer

Deploy a single enterprise resource planning (ERP) system across all units.

Answer

Require all IT projects to be approved by the corporate IT department.

Answer

Create a central IT budget that allocates funds to business units.

Question 9

A company is implementing IT governance based on COBIT 2019. Which of the following design factors would have the GREATEST impact on the governance system design?

Accepted Answer

The industry and regulatory environment.. According to COBIT 2019, the industry and regulatory environment is a key design factor that significantly influences the governance system design, as it dictates compliance and risk management requirements. Options A, B, and C are factors but have a lesser impact compared to industry and regulatory considerations.

Answer

The IT infrastructure complexity.

Answer

The size of the organization.

Answer

The number of IT staff.

Question 10

An organization's IT strategy is developed by the IT department without input from business stakeholders. Which of the following is the MOST significant risk?

Accepted Answer

IT strategy may not support business objectives.. An IT strategy developed in isolation from business stakeholders risks being misaligned with organizational goals, meaning IT investments may not deliver business value or support strategic objectives. This is the most significant risk because it undermines the entire purpose of IT governance—ensuring IT enables and extends business strategy. Other risks like obsolescence, budget overruns, or skill gaps are secondary symptoms that may result from misalignment.

Answer

Technology may become obsolete quickly.

Answer

IT projects may exceed budget.

Answer

IT staff may lack required skills.

Question 11

Which THREE of the following are indicators of mature IT governance?

Accepted Answer

IT risks are formally assessed and managed.. Option B is correct because mature IT governance requires a formal, repeatable risk management process — risks are identified, assessed, prioritized, and mitigated with defined ownership and reporting, typically aligned to frameworks such as COBIT or ISO/IEC 27005. Option D is correct because governance maturity means IT strategy and investment decisions are driven by and traceable to business objectives, not by technology for its own sake. Option E is correct because board-level oversight through regular IT performance reporting (KPIs, dashboards, risk and compliance updates) demonstrates accountability and direction-setting at the highest level of the organization. Option A does not belong because high staff retention is an HR outcome that may reflect pay or market conditions rather than governance maturity. Option C does not belong because on-time, on-budget delivery is a project management performance metric, not an indicator of governance maturity — projects can be delivered efficiently under poor governance and vice versa.

Answer

The IT department has high staff retention.

Answer

IT projects are completed on time and within budget.

Question 12

Based on the exhibit, what is the MOST appropriate action for IT management?

Accepted Answer

Investigate the reasons for the shortfall and implement corrective actions.. When a performance metric shows a significant shortfall against its target, IT management's most appropriate action is to investigate the root cause and implement corrective actions. This aligns with continuous improvement and governance principles rather than adjusting targets or ignoring the gap.

Answer

Ignore the variance as it is within acceptable range.

Answer

Adjust the target to 80% to match actual performance.

Answer

Replace the survey with a different measurement tool.

Question 13

An organization is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of aligning IT strategy with business strategy?

Accepted Answer

Improved resource allocation. Aligning IT strategy with business strategy ensures that IT investments and initiatives directly support business objectives, leading to more effective prioritization and allocation of resources (budget, personnel, technology) to areas that deliver the most value. This alignment is a core goal of IT governance frameworks like COBIT, which emphasize value delivery and resource optimization.

Answer

Increased technical efficiency

Answer

Reduced IT costs

Answer

Enhanced security posture

Question 14

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. What is the committee's MOST important role?

Accepted Answer

Ensuring alignment with business objectives. An IT steering committee is a governance body whose primary function is to ensure that IT investments and projects align with the organization's strategic business objectives. It prioritizes, funds, and monitors initiatives at a portfolio level, so its most important role is strategic alignment rather than tactical execution. Technical specifications, vendor selection, and day-to-day budget management are delegated to project teams and IT management.

Answer

Approving technical specifications

Answer

Selecting the vendor

Answer

Managing the project budget

Question 15

An IT department uses a balanced scorecard to measure performance. Which metric would BEST reflect the 'customer perspective'?

Accepted Answer

User satisfaction survey results. The customer perspective focuses on user satisfaction and service responsiveness. Option A is incorrect as training hours relate to learning and growth perspective. Option B is incorrect as system uptime is an internal process metric. Option D is incorrect as project completion rate is an internal efficiency metric.

Answer

Training hours per employee

Answer

System uptime percentage

Answer

Project completion rate