CISA Governance and Management of IT Practice Test 7 — 15 Questions

Question 1

An organization's data classification policy defines 'Confidential' data as requiring encryption at rest. An IS auditor discovers that a database containing customer personal information is not encrypted. What is the auditor's BEST course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Report the finding to the data owner and IT management. The IS auditor's primary responsibility is to report findings to the appropriate stakeholders—the data owner and IT management—so they can take corrective action. Option A is incorrect because implementing controls is management's responsibility, not the auditor's. Option C is premature; compensating controls should be recommended after reporting and discussing the risk. Option D is unnecessary since the data classification policy already defines 'Confidential' data requiring encryption, and the auditor has identified a violation of that policy.

Answer

Encrypt the database immediately

Answer

Recommend a compensating control

Answer

Verify the classification of the data

Question 2

Which of the following is the PRIMARY purpose of an IT strategy committee?

Accepted Answer

To ensure IT investments support business objectives. The primary purpose of an IT strategy committee is to ensure that IT investments and initiatives are aligned with and support the organization's business objectives. This governance body provides strategic direction, prioritizes IT investments, and ensures IT delivers business value rather than just managing operational tasks.

Answer

To monitor IT project timelines

Answer

To manage IT vendor contracts

Answer

To approve IT project budgets

Question 3

Which TWO of the following are common objectives of an IT balanced scorecard? (Choose two.)

Accepted Answer

Enhancing IT staff skills and knowledge. The IT balanced scorecard adapts the four-perspective Kaplan-Norton framework to IT, so its objectives are outcome-oriented goals rather than one-off projects. Option C, enhancing IT staff skills and knowledge, is correct because it maps to the learning and growth (innovation) perspective, which drives the internal process and customer perspectives through continuous capability development. Option E, improving customer satisfaction with IT services, is correct because it maps to the customer perspective, measuring how well IT delivers value and meets service expectations. Options A (deploying a new ERP system) and D (implementing a new firewall) are specific tactical projects or deliverables, not strategic scorecard objectives, and option B (reducing the number of help desk tickets) is a narrow operational metric that may even conflict with service quality rather than a balanced scorecard objective.

Answer

Deploying a new ERP system

Answer

Reducing the number of help desk tickets

Answer

Implementing a new firewall

Question 4

Based on the exhibit, what is the MOST likely security risk?

Accepted Answer

Unrestricted traffic is allowed after the specific deny. The 'permit ip any any' at the end allows all traffic, bypassing earlier specific denials. Option A is not correct because the deny line only blocks other traffic, but the permit any any overrides it. Option B is not directly indicated. Option D is a risk but less direct than the rule order issue.

Answer

The web server is fully protected

Answer

Traffic to port 80 is not encrypted

Answer

The host 192.168.1.100 is exposed to denial-of-service attacks

Question 5

A large financial institution is evaluating the effectiveness of its IT governance framework. The board has requested a review to ensure alignment with business objectives and regulatory requirements. Which of the following is the MOST important factor for the board to consider when assessing the IT governance framework?

Accepted Answer

The framework is integrated with enterprise governance and supports strategic objectives.. An effective IT governance framework must be integrated with enterprise governance to ensure alignment with business objectives and regulatory requirements. Option B is incorrect because incident response is an operational process, not a primary board-level governance consideration. Option C is incorrect because technical efficiency is a management concern, not a governance-level factor. Option D is incorrect because minimizing IT costs is a tactical objective that may conflict with strategic priorities.

Answer

The framework includes a detailed incident response plan.

Answer

The framework focuses on achieving high technical efficiency.

Answer

The framework minimizes overall IT costs.

Question 6

An organization is developing its IT strategy to align with the overall business strategy. The business strategy emphasizes rapid market expansion through digital products. Which of the following IT strategies would BEST support this business goal?

Accepted Answer

Adopt agile development methods and scalable cloud infrastructure.. A business strategy focused on rapid market expansion through digital products requires IT to deliver quickly and scale elastically. Agile development methods enable fast iteration and responsiveness to market feedback, while scalable cloud infrastructure provides the elasticity to handle growth without heavy upfront capital investment. Together they directly enable speed and scale, which are the core requirements of the stated strategy.

Answer

Standardize all IT systems to reduce complexity.

Answer

Outsource all IT operations to a low-cost provider.

Answer

Minimize IT investment to preserve capital for business growth.

Question 7

A multinational corporation has defined its risk appetite as 'moderate' for IT investments. The IT steering committee is evaluating a new project with potential high returns but also significant cybersecurity risks. The project's risk profile is assessed as 'high' by the risk management team. What should the committee do FIRST?

Accepted Answer

Request the project team to identify risk mitigation measures.. When a project's risk profile exceeds the organization's defined risk appetite, the FIRST step is to understand whether the risk can be brought within tolerance through mitigation. The committee cannot make an informed accept/reject/escalate decision until the risk management team and project team have identified possible controls and residual risk. Requesting mitigation measures preserves the opportunity for high returns while aligning the project with the 'moderate' appetite.

Answer

Approve the project but increase monitoring.

Answer

Escalate the decision to the board of directors.

Answer

Reject the project immediately as it exceeds risk appetite.

Question 8

A company is considering restructuring its IT department from a centralized to a decentralized model to give business units more autonomy. What is a PRIMARY governance risk associated with this move?

Accepted Answer

Inconsistent IT policies and security controls across business units.. Decentralizing IT gives business units autonomy, but the primary governance risk is that each unit may adopt its own policies, standards, and security controls. This fragmentation leads to inconsistent security postures, compliance gaps, and difficulty enforcing enterprise-wide governance. The core risk is loss of centralized control over policy and security consistency.

Answer

Difficulty in managing vendor contracts due to decentralization.

Answer

Reduced innovation due to lack of central coordination.

Answer

Increased risk of project cost overruns.

Question 9

An organization has a policy requiring annual information security awareness training for all employees. During a recent audit, it was found that 20% of employees had not completed the training. What is the BEST course of action for the IT governance committee?

Accepted Answer

Require managers to ensure their teams complete training and escalate non-compliance to HR.. The governance committee's role is to ensure policy compliance through accountability mechanisms. Requiring managers to enforce completion and escalating non-compliance to HR reinforces the policy's mandatory nature and creates consequences for non-compliance, which is the most effective way to achieve sustained compliance. This addresses the root cause—lack of enforcement—rather than weakening the policy.

Answer

Reduce the training frequency to biennial.

Answer

Extend the training deadline by three months.

Answer

Make the training optional for employees with high performance ratings.

Question 10

An IT department uses a balanced scorecard (BSC) to measure performance. The financial perspective shows that IT costs are within budget, but customer satisfaction scores are declining. The learning and growth perspective indicates low employee engagement. Which action should the IT governance committee prioritize?

Accepted Answer

Invest in training and development programs for IT staff.. The BSC's learning and growth perspective is the foundational driver of the other three perspectives — low employee engagement directly undermines process quality, customer satisfaction, and ultimately financial outcomes. Since customer satisfaction is already declining and the root cause traces to employee engagement, the governance committee should prioritize investing in training and development to fix the upstream cause. This aligns with the BSC's cause-and-effect logic where learning and growth improvements cascade into customer and financial results.

Answer

Reduce IT costs further to reallocate savings to customer service.

Answer

Increase the IT budget to hire more staff.

Answer

Outsource customer-facing IT support to a third party.

Question 11

A company plans to outsource its data center operations to a cloud service provider. What is the MOST important governance consideration for the board before finalizing the contract?

Accepted Answer

Ensure the contract includes clauses for regulatory compliance and audit rights.. The board's primary governance responsibility is to ensure the organization remains compliant with all applicable laws and regulations, even when operations are outsourced. Without explicit contractual clauses for regulatory compliance and audit rights, the company loses visibility and control over how its data is handled, creating legal and reputational risk. This is the most critical governance consideration because it directly addresses accountability and oversight.

Answer

Select a provider with the lowest cost per transaction.

Answer

Negotiate the transfer of existing IT staff to the provider.

Answer

Define a detailed exit strategy for transitioning to another provider.

Question 12

A healthcare organization must comply with HIPAA regulations regarding patient data privacy. The IT department has implemented technical controls, but the compliance officer discovers that some employees are sharing passwords. What is the BEST governance response?

Accepted Answer

Enforce the existing policy through disciplinary actions and additional training.. Password sharing is a policy violation, not a technical control failure. The best governance response is to enforce the existing policy through disciplinary action and reinforce awareness via training, addressing the human/behavioral root cause while maintaining a documented compliance posture.

Answer

Implement multi-factor authentication to prevent password sharing.

Answer

Report the incident to the regulatory authority as a data breach.

Answer

Revise the password policy to require more complex passwords.

Question 13

Which THREE of the following are components of the COBIT 2019 governance system?

Accepted Answer

Organizational structures. COBIT 2019 defines a governance system as comprising several distinct types of components, and among the listed choices the three that belong are A (Organizational structures), B (Information items), and C (Processes). Organizational structures are correct because COBIT 2019 explicitly names them as a component type, covering the various decision-making bodies and roles (such as boards, committees, and executive management) that carry out governance and management activities. Information items are correct because COBIT 2019 lists them as a component, referring to the information produced and used by the governance system to enable informed decision-making and effective operation. Processes are correct because COBIT 2019 identifies processes as a core component type, encompassing the organized sets of practices and activities (the governance and management objectives) used to achieve enterprise goals. The unmarked options do not belong: a service desk (D) is a specific IT service management function rather than a COBIT 2019 governance system component type, and a project management office (E) is a particular organizational entity or function, not one of the defined component categories in the COBIT 2019 governance system.

Answer

Service desk

Answer

Project management office

Question 14

Which TWO of the following are benefits of establishing an IT steering committee?

Accepted Answer

Enhanced prioritization of IT investments. Option B is correct because an IT steering committee's core purpose is governance: it evaluates competing IT initiatives against business value, risk, and resource capacity, thereby enhancing prioritization of IT investments so funding goes to the highest-value projects. Option C is correct because the committee is composed of senior business and IT leaders who jointly set direction, which produces better alignment between IT and business strategy and ensures IT delivers on organizational objectives. Option A is not a primary benefit of a steering committee, since operational efficiency of IT systems is achieved through operational management practices such as monitoring, tuning, and incident management rather than governance-level prioritization. Option D is incorrect because establishing a steering committee adds governance meetings and coordination effort, typically increasing rather than reducing management overhead. Option E is incorrect because steering committees provide strategic direction and oversight, not direct control over technical IT decisions, which remain with IT architects, engineers, and operational teams.

Answer

Improved operational efficiency of IT systems

Answer

Reduction of management overhead

Answer

Direct control over technical IT decisions

Question 15

A multinational manufacturing company with operations in 20 countries has historically allowed each regional division to manage its own IT systems independently. Recently, the company experienced a significant data breach originating from a region with weaker security controls, leading to financial losses and reputational damage. The board has mandated stronger IT governance to prevent future incidents. The CIO proposes implementing a global IT governance framework with centralized policy enforcement. However, regional directors argue that local regulations and business needs require autonomy. The governance committee must decide on a course of action that balances risk and business flexibility. Which of the following approaches is the MOST appropriate?

Accepted Answer

Adopt a federated governance model with global policies and local flexibility within defined tolerances.. A federated governance model with global policies and local flexibility within defined tolerances is the most appropriate because it balances the board's mandate for stronger, centralized governance with the regional directors' need for autonomy to meet local regulations and business requirements. It establishes global minimum standards while allowing regions to adapt within approved boundaries, directly addressing the risk of weak regional controls without eliminating necessary flexibility.

Answer

Allow each region to continue independently but require quarterly reporting to the committee.

Answer

Implement a fully centralized IT governance model with no regional deviations.

Answer

Maintain the status quo but enforce minimum security standards across all regions.