CISA Governance and Management of IT Practice Test 6 — 15 Questions

Question 1

An organization has a policy requiring all employees to complete annual information security awareness training. Which of the following is the BEST way to verify compliance with this policy?

Accepted Answer

Review training completion records from the learning management system. Option C is correct because reviewing training completion records directly confirms compliance. Option A assumes training content is known. Option B tests knowledge but not compliance. Option D measures satisfaction, not completion.

Answer

Conduct phishing simulation tests

Answer

Survey employees about their satisfaction with training

Answer

Interview HR about training content

Question 2

A company outsources its data center operations to a third-party provider. Which of the following is the MOST important control to include in the outsourcing contract?

Accepted Answer

Right to audit the provider's facilities and processes. Option D is correct because the right to audit allows the company to verify the provider's compliance. Option A is important but less critical than audit rights. Option B is operational. Option C is a security control but not the most important contractual safeguard.

Answer

Detailed escalation procedures for incidents

Answer

Service level agreements with financial penalties

Answer

Requirements for encryption of data at rest

Question 3

An IS auditor is reviewing the balanced scorecard for IT. Which of the following metrics BEST aligns with the 'customer perspective'?

Accepted Answer

Average system uptime for critical applications. Option B is correct because system uptime directly measures service delivery to customers. Option A aligns with financial perspective. Option C aligns with internal processes. Option D aligns with learning and growth.

Answer

Percentage of IT projects under budget

Answer

Number of change requests completed on time

Answer

Percentage of staff with ITIL certification

Question 4

An IT manager submits a request to change the firewall configuration during business hours. According to best practices for change management, what should be done FIRST?

Accepted Answer

Assess the impact and risk of the proposed change. Option A is correct because assessing the impact and risk is the initial step. Option B may be done after assessment. Option C is premature without assessment. Option D is not standard.

Answer

Obtain approval from the change advisory board

Answer

Notify all users of the planned change

Answer

Implement the change immediately to address an urgent threat

Question 5

A business continuity plan (BCP) includes a tabletop exercise once a year. An IS auditor finds that the exercise only involves IT staff. Which of the following is the BEST recommendation?

Accepted Answer

Invite business process owners to participate in future exercises. Option C is correct because exercises should include business units to validate integrated response. Option A is too narrow. Option B focuses on data, not participation. Option D tests technical skills but not coordination.

Answer

Perform a failover test of the production environment

Answer

Increase the frequency of IT-only exercises

Answer

Include a data restoration test in the exercise

Question 6

An organization's data classification policy defines 'Confidential' data as requiring encryption at rest. An IS auditor discovers that a database containing customer personal information is not encrypted. What is the auditor's BEST course of action?

Accepted Answer

Report the finding to the data owner and IT management. Option D is correct because reporting the non-compliance to management is the auditor's responsibility. Option A is not an audit action. Option B may be outside scope. Option C is after reporting.

Answer

Encrypt the database immediately

Answer

Recommend a compensating control

Answer

Verify the classification of the data

Question 7

Which of the following is the PRIMARY purpose of an IT strategy committee?

Accepted Answer

To ensure IT investments support business objectives. Option B is correct because the committee's role is to align IT with business strategy. Option A is operational. Option C is project-specific. Option D is too narrow.

Answer

To monitor IT project timelines

Answer

To manage IT vendor contracts

Answer

To approve IT project budgets

Question 8

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

Performance measurement. Correct answers: A and D. Both are core governance elements. Option B is operational, not governance. Option C is a specific control. Option E is risk management, which is part of governance but not a framework component itself; frameworks include processes like risk management.

Answer

Configuration management database

Answer

Vulnerability assessment results

Answer

Firewall rules

Question 9

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Approving the IT strategy. Correct answers: A, C, E. The board is responsible for strategy oversight, risk acceptance, and policy approval. Option B is a management duty. Option D is operational.

Answer

Implementing IT security controls

Answer

Monitoring daily IT operations

Question 10

Which TWO of the following are common objectives of an IT balanced scorecard? (Choose two.)

Accepted Answer

Enhancing IT staff skills and knowledge. Correct answers: B and D. The balanced scorecard typically includes customer, financial, internal process, and learning/growth perspectives. Option A is a metric, not an objective. Option C is operational. Option E is security-specific.

Answer

Deploying a new ERP system

Answer

Reducing the number of help desk tickets

Answer

Implementing a new firewall

Question 11

Based on the exhibit, what is the MOST likely security risk?

Accepted Answer

Unrestricted traffic is allowed after the specific deny. Option C is correct because the 'permit ip any any' at the end allows all traffic, bypassing earlier specific denials. Option A is not correct because the deny line only blocks other traffic, but the permit any any overrides it. Option B is not directly indicated. Option D is a risk but less direct than the rule order issue.

Answer

The web server is fully protected

Answer

Traffic to port 80 is not encrypted

Answer

The host 192.168.1.100 is exposed to denial-of-service attacks

Question 12

An organization uses the policy shown. Which of the following is an omission in the policy?

Accepted Answer

No specification of data disposal methods after retention periods. Option A is correct because there is no rule for data disposal after retention. Option B is present. Option C is addressed. Option D is not mentioned but not an omission in this context.

Answer

No definition of authorized users

Answer

No mention of backup frequency

Answer

Missing encryption requirement for log data

Question 13

Based on the log, what is the MOST likely root cause of the backup failure?

Accepted Answer

Insufficient storage capacity. Option D is correct because the log clearly indicates the target directory is full. Options A, B, C are not indicated in the log.

Answer

Network connectivity issues

Answer

Incorrect backup schedule

Answer

Backup software corruption

Question 14

A large financial institution is evaluating the effectiveness of its IT governance framework. The board has requested a review to ensure alignment with business objectives and regulatory requirements. Which of the following is the MOST important factor for the board to consider when assessing the IT governance framework?

Accepted Answer

The framework is integrated with enterprise governance and supports strategic objectives.. Option B is correct because a well-defined IT governance framework must integrate with enterprise governance to ensure alignment with business objectives and regulatory requirements. Option A is wrong because focusing solely on cost reduction may conflict with strategic priorities. Option C is wrong because incident response is operational, not governance-level. Option D is wrong because technical efficiency is a management concern, not board-level governance.

Answer

The framework includes a detailed incident response plan.

Answer

The framework focuses on achieving high technical efficiency.

Answer

The framework minimizes overall IT costs.

Question 15

An organization is developing its IT strategy to align with the overall business strategy. The business strategy emphasizes rapid market expansion through digital products. Which of the following IT strategies would BEST support this business goal?

Accepted Answer

Adopt agile development methods and scalable cloud infrastructure.. Option C is correct because rapid market expansion requires agility and speed. Option A is wrong because strict standardization may slow down innovation. Option B is wrong because minimizing IT investment would hinder digital product development. Option D is wrong because outsourcing to the lowest-cost provider may compromise quality and speed.

Answer

Standardize all IT systems to reduce complexity.

Answer

Outsource all IT operations to a low-cost provider.

Answer

Minimize IT investment to preserve capital for business growth.