CISA Governance and Management of IT Practice Test 7 — 15 Questions

Question 1

A multinational corporation has defined its risk appetite as 'moderate' for IT investments. The IT steering committee is evaluating a new project with potential high returns but also significant cybersecurity risks. The project's risk profile is assessed as 'high' by the risk management team. What should the committee do FIRST?

Accepted Answer

Request the project team to identify risk mitigation measures.. Option D is correct because if the risk exceeds appetite, risk mitigation measures should be explored to bring it to an acceptable level. Option A is wrong because rejecting outright without considering mitigation may miss valuable opportunities. Option B is wrong because escalating to the board should be after mitigation options are considered. Option C is wrong because approving as is violates risk appetite.

Answer

Approve the project but increase monitoring.

Answer

Escalate the decision to the board of directors.

Answer

Reject the project immediately as it exceeds risk appetite.

Question 2

A company is considering restructuring its IT department from a centralized to a decentralized model to give business units more autonomy. What is a PRIMARY governance risk associated with this move?

Accepted Answer

Inconsistent IT policies and security controls across business units.. Option A is correct because decentralized IT can lead to inconsistent policies and standards across units. Option B is wrong because cost overruns can occur in any model. Option C is wrong because innovation may increase with autonomy. Option D is wrong because vendor management can be decentralized but still controlled.

Answer

Difficulty in managing vendor contracts due to decentralization.

Answer

Reduced innovation due to lack of central coordination.

Answer

Increased risk of project cost overruns.

Question 3

An organization has a policy requiring annual information security awareness training for all employees. During a recent audit, it was found that 20% of employees had not completed the training. What is the BEST course of action for the IT governance committee?

Accepted Answer

Require managers to ensure their teams complete training and escalate non-compliance to HR.. Option B is correct because enforcing compliance through HR and management reinforces the policy. Option A is wrong because extending the deadline does not address non-compliance. Option C is wrong because reducing training frequency weakens security. Option D is wrong because training is a mandatory policy, not optional.

Answer

Reduce the training frequency to biennial.

Answer

Extend the training deadline by three months.

Answer

Make the training optional for employees with high performance ratings.

Question 4

An IT department uses a balanced scorecard (BSC) to measure performance. The financial perspective shows that IT costs are within budget, but customer satisfaction scores are declining. The learning and growth perspective indicates low employee engagement. Which action should the IT governance committee prioritize?

Accepted Answer

Invest in training and development programs for IT staff.. Option D is correct because investing in training improves employee engagement (learning & growth) which likely leads to better service and customer satisfaction. Option A is wrong because reducing budget may worsen customer satisfaction. Option B is wrong because cost reduction does not address root cause. Option C is wrong because engaging external consultants is a temporary fix.

Answer

Reduce IT costs further to reallocate savings to customer service.

Answer

Increase the IT budget to hire more staff.

Answer

Outsource customer-facing IT support to a third party.

Question 5

A company plans to outsource its data center operations to a cloud service provider. What is the MOST important governance consideration for the board before finalizing the contract?

Accepted Answer

Ensure the contract includes clauses for regulatory compliance and audit rights.. Option A is correct because the board must ensure regulatory compliance (e.g., data residency, security standards) is contractually enforced. Option B is wrong while important, it is operational. Option C is wrong because transfer of staff is an HR concern. Option D is wrong because exit strategy is detailed but not the most critical for board.

Answer

Select a provider with the lowest cost per transaction.

Answer

Negotiate the transfer of existing IT staff to the provider.

Answer

Define a detailed exit strategy for transitioning to another provider.

Question 6

A healthcare organization must comply with HIPAA regulations regarding patient data privacy. The IT department has implemented technical controls, but the compliance officer discovers that some employees are sharing passwords. What is the BEST governance response?

Accepted Answer

Enforce the existing policy through disciplinary actions and additional training.. Option D is correct because enforcing policy through disciplinary action and training addresses the root cause. Option A is wrong because over-reliance on technical controls may not prevent deliberate sharing. Option B is wrong because policy revision alone may not change behavior. Option C is wrong because reporting to regulator is premature.

Answer

Implement multi-factor authentication to prevent password sharing.

Answer

Report the incident to the regulatory authority as a data breach.

Answer

Revise the password policy to require more complex passwords.

Question 7

Which TWO of the following are primary objectives of IT governance as defined by COBIT 5?

Accepted Answer

Resource optimization. Options A and C are correct because COBIT 5 defines IT governance objectives as stakeholder value creation and resource optimization. Option B is a management objective, not governance. Option D is a goal of information security, not governance overall. Option E is too narrow (cost reduction) and not a primary governance objective.

Answer

Cost reduction

Answer

Incident response

Answer

Data encryption

Question 8

Which THREE of the following are components of the COBIT 2019 governance system?

Accepted Answer

Organizational structures. Options A, C, and E are correct because COBIT 2019 includes governance components: Processes, Organizational Structures, and Information Items. Option B (Service Desk) is an operational process not a governance component. Option D (Project Management Office) is a management structure, not a governance component as defined in COBIT 2019.

Answer

Service desk

Answer

Project management office

Question 9

Which TWO of the following are benefits of establishing an IT steering committee?

Accepted Answer

Enhanced prioritization of IT investments. Options B and D are correct because an IT steering committee provides strategic alignment and prioritization of IT initiatives. Option A is not a benefit; it may increase bureaucracy. Option C is not a direct benefit; operational efficiency is management's role. Option E is not a primary benefit; detailed technical decisions are outside committee scope.

Answer

Improved operational efficiency of IT systems

Answer

Reduction of management overhead

Answer

Direct control over technical IT decisions

Question 10

A multinational manufacturing company with operations in 20 countries has historically allowed each regional division to manage its own IT systems independently. Recently, the company experienced a significant data breach originating from a region with weaker security controls, leading to financial losses and reputational damage. The board has mandated stronger IT governance to prevent future incidents. The CIO proposes implementing a global IT governance framework with centralized policy enforcement. However, regional directors argue that local regulations and business needs require autonomy. The governance committee must decide on a course of action that balances risk and business flexibility. Which of the following approaches is the MOST appropriate?

Accepted Answer

Adopt a federated governance model with global policies and local flexibility within defined tolerances.. Option C is correct because a federated model allows consistent governance at the top while permitting regional adaptations within defined boundaries, balancing control and flexibility. Option A is wrong because a fully centralized model may ignore local constraints and hinder business. Option B is wrong because the committee should not delegate entirely; the board expects governance. Option D is wrong because minimum standards are insufficient; a stronger framework is needed after a breach.

Answer

Allow each region to continue independently but require quarterly reporting to the committee.

Answer

Implement a fully centralized IT governance model with no regional deviations.

Answer

Maintain the status quo but enforce minimum security standards across all regions.

Question 11

A retail company is merging with a competitor. The IT departments of both organizations have different IT governance structures: Company A uses a centralized model with strict change management, while Company B uses a decentralized model with autonomous business unit IT. The CIO has been tasked with integrating the IT functions post-merger. The board expects cost synergies and improved service levels. The integration team is facing resistance from Company B's business heads who fear loss of agility. The CIO needs to propose a governance model for the merged entity. Which approach would BEST meet the board's expectations while addressing resistance?

Accepted Answer

Implement a phased integration with a transitional governance structure that includes representatives from both sides.. Option B is correct because a phased integration with interim governance allows gradual convergence, managing change and resistance while building toward synergy. Option A is wrong because immediate full centralization may cause disruption and strong resistance. Option C is wrong because adopting the weaker model (decentralized) may not achieve synergies. Option D is wrong because maintaining both models permanently does not achieve integration.

Answer

Keep both models separate and allow business units to choose their preferred model.

Answer

Adopt Company B's decentralized model to preserve agility.

Answer

Immediately impose Company A's centralized model across the merged entity.

Question 12

A medium-sized e-commerce company recently suffered a ransomware attack that encrypted critical databases. The IT team restored systems from backups, but the incident exposed a lack of clear roles and responsibilities for incident response. The board has asked the IT governance committee to review and improve the incident response governance. The committee notes that while there is an incident response policy, it is not regularly tested, and staff are unsure of their roles. The company also lacks a formal communication protocol for notifying stakeholders. What should the committee prioritize to strengthen governance over incident response?

Accepted Answer

Define and communicate clear roles and responsibilities for incident response, and establish accountability.. Option A is correct because a governance framework must include clear roles, responsibilities, and accountability, which is the root cause. Option B is wrong because technology alone does not fix governance gaps. Option C is wrong while testing is valuable, it should follow role definition. Option D is wrong because outsourcing does not address internal governance deficiencies.

Answer

Invest in advanced endpoint detection and response tools.

Answer

Outsource incident response to a managed security service provider.

Answer

Conduct a tabletop exercise to test the current plan.

Question 13

A financial services company is migrating its core banking system to a public cloud to improve scalability and reduce costs. The project is high-risk due to regulatory compliance requirements (e.g., data residency, audit trails). The IT governance committee has reviewed the project plan and finds that the risk assessment is incomplete – it does not address the potential impact of a cloud provider outage on critical transactions. The committee must approve the project or request changes. The project manager argues that the cloud provider's SLA guarantees 99.99% uptime and that additional controls would delay the project. What should the governance committee do?

Accepted Answer

Request a revised risk assessment that includes contingency plans for provider outages.. Option D is correct because the committee's duty is to ensure risks are adequately addressed; requiring a comprehensive risk assessment and contingency plans is necessary. Option A is wrong because committees should not bypass governance processes. Option B is wrong because SLAs do not cover all risks (e.g., data residency). Option C is wrong because a pilot does not address the missing assessment.

Answer

Reject the project and require the system to remain on-premises.

Answer

Approve the project based on the provider's strong SLA.

Answer

Approve a pilot migration for non-critical systems first.

Question 14

An organization is implementing an IT governance framework to align IT with business objectives. Which TWO of the following are primary responsibilities of the IT steering committee?

Accepted Answer

Approving IT project budgets and priorities. Options A and D are correct. The IT steering committee is responsible for approving IT project budgets and priorities (A) and ensuring IT investments deliver value (D). Performing daily IT operations (B) is an operational management task. Defining IT security policies (C) is typically the responsibility of the security function. Conducting technical vulnerability assessments (E) is a technical operational activity.

Answer

Performing daily IT operations

Answer

Defining IT security policies

Answer

Conducting technical vulnerability assessments

Question 15

A medium-sized manufacturing company has a decentralized IT structure where each business unit manages its own IT budget and projects. The CEO is concerned that IT investments are not aligned with corporate strategy and that there is duplication of effort. The IT department lacks a formal project portfolio management process. The company has experienced several project failures due to poor prioritization. The CEO has asked the newly hired IT auditor to recommend an initial step to improve IT governance. The auditor should recommend:

Accepted Answer

Establishing an IT steering committee with representatives from business units and IT. Option B is correct because establishing an IT steering committee is a foundational step to provide oversight, prioritize projects, and align IT with business strategy. Option A is premature; a process should be defined with governance approval. Option C addresses security but not overall governance. Option D is too drastic and does not solve the alignment issue.

Answer

Implementing a project portfolio management software tool immediately to track all projects

Answer

Conducting a security risk assessment of all IT systems

Answer

Outsourcing IT management to a third-party provider