CISA Governance and Management of IT Practice Test 5 — 15 Questions

Question 1

An organization is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of aligning IT strategy with business strategy?

Accepted Answer

Improved resource allocation. The primary benefit of aligning IT strategy with business strategy is improved resource allocation (Option B). This alignment ensures that IT investments and projects are directed toward activities that directly support business goals, maximizing value and minimizing waste. While increased technical efficiency (Option A), reduced IT costs (Option C), and enhanced security posture (Option D) are possible outcomes, they are not the primary benefit; they are secondary benefits that may result from proper alignment.

Answer

Increased technical efficiency

Answer

Reduced IT costs

Answer

Enhanced security posture

Question 2

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. What is the committee's MOST important role?

Accepted Answer

Ensuring alignment with business objectives. The IT steering committee's most important role is to ensure that proposed IT projects align with the organization's business objectives. Option A is incorrect as technical specifications are typically reviewed by technical architects or engineering teams. Option B is incorrect because vendor selection is often a procurement or business decision, and while the committee may provide input, it is not their primary role. Option D is incorrect because managing the project budget is the responsibility of the project manager and project team, not the steering committee.

Answer

Approving technical specifications

Answer

Selecting the vendor

Answer

Managing the project budget

Question 3

An IT department uses a balanced scorecard to measure performance. Which metric would BEST reflect the 'customer perspective'?

Accepted Answer

User satisfaction survey results. The customer perspective focuses on user satisfaction and service responsiveness. Option A is incorrect as training hours relate to learning and growth perspective. Option B is incorrect as system uptime is an internal process metric. Option D is incorrect as project completion rate is an internal efficiency metric.

Answer

Training hours per employee

Answer

System uptime percentage

Answer

Project completion rate

Question 4

According to COBIT 2019, which design factor is MOST critical for tailoring a governance system?

Accepted Answer

Enterprise strategy. Enterprise strategy determines the governance objectives and risk appetite, making it the most critical design factor. Options A, B, and C are all important but secondary; they influence the system but are driven by strategy.

Answer

Regulatory environment

Answer

Technology complexity

Answer

Organizational size

Question 5

An organization's IT governance framework includes a policy that all system access must be reviewed quarterly. The internal audit finds that reviews are incomplete. What is the BEST action?

Accepted Answer

Reinforce accountability with managers. Reinforcing accountability with managers directly addresses the root cause of incomplete reviews—lack of responsibility and follow-through. Option A is incorrect because implementing an automated access review tool may improve efficiency but does not address the underlying accountability issue. Option C is incorrect because disabling all non-compliant accounts could disrupt business operations without solving the process failure. Option D is incorrect because updating the policy to require monthly reviews increases frequency but does not ensure reviews are completed.

Answer

Implement an automated access review tool

Answer

Disable all non-compliant accounts

Answer

Update the policy to require monthly reviews

Question 6

A multinational corporation is implementing a global IT governance framework. Which of the following challenges is MOST likely to arise?

Accepted Answer

Conflicting regulatory requirements. A multinational corporation implementing a global IT governance framework will most likely face conflicting regulatory requirements across different countries (option A). These legal and compliance issues are complex and vary significantly by jurisdiction (e.g., GDPR, data sovereignty), making them the primary challenge. Standardizing hardware (B) is a technical issue that can be addressed through procurement policies. Training users (C) is an operational challenge that can be managed with change management processes. Software licensing costs (D) are a financial concern but not as fundamental as legal compliance. Therefore, option A is the most likely challenge.

Answer

Standardizing hardware across regions

Answer

Training users on new procedures

Answer

Software licensing costs

Question 7

An IT manager is developing a governance policy for change management. Which element is MOST important to include?

Accepted Answer

Roles and responsibilities. Clearly defined roles and responsibilities ensure accountability in the change process. Option A is incorrect because project management methodology is separate from governance policy. Option B is incorrect as detailed technical procedures are part of implementation, not governance. Option C is incorrect because a list of all applications is operational, not a governance element.

Answer

Project management methodology

Answer

Detailed technical procedures

Answer

List of all applications

Question 8

An organization's IT governance committee is reviewing a proposal to use a public cloud provider that does not meet the organization's data encryption standards. The board has set a low risk appetite for data privacy. What is the BEST action?

Accepted Answer

Reject the proposal until encryption requirements are met. Rejecting the proposal aligns with the board's low risk appetite for data privacy and ensures encryption standards are met before acceptance. Option A is incorrect because additional monitoring does not resolve the encryption gap. Option B is incorrect because delegation to the security team bypasses the governance committee's responsibility to enforce risk appetite. Option C is incorrect because waivers do not mitigate the fundamental encryption non-compliance.

Answer

Accept the proposal with additional monitoring

Answer

Delegate the decision to the security team

Answer

Accept the proposal but require the provider to sign a waiver

Question 9

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

IT strategy. D and E are correct. An IT strategy (D) and an IT steering committee (E) are key components of an IT governance framework. A (network topology diagram) is a technical document, B (help desk procedures) is operational, and C (hardware inventory) is operational, so they are not governance components.

Answer

Network topology diagram

Answer

Help desk procedures

Answer

Hardware inventory

Question 10

An organization is implementing COBIT 2019. Which TWO of the following are governance enablers? (Choose two.)

Accepted Answer

Organizational structures. Options C and E are correct because organizational structures and culture, ethics, and behavior are governance enablers in COBIT 2019. Option A (Hardware configuration) is incorrect as it is an implementation detail, not a governance enabler. Option B (Project schedule) is incorrect as it is a project management artifact. Option D (Network performance) is incorrect as it is operational.

Answer

Hardware configuration

Answer

Project schedule

Answer

Network performance

Question 11

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Setting IT risk appetite. Options B, C, and E are correct because setting IT risk appetite, reviewing IT performance, and approving IT strategy are board-level responsibilities under IT governance. Option A is incorrect as designing network security architecture is an operational task typically handled by management or technical staff. Option D is incorrect because implementing IT controls is also a management function, not a board responsibility.

Answer

Designing network security architecture

Answer

Implementing IT controls

Question 12

Based on the exhibit, which metric would be LEAST relevant to the 'Customer' perspective?

Accepted Answer

System Uptime Percentage. (System Uptime Percentage) is the least relevant to the Customer perspective because system uptime is an operational metric that primarily supports the Internal Process perspective (e.g., reliability and availability). In contrast, the other options directly measure customer satisfaction and engagement: Number of New Features (customer-driven innovation), Satisfaction Survey Score (direct feedback), and Complaint Resolution Time (service responsiveness). While uptime may indirectly affect customer satisfaction, it is not a direct measure of the customer perspective as defined by balanced scorecard frameworks.

Answer

Number of New Features Delivered

Answer

Satisfaction Survey Score

Answer

Complaint Resolution Time

Question 13

An auditor finds that access reviews have not been completed for two quarters. What is the MOST significant risk?

Accepted Answer

Unauthorized access may be granted and persist. Access reviews are essential for detecting and revoking unauthorized or excessive permissions. Without them, unauthorized access may go undetected and persist, leading to potential security breaches. Option A is incorrect because while data integrity could be compromised as a secondary effect, the most direct risk is unauthorized access. Option C is incorrect: system performance is unrelated to access reviews. Option D is incorrect because reporting audit findings is a consequence, not the primary risk.

Answer

Data integrity may be compromised

Answer

System performance may degrade

Answer

Audit findings may be reported to management

Question 14

Based on the exhibit, what is the default retention period for data?

Accepted Answer

365 days. The JSON exhibit shows a default retention period of 365 days. Option B is incorrect; 30 days is the extension applied only to the Legal role, not the default. Option C is incorrect as the policy explicitly specifies a default period. Option D is incorrect because 365 days, not 30 days, is the default retention period.

Answer

30 days for Legal role only

Answer

The policy does not specify a default period

Answer

30 days

Question 15

An organization is implementing a new IT governance framework. Which of the following is the BEST approach to ensure alignment between IT strategy and business goals?

Accepted Answer

Establish an IT steering committee with business representation. An IT steering committee with both IT and business leaders ensures continuous strategic alignment by involving business stakeholders in IT decision-making. Option A is incorrect because aligning the IT budget with a previous year's business plan uses outdated information and does not guarantee alignment with current goals. Option B is incorrect because annual IT strategy reviews independent of business cycles create a disconnect between IT and business priorities. Option D is incorrect because delegating IT strategy solely to the CIO without business input can lead to misalignment with organizational objectives.

Answer

Align IT budget with the previous year's business plan

Answer

Conduct annual IT strategy reviews independent of business cycles

Answer

Delegate IT strategy to the CIO without business input