CISA Governance and Management of IT Practice Test 8 — 15 Questions

Question 1

A retail company is merging with a competitor. The IT departments of both organizations have different IT governance structures: Company A uses a centralized model with strict change management, while Company B uses a decentralized model with autonomous business unit IT. The CIO has been tasked with integrating the IT functions post-merger. The board expects cost synergies and improved service levels. The integration team is facing resistance from Company B's business heads who fear loss of agility. The CIO needs to propose a governance model for the merged entity. Which approach would BEST meet the board's expectations while addressing resistance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a phased integration with a transitional governance structure that includes representatives from both sides.. A phased integration with a transitional governance structure that includes representatives from both sides allows the merged entity to gradually converge governance models, manage change and resistance, and work toward cost synergies and improved service levels without immediately disrupting business operations. Option A is incorrect because keeping both models separate permanently fails to achieve the desired integration and synergies. Option B is incorrect because fully adopting the decentralized model may not deliver the cost synergies and centralized control expected by the board. Option C is incorrect because immediately imposing a centralized model would likely cause strong resistance from Company B's business heads and disrupt agility, undermining the merger's success.

Answer

Keep both models separate and allow business units to choose their preferred model.

Answer

Adopt Company B's decentralized model to preserve agility.

Answer

Immediately impose Company A's centralized model across the merged entity.

Question 2

A medium-sized e-commerce company recently suffered a ransomware attack that encrypted critical databases. The IT team restored systems from backups, but the incident exposed a lack of clear roles and responsibilities for incident response. The board has asked the IT governance committee to review and improve the incident response governance. The committee notes that while there is an incident response policy, it is not regularly tested, and staff are unsure of their roles. The company also lacks a formal communication protocol for notifying stakeholders. What should the committee prioritize to strengthen governance over incident response?

Accepted Answer

Define and communicate clear roles and responsibilities for incident response, and establish accountability.. The committee should prioritize defining and communicating clear roles and responsibilities for incident response and establishing accountability. The incident exposed a lack of clarity in roles, which is a governance issue. Without clear roles, even the best tools or outsourced services may not be effective. This directly addresses the governance gap identified.

Answer

Invest in advanced endpoint detection and response tools.

Answer

Outsource incident response to a managed security service provider.

Answer

Conduct a tabletop exercise to test the current plan.

Question 3

A financial services company is migrating its core banking system to a public cloud to improve scalability and reduce costs. The project is high-risk due to regulatory compliance requirements (e.g., data residency, audit trails). The IT governance committee has reviewed the project plan and finds that the risk assessment is incomplete – it does not address the potential impact of a cloud provider outage on critical transactions. The committee must approve the project or request changes. The project manager argues that the cloud provider's SLA guarantees 99.99% uptime and that additional controls would delay the project. What should the governance committee do?

Accepted Answer

Request a revised risk assessment that includes contingency plans for provider outages.. The governance committee's role is to ensure that risks are identified, assessed, and mitigated before approving a high-risk project. An incomplete risk assessment that ignores the impact of a cloud provider outage on critical banking transactions is a material gap. Requesting a revised risk assessment with contingency plans directly addresses this gap while allowing the project to proceed responsibly. This aligns with CISA's emphasis on risk-based decision-making and IT governance.

Answer

Reject the project and require the system to remain on-premises.

Answer

Approve the project based on the provider's strong SLA.

Answer

Approve a pilot migration for non-critical systems first.

Question 4

An organization is implementing an IT governance framework to align IT with business objectives. Which TWO of the following are primary responsibilities of the IT steering committee?

Accepted Answer

Approving IT project budgets and priorities. Option C is correct because an IT steering committee is a governance body that reviews and approves IT project budgets and sets project priorities, ensuring that funding and sequencing decisions align with business strategy rather than being left to operational teams. Option E is correct because a core governance responsibility is ensuring IT investments deliver value, which the committee accomplishes by monitoring benefits realization, tracking ROI, and holding IT accountable for outcomes tied to business objectives. Options A, B, and D do not belong: performing daily IT operations (A) is an operational/IT operations function, defining IT security policies (B) is typically delegated to a security governance or CISO function (the steering committee may endorse them but does not author them), and conducting technical vulnerability assessments (D) is a hands-on technical security task performed by security engineers or analysts, not a governance committee.

Answer

Performing daily IT operations

Answer

Defining IT security policies

Answer

Conducting technical vulnerability assessments

Question 5

A medium-sized manufacturing company has a decentralized IT structure where each business unit manages its own IT budget and projects. The CEO is concerned that IT investments are not aligned with corporate strategy and that there is duplication of effort. The IT department lacks a formal project portfolio management process. The company has experienced several project failures due to poor prioritization. The CEO has asked the newly hired IT auditor to recommend an initial step to improve IT governance. The auditor should recommend:

Accepted Answer

Establishing an IT steering committee with representatives from business units and IT. An IT steering committee provides governance oversight, ensures alignment with corporate strategy, and helps prioritize projects to avoid duplication. This foundational step addresses the root cause of poor alignment and project failures before implementing tools or processes. Option B is premature because a tool without governance oversight may not improve prioritization. Option C focuses on security, not overall strategic alignment. Option D is drastic and does not address internal governance issues.

Answer

Implementing a project portfolio management software tool immediately to track all projects

Answer

Conducting a security risk assessment of all IT systems

Answer

Outsourcing IT management to a third-party provider

Question 6

A large financial institution has a well-defined IT governance framework with a clear organizational structure, policies, and processes. However, the internal audit department has identified that several IT projects are over budget and behind schedule. The project managers blame unclear requirements and scope creep. The IT governance committee meets monthly but reviews projects only at a high level. The auditor's best recommendation to improve project governance is to:

Accepted Answer

Establish a project management office (PMO) to oversee project governance and reporting. Establishing a project management office (PMO) provides standardized project management practices, oversight, and controls to prevent scope creep and improve delivery. Option A is tactical and focuses on security, not project delivery. Option B changes meeting frequency but does not establish a dedicated project governance function. Option D mandates a tool but does not address underlying governance processes.

Answer

Increase the frequency of security reviews for all projects

Answer

Change the IT steering committee's meeting frequency to weekly with detailed reviews

Answer

Require all projects to use a specific project management software tool

Question 7

A multinational corporation operates in a highly regulated industry. The IT governance framework includes a risk appetite statement approved by the board. Recently, the company suffered a significant data breach due to an unpatched vulnerability that had been identified three months earlier. The IT audit found that the vulnerability was reported to the IT department but was not prioritized for remediation because it was deemed low risk by the IT operations team. The incident response plan was not activated because the breach was not initially detected. The board wants to strengthen governance to prevent recurrence. The most effective course of action for the auditor to recommend is:

Accepted Answer

Establishing a formal vulnerability management policy that requires risk-based prioritization in accordance with the risk appetite and escalation to the IT risk committee for decisions outside tolerance. The root cause is a governance failure: the IT operations team made a risk-acceptance decision that exceeded its authority, without a formal process tying vulnerability prioritization to the board-approved risk appetite. A vulnerability management policy that mandates risk-based prioritization aligned with the risk appetite and requires escalation to the IT risk committee when findings fall outside tolerance directly addresses this governance gap. This is the most effective recommendation because it fixes the decision-making framework, not just the symptom.

Answer

Deploying an intrusion detection system to identify breaches sooner

Answer

Disciplining the IT operations team for not escalating the vulnerability

Answer

Implementing a more robust patch management system with automated patching

Question 8

Which TWO of the following are recommended practices for aligning IT strategy with business goals, according to COBIT 2019?

Accepted Answer

Adopting a governance framework that covers all IT-related activities and stakeholder needs. Option C is correct because COBIT 2019's governance system is explicitly built on a governance framework that spans the whole enterprise—covering all IT-related activities through the governance and management objectives and addressing the needs of internal and external stakeholders, which is exactly what aligning IT strategy with business goals requires. Option D is correct because COBIT 2019's BA (Build, Acquire and Implement) and APO (Align, Plan and Organise) domains, particularly APO05 Managed Portfolio, call for managing IT investments as a portfolio prioritised by business value and strategic contribution, directly tying IT spending to business goals. Option A is not marked correct because continuous monitoring of operational metrics is a performance/operations practice rather than a strategic alignment practice in COBIT 2019. Option B is not marked correct because, while steering committees are useful, COBIT 2019 does not prescribe monthly IT steering committee meetings as a recommended alignment practice. Option E is not marked correct because COBIT 2019 is methodology-agnostic and does not mandate agile for all IT projects as a means of strategic alignment.

Answer

Implementing a continuous monitoring system for IT operational metrics

Answer

Conducting monthly IT steering committee meetings to review project status

Answer

Using agile development methodologies for all IT projects

Question 9

A medium-sized manufacturing company has recently deployed an ERP system to integrate its financial, supply chain, and HR processes. The IT department is small (5 staff) and reports to the CFO. The company has no formal IT governance committee; IT decisions are made by the CFO and CEO informally. During a recent audit, it was found that several critical security patches for the ERP system have not been applied, and there are no documented procedures for change management. The IT manager states that patches are applied when time permits, and changes are discussed via email. The CFO argues that the ERP is running fine and the audit findings are low risk. The IS auditor needs to recommend a course of action to improve IT governance. Which of the following is the MOST appropriate initial step?

Accepted Answer

Recommend the formation of an IT steering committee comprising key business stakeholders to oversee IT strategy, risk, and resource allocation. The root cause of the audit findings is the absence of IT governance, not the missing patches themselves. Forming an IT steering committee establishes a governance structure that aligns IT strategy with business objectives, assigns accountability for risk, and provides oversight for change and patch management. This addresses the underlying governance gap rather than a symptom, making it the most appropriate initial step for the IS auditor to recommend.

Answer

Elevate the issue to the board of directors with a recommendation to outsource IT management

Answer

Develop a comprehensive patch management policy and present it to the CFO for approval

Answer

Insist that the IT manager immediately apply all missing patches within one week

Question 10

An IS auditor is reviewing the organization's IT governance framework. The board has delegated oversight of IT to an IT steering committee. The auditor finds that the committee meets quarterly, but its charter does not define decision rights or escalation procedures. Which of the following is the MOST significant concern?

Accepted Answer

The committee's charter lacks clear decision rights and escalation procedures, creating ambiguity in IT decision-making.. The most significant concern is the lack of defined decision rights and escalation procedures in the committee's charter. Effective IT governance requires clear authority for decision-making and a defined path for escalating issues. Without these, the committee cannot ensure timely, accountable IT decisions, leading to potential misalignment with business objectives and unmanaged risks. Meeting frequency and representation are secondary to this structural gap.

Answer

The board has delegated IT oversight to a committee, which dilutes board accountability.

Answer

The committee meets too infrequently to govern IT effectively.

Answer

The committee does not include business unit representatives, limiting its perspective.

Question 11

An IS auditor is reviewing an organization's IT governance structure and finds that the IT steering committee meets quarterly but has no defined charter or decision-making authority. Which of the following is the MOST significant risk arising from this situation?

Accepted Answer

IT initiatives may not be aligned with business strategy due to unclear governance mandate.. A steering committee without a formal charter and decision-making authority cannot fulfill its governance role. The most critical risk is that IT initiatives will not be aligned with business strategy because the committee lacks the mandate to prioritize and enforce alignment. This undermines the entire purpose of IT governance, making other operational risks secondary.

Answer

The committee may lack the technical expertise to evaluate IT projects.

Answer

IT projects may experience delays due to infrequent meetings.

Answer

The committee may exceed its budget due to lack of financial oversight.

Question 12

An IS auditor is reviewing the governance structure of a large retail company. The board has delegated all IT oversight to the IT steering committee, which meets quarterly and focuses primarily on project prioritization. The auditor notes that the board receives no IT-related reports and does not review IT risks. Which of the following is the MOST significant governance concern?

Accepted Answer

The board has not retained ultimate responsibility for IT governance and oversight.. The board retains ultimate accountability for IT governance and must ensure oversight, even when delegating to committees. Without board-level reporting and risk review, the governance structure lacks direction and accountability, increasing the risk of IT failures and misalignment with business objectives. Other concerns, such as meeting frequency or committee focus, are secondary to this foundational failure.

Answer

There is no independent assurance over IT activities reported to the board.

Answer

The IT steering committee is too focused on project prioritization and ignores other IT domains.

Answer

The IT steering committee meets only quarterly, which is insufficient to address emerging IT risks.

Question 13

An IS auditor is reviewing an organization's IT governance framework and notices that the IT steering committee, chaired by the CIO, approves all IT investments and also monitors their benefits realization. The board has delegated full IT decision-making authority to this committee. The auditor is MOST likely to conclude that:

Accepted Answer

The committee's dual role of approving investments and monitoring benefits creates a self-review risk that weakens independent oversight.. The IT steering committee, led by the CIO, both approves IT investments and monitors their benefits, which is a self-review conflict. The board has delegated full authority, meaning it lacks independent oversight. Effective IT governance requires separation between those who make investment decisions and those who evaluate their outcomes. The auditor should conclude that this structure weakens independent oversight and may lead to biased benefits assessments.

Answer

The arrangement is appropriate as long as the committee reports regularly to the board on its decisions and outcomes.

Answer

The committee structure provides adequate oversight because the CIO has the technical expertise to evaluate IT investments.

Answer

The board's delegation of full authority to the committee is acceptable because IT governance is an operational responsibility, not a board responsibility.

Question 14

An IS auditor is reviewing an organization's IT governance structure. The board of directors has delegated all IT oversight to the CIO, who reports to the CFO. The auditor finds that the board receives only annual summaries of IT performance and never reviews IT risks. Which of the following is the MOST significant governance concern?

Accepted Answer

The board has not retained ultimate responsibility for IT oversight.. The board of directors holds ultimate accountability for IT governance, including oversight of IT risks and alignment with business strategy. Delegating all oversight to the CIO without active board involvement and only receiving annual summaries means the board is not fulfilling its fiduciary duty. This creates a significant governance risk because IT decisions may not be aligned with stakeholder interests and risks may go unaddressed. The auditor should highlight this as a critical concern.

Answer

The CFO should not have IT reporting to them because it creates a conflict of interest.

Answer

IT performance is not measured using balanced scorecard metrics.

Answer

The CIO lacks the authority to implement IT strategies.

Question 15

A mid-sized insurance company has decided to adopt a formal IT governance framework because its board is concerned about unmanaged IT risk. The CIO asks the IS auditor to recommend the FIRST step in establishing the governance framework. Which of the following should the IS auditor recommend?

Accepted Answer

Define IT governance objectives and align them with enterprise strategic goals.. The first step in establishing IT governance is to define objectives that align IT with enterprise strategy. This ensures that all subsequent governance structures, processes, and metrics are purposeful and support business goals. Without this alignment, other activities such as scorecards, RACI matrices, or steering committees lack a foundation and may not effectively manage IT-related risks or deliver value to the organization.

Answer

Create a RACI matrix for all IT processes to clarify accountability.

Answer

Implement a balanced scorecard to measure IT performance across four perspectives.

Answer

Establish an IT steering committee to oversee IT investment decisions.