CISA Governance and Management of IT Practice Test 7 — 15 Questions

Question 1

A multinational corporation has defined its risk appetite as 'moderate' for IT investments. The IT steering committee is evaluating a new project with potential high returns but also significant cybersecurity risks. The project's risk profile is assessed as 'high' by the risk management team. What should the committee do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Request the project team to identify risk mitigation measures.. The correct first step. When a project's risk profile exceeds the defined risk appetite, the committee should not immediately reject or approve it. Instead, they should first explore whether risk mitigation measures can reduce the risk to an acceptable level. This aligns with governance best practices to balance risk and reward. Option B is premature without assessing mitigation. Option C escalates too early before considering mitigations. Option D rejects the opportunity without considering potential mitigation, which may discard valuable projects.

Answer

Approve the project but increase monitoring.

Answer

Escalate the decision to the board of directors.

Answer

Reject the project immediately as it exceeds risk appetite.

Question 2

A company is considering restructuring its IT department from a centralized to a decentralized model to give business units more autonomy. What is a PRIMARY governance risk associated with this move?

Accepted Answer

Inconsistent IT policies and security controls across business units.. The primary governance risk when moving from a centralized to a decentralized IT model is the potential for inconsistent IT policies and security controls across business units (Option D). Decentralization gives business units autonomy, which can lead to differences in how IT policies are interpreted and applied, increasing the risk of security gaps and non-compliance. Option A (difficulty in managing vendor contracts) is a valid operational concern but not a primary governance risk. Option B (reduced innovation) is unlikely, as decentralization often fosters innovation. Option C (increased cost overruns) can occur but is typically a financial risk rather than a governance risk.

Answer

Difficulty in managing vendor contracts due to decentralization.

Answer

Reduced innovation due to lack of central coordination.

Answer

Increased risk of project cost overruns.

Question 3

An organization has a policy requiring annual information security awareness training for all employees. During a recent audit, it was found that 20% of employees had not completed the training. What is the BEST course of action for the IT governance committee?

Accepted Answer

Require managers to ensure their teams complete training and escalate non-compliance to HR.. Enforcing compliance through HR and management reinforces the policy. Option A is wrong because reducing training frequency weakens security. Option C is wrong because extending the deadline does not address non-compliance. Option D is wrong because training is a mandatory policy, not optional.

Answer

Reduce the training frequency to biennial.

Answer

Extend the training deadline by three months.

Answer

Make the training optional for employees with high performance ratings.

Question 4

An IT department uses a balanced scorecard (BSC) to measure performance. The financial perspective shows that IT costs are within budget, but customer satisfaction scores are declining. The learning and growth perspective indicates low employee engagement. Which action should the IT governance committee prioritize?

Accepted Answer

Invest in training and development programs for IT staff.. Investing in training and development programs improves employee engagement (learning & growth perspective), which likely leads to better service and increased customer satisfaction. Option A is wrong because reducing costs further may harm service quality and not address the root cause of low engagement. Option C is wrong because simply hiring more staff does not necessarily improve engagement or customer satisfaction without proper training. Option D is wrong because outsourcing may provide short-term relief but does not address the underlying employee engagement issue and could lead to loss of control.

Answer

Reduce IT costs further to reallocate savings to customer service.

Answer

Increase the IT budget to hire more staff.

Answer

Outsource customer-facing IT support to a third party.

Question 5

A company plans to outsource its data center operations to a cloud service provider. What is the MOST important governance consideration for the board before finalizing the contract?

Accepted Answer

Ensure the contract includes clauses for regulatory compliance and audit rights.. The most important governance consideration because the board must ensure that the contract enforces regulatory compliance and provides audit rights to meet legal and regulatory obligations. Option A is wrong because cost reduction is secondary to compliance and governance. Option B is wrong because transferring staff is an HR/operational issue, not a board-level governance priority. Option D is wrong while an exit strategy is important, contractually securing compliance and audit rights is more critical for governance oversight.

Answer

Select a provider with the lowest cost per transaction.

Answer

Negotiate the transfer of existing IT staff to the provider.

Answer

Define a detailed exit strategy for transitioning to another provider.

Question 6

A healthcare organization must comply with HIPAA regulations regarding patient data privacy. The IT department has implemented technical controls, but the compliance officer discovers that some employees are sharing passwords. What is the BEST governance response?

Accepted Answer

Enforce the existing policy through disciplinary actions and additional training.. The best governance response is to enforce the existing policy through disciplinary actions and additional training (option B). This addresses the root cause of non-compliance—employee behavior—by reinforcing the policy and educating staff. Option A (implementing MFA) is a technical control that may reduce password sharing but does not address the governance aspect; it could be a supporting measure but not the primary governance response. Option C (reporting to regulatory authority) is premature because password sharing does not necessarily constitute a data breach; there is no evidence of actual exposure. Option D (revising the password policy to require more complex passwords) does not prevent sharing and may even increase it if passwords are harder to remember. Therefore, governance should focus on policy enforcement and training.

Answer

Implement multi-factor authentication to prevent password sharing.

Answer

Report the incident to the regulatory authority as a data breach.

Answer

Revise the password policy to require more complex passwords.

Question 7

Which TWO of the following are primary objectives of IT governance as defined by COBIT 5?

Accepted Answer

Resource optimization. Options A and D are correct because COBIT 5 defines primary IT governance objectives as stakeholder value delivery and resource optimization. Option B (cost reduction) is a management objective, not governance. Option C (incident response) is an operational activity. Option E (data encryption) is a security control.

Answer

Cost reduction

Answer

Incident response

Answer

Data encryption

Question 8

Which THREE of the following are components of the COBIT 2019 governance system?

Accepted Answer

Organizational structures. Options A, B, and C are correct because COBIT 2019 defines governance system components as Organizational Structures, Information Items, and Processes. Option D (Service desk) is an operational process not a governance component. Option E (Project management office) is a management structure, not a governance component as defined in COBIT 2019.

Answer

Service desk

Answer

Project management office

Question 9

Which TWO of the following are benefits of establishing an IT steering committee?

Accepted Answer

Enhanced prioritization of IT investments. Options B and C are correct because an IT steering committee provides strategic alignment and prioritization of IT initiatives, ensuring they align with business goals. Option A is not a benefit; operational efficiency is a management responsibility, not a committee function. Option D is incorrect; establishing a steering committee may add governance overhead rather than reduce management overhead. Option E is not a primary benefit; technical decisions are typically delegated to IT management.

Answer

Improved operational efficiency of IT systems

Answer

Reduction of management overhead

Answer

Direct control over technical IT decisions

Question 10

A multinational manufacturing company with operations in 20 countries has historically allowed each regional division to manage its own IT systems independently. Recently, the company experienced a significant data breach originating from a region with weaker security controls, leading to financial losses and reputational damage. The board has mandated stronger IT governance to prevent future incidents. The CIO proposes implementing a global IT governance framework with centralized policy enforcement. However, regional directors argue that local regulations and business needs require autonomy. The governance committee must decide on a course of action that balances risk and business flexibility. Which of the following approaches is the MOST appropriate?

Accepted Answer

Adopt a federated governance model with global policies and local flexibility within defined tolerances.. The most appropriate approach is the federated governance model (Option A), which establishes global policies and standards centrally while allowing regional divisions to adapt within defined risk tolerances. This balances the board's mandate for stronger IT governance with legitimate local regulatory and business needs. Option B (quarterly reporting) is insufficient because it does not enforce any binding controls, leaving the company vulnerable to future breaches. Option C (fully centralized) may ignore critical local regulations and hinder business agility, leading to non-compliance and operational friction. Option D (status quo with minimum standards) is too weak; after a significant breach, a more robust framework requiring proactive governance is needed, not just baseline security.

Answer

Allow each region to continue independently but require quarterly reporting to the committee.

Answer

Implement a fully centralized IT governance model with no regional deviations.

Answer

Maintain the status quo but enforce minimum security standards across all regions.

Question 11

A retail company is merging with a competitor. The IT departments of both organizations have different IT governance structures: Company A uses a centralized model with strict change management, while Company B uses a decentralized model with autonomous business unit IT. The CIO has been tasked with integrating the IT functions post-merger. The board expects cost synergies and improved service levels. The integration team is facing resistance from Company B's business heads who fear loss of agility. The CIO needs to propose a governance model for the merged entity. Which approach would BEST meet the board's expectations while addressing resistance?

Accepted Answer

Implement a phased integration with a transitional governance structure that includes representatives from both sides.. A phased integration with a transitional governance structure that includes representatives from both sides allows the merged entity to gradually converge governance models, manage change and resistance, and work toward cost synergies and improved service levels without immediately disrupting business operations. Option A is incorrect because keeping both models separate permanently fails to achieve the desired integration and synergies. Option B is incorrect because fully adopting the decentralized model may not deliver the cost synergies and centralized control expected by the board. Option C is incorrect because immediately imposing a centralized model would likely cause strong resistance from Company B's business heads and disrupt agility, undermining the merger's success.

Answer

Keep both models separate and allow business units to choose their preferred model.

Answer

Adopt Company B's decentralized model to preserve agility.

Answer

Immediately impose Company A's centralized model across the merged entity.

Question 12

A medium-sized e-commerce company recently suffered a ransomware attack that encrypted critical databases. The IT team restored systems from backups, but the incident exposed a lack of clear roles and responsibilities for incident response. The board has asked the IT governance committee to review and improve the incident response governance. The committee notes that while there is an incident response policy, it is not regularly tested, and staff are unsure of their roles. The company also lacks a formal communication protocol for notifying stakeholders. What should the committee prioritize to strengthen governance over incident response?

Accepted Answer

Define and communicate clear roles and responsibilities for incident response, and establish accountability.. The root cause is a lack of clear roles, responsibilities, and accountability, which must be addressed first to strengthen governance. Option A is wrong because investing in technology alone does not fix governance gaps. Option B is wrong because outsourcing does not address internal governance deficiencies. Option D is wrong, while testing is valuable, it should follow role definition and communication.

Answer

Invest in advanced endpoint detection and response tools.

Answer

Outsource incident response to a managed security service provider.

Answer

Conduct a tabletop exercise to test the current plan.

Question 13

A financial services company is migrating its core banking system to a public cloud to improve scalability and reduce costs. The project is high-risk due to regulatory compliance requirements (e.g., data residency, audit trails). The IT governance committee has reviewed the project plan and finds that the risk assessment is incomplete – it does not address the potential impact of a cloud provider outage on critical transactions. The committee must approve the project or request changes. The project manager argues that the cloud provider's SLA guarantees 99.99% uptime and that additional controls would delay the project. What should the governance committee do?

Accepted Answer

Request a revised risk assessment that includes contingency plans for provider outages.. The governance committee's role is to ensure that all significant risks are identified and mitigated before approval. The risk assessment is incomplete as it does not address the impact of a cloud provider outage on critical transactions. Requiring a revised risk assessment that includes contingency plans for provider outages is a proper governance response. Option A is wrong because it preemptively rejects the project without considering updated risk information. Option C is wrong because the SLA does not eliminate the need for contingency planning or address other compliance risks. Option D is wrong because a pilot for non-critical systems does not resolve the missing risk assessment for the core banking migration.

Answer

Reject the project and require the system to remain on-premises.

Answer

Approve the project based on the provider's strong SLA.

Answer

Approve a pilot migration for non-critical systems first.

Question 14

An organization is implementing an IT governance framework to align IT with business objectives. Which TWO of the following are primary responsibilities of the IT steering committee?

Accepted Answer

Approving IT project budgets and priorities. Options C and E are correct. The IT steering committee is responsible for approving IT project budgets and priorities (C) and ensuring IT investments deliver value (E). Performing daily IT operations (A) is an operational management task. Defining IT security policies (B) is typically the responsibility of the security function. Conducting technical vulnerability assessments (D) is a technical operational activity.

Answer

Performing daily IT operations

Answer

Defining IT security policies

Answer

Conducting technical vulnerability assessments

Question 15

A medium-sized manufacturing company has a decentralized IT structure where each business unit manages its own IT budget and projects. The CEO is concerned that IT investments are not aligned with corporate strategy and that there is duplication of effort. The IT department lacks a formal project portfolio management process. The company has experienced several project failures due to poor prioritization. The CEO has asked the newly hired IT auditor to recommend an initial step to improve IT governance. The auditor should recommend:

Accepted Answer

Establishing an IT steering committee with representatives from business units and IT. An IT steering committee provides governance oversight, ensures alignment with corporate strategy, and helps prioritize projects to avoid duplication. This foundational step addresses the root cause of poor alignment and project failures before implementing tools or processes. Option B is premature because a tool without governance oversight may not improve prioritization. Option C focuses on security, not overall strategic alignment. Option D is drastic and does not address internal governance issues.

Answer

Implementing a project portfolio management software tool immediately to track all projects

Answer

Conducting a security risk assessment of all IT systems

Answer

Outsourcing IT management to a third-party provider