CISA Governance and Management of IT Practice Test 6 — 15 Questions

Question 1

During a risk assessment, an IS auditor identifies that the IT department has not performed a business impact analysis (BIA) for critical systems. Which of the following is the MOST significant risk?

Accepted Answer

Uncertainty regarding recovery time objectives for critical systems. Without a BIA, recovery time objectives (RTOs) are uncertain, leading to potential unacceptable downtime. Option A is a consequence but not the primary risk. Option B is incorrect because BIA is for recovery, not cost. Option C is less direct.

Answer

Non-compliance with software licensing

Answer

Increased likelihood of security breaches

Answer

Inability to calculate total cost of ownership

Question 2

An organization has a policy requiring all employees to complete annual information security awareness training. Which of the following is the BEST way to verify compliance with this policy?

Accepted Answer

Review training completion records from the learning management system. Reviewing training completion records directly confirms that employees have completed the required annual information security awareness training. Option A (phishing simulation tests) evaluates susceptibility to phishing but does not verify training completion. Option B (surveying satisfaction) measures perception, not compliance. Option C (interviewing HR about content) does not provide evidence of individual completion.

Answer

Conduct phishing simulation tests

Answer

Survey employees about their satisfaction with training

Answer

Interview HR about training content

Question 3

A company outsources its data center operations to a third-party provider. Which of the following is the MOST important control to include in the outsourcing contract?

Accepted Answer

Right to audit the provider's facilities and processes. The right to audit allows the company to verify the provider's compliance. Option A is important but less critical than audit rights. Option B is operational. Option C is a security control but not the most important contractual safeguard.

Answer

Detailed escalation procedures for incidents

Answer

Service level agreements with financial penalties

Answer

Requirements for encryption of data at rest

Question 4

An IS auditor is reviewing the balanced scorecard for IT. Which of the following metrics BEST aligns with the 'customer perspective'?

Accepted Answer

Average system uptime for critical applications. Average system uptime for critical applications directly measures IT service availability from the customer's perspective. In the balanced scorecard framework, the customer perspective focuses on how end users experience IT services. The other options align with different perspectives: B (under budget) is financial, C (change requests on time) is internal processes, and D (ITIL certification) is learning and growth.

Answer

Percentage of IT projects under budget

Answer

Number of change requests completed on time

Answer

Percentage of staff with ITIL certification

Question 5

An IT manager submits a request to change the firewall configuration during business hours. According to best practices for change management, what should be done FIRST?

Accepted Answer

Assess the impact and risk of the proposed change. The first step in any change management process is to assess the impact and risk of the proposed change. This assessment informs subsequent steps such as approval, notification, and implementation. Option A (CAB approval) should occur after the impact and risk assessment is completed. Option B (notifying users) is typically done after the change is approved and scheduled. Option D (immediate implementation) bypasses the necessary assessment and approval steps, which is not best practice even for urgent threats—a risk assessment should still be conducted.

Answer

Obtain approval from the change advisory board

Answer

Notify all users of the planned change

Answer

Implement the change immediately to address an urgent threat

Question 6

An organization's data classification policy defines 'Confidential' data as requiring encryption at rest. An IS auditor discovers that a database containing customer personal information is not encrypted. What is the auditor's BEST course of action?

Accepted Answer

Report the finding to the data owner and IT management. The IS auditor's primary responsibility is to report findings to the appropriate stakeholders—the data owner and IT management—so they can take corrective action. Option A is incorrect because implementing controls is management's responsibility, not the auditor's. Option C is premature; compensating controls should be recommended after reporting and discussing the risk. Option D is unnecessary since the data classification policy already defines 'Confidential' data requiring encryption, and the auditor has identified a violation of that policy.

Answer

Encrypt the database immediately

Answer

Recommend a compensating control

Answer

Verify the classification of the data

Question 7

Which of the following is the PRIMARY purpose of an IT strategy committee?

Accepted Answer

To ensure IT investments support business objectives. The primary purpose of an IT strategy committee is to ensure that IT investments align with and support business objectives, providing strategic direction and governance. Option A is incorrect as monitoring project timelines is an operational task, not a strategic committee responsibility. Option B is incorrect because managing vendor contracts is typically handled by procurement or IT operations. Option C is incorrect because approving specific project budgets is a project-level decision, not the committee's primary focus.

Answer

To monitor IT project timelines

Answer

To manage IT vendor contracts

Answer

To approve IT project budgets

Question 8

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

Performance measurement. The correct answers are B (Performance measurement) and D (Strategic alignment of IT with business). Both are key components of an IT governance framework as defined by COBIT and similar frameworks. Performance measurement enables monitoring of IT's contribution to business goals, while strategic alignment ensures IT initiatives support business objectives. Option A (Configuration management database) is an operational tool, not a governance component. Option C (Vulnerability assessment results) is a security control output. Option E (Firewall rules) is an operational security measure, not a governance framework element.

Answer

Configuration management database

Answer

Vulnerability assessment results

Answer

Firewall rules

Question 9

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Approving the IT strategy. Correct answers: B, C, E. The board is responsible for approving the IT strategy (B), reviewing and approving IT policies (C), and ensuring that IT risks are managed within acceptable levels (E). Implementing IT security controls (A) is a management duty, and monitoring daily IT operations (D) is an operational responsibility.

Answer

Implementing IT security controls

Answer

Monitoring daily IT operations

Question 10

Which TWO of the following are common objectives of an IT balanced scorecard? (Choose two.)

Accepted Answer

Enhancing IT staff skills and knowledge. The IT balanced scorecard translates the organization's strategy into objectives across four perspectives: customer, financial, internal process, and learning/growth. Option C (enhancing IT staff skills and knowledge) aligns with the learning and growth perspective, as it focuses on developing human capital. Option E (improving customer satisfaction with IT services) aligns with the customer perspective, measuring how IT meets user needs. Options A, B, and D are tactical or operational activities rather than strategic objectives spanning the balanced scorecard dimensions.

Answer

Deploying a new ERP system

Answer

Reducing the number of help desk tickets

Answer

Implementing a new firewall

Question 11

Based on the exhibit, what is the MOST likely security risk?

Accepted Answer

Unrestricted traffic is allowed after the specific deny. The 'permit ip any any' at the end allows all traffic, bypassing earlier specific denials. Option A is not correct because the deny line only blocks other traffic, but the permit any any overrides it. Option B is not directly indicated. Option D is a risk but less direct than the rule order issue.

Answer

The web server is fully protected

Answer

Traffic to port 80 is not encrypted

Answer

The host 192.168.1.100 is exposed to denial-of-service attacks

Question 12

An organization uses the policy shown. Which of the following is an omission in the policy?

Accepted Answer

No specification of data disposal methods after retention periods. The policy does not specify data disposal methods after the retention period, which is a critical omission for data lifecycle management. Option A is incorrect because authorized users are likely defined elsewhere in the policy. Option B is incorrect because backup frequency is mentioned. Option D is incorrect because encryption may not be required for all log data based on the policy context.

Answer

No definition of authorized users

Answer

No mention of backup frequency

Answer

Missing encryption requirement for log data

Question 13

Based on the log, what is the MOST likely root cause of the backup failure?

Accepted Answer

Insufficient storage capacity. The log clearly indicates the target directory is full. Options A, B, C are not indicated in the log.

Answer

Network connectivity issues

Answer

Incorrect backup schedule

Answer

Backup software corruption

Question 14

A large financial institution is evaluating the effectiveness of its IT governance framework. The board has requested a review to ensure alignment with business objectives and regulatory requirements. Which of the following is the MOST important factor for the board to consider when assessing the IT governance framework?

Accepted Answer

The framework is integrated with enterprise governance and supports strategic objectives.. An effective IT governance framework must be integrated with enterprise governance to ensure alignment with business objectives and regulatory requirements. Option B is incorrect because incident response is an operational process, not a primary board-level governance consideration. Option C is incorrect because technical efficiency is a management concern, not a governance-level factor. Option D is incorrect because minimizing IT costs is a tactical objective that may conflict with strategic priorities.

Answer

The framework includes a detailed incident response plan.

Answer

The framework focuses on achieving high technical efficiency.

Answer

The framework minimizes overall IT costs.

Question 15

An organization is developing its IT strategy to align with the overall business strategy. The business strategy emphasizes rapid market expansion through digital products. Which of the following IT strategies would BEST support this business goal?

Accepted Answer

Adopt agile development methods and scalable cloud infrastructure.. Rapid market expansion through digital products requires agility, speed, and scalability. Agile development methods enable iterative, fast delivery of features, while cloud infrastructure provides elastic resources to scale quickly. Option A is wrong because excessive standardization can hinder innovation and slow down time-to-market. Option C is wrong because outsourcing to a low-cost provider may prioritize cost over speed and quality, which is not suitable for rapid expansion. Option D is wrong because minimizing IT investment would deprive the organization of the necessary resources to develop and scale digital products.

Answer

Standardize all IT systems to reduce complexity.

Answer

Outsource all IT operations to a low-cost provider.

Answer

Minimize IT investment to preserve capital for business growth.