CISA Governance and Management of IT — Timed 10 Questions

Question 1

An organization outsources its data center operations. What is the BEST way to ensure the service provider's controls are effective?

Accepted Answer

Conduct periodic third-party audits. Independent third-party audits provide objective verification of controls. Option B is incorrect because relying solely on the provider's internal audit may lack independence. Option C is incorrect because SLAs focus on performance, not control effectiveness. Option D is incorrect because requiring all controls may be impractical and expensive.

Answer

Rely on the provider's internal audit reports

Answer

Monitor service level agreements only

Answer

Require the provider to implement all organizational controls

Question 2

A business continuity plan (BCP) includes a tabletop exercise once a year. An IS auditor finds that the exercise only involves IT staff. Which of the following is the BEST recommendation?

Accepted Answer

Invite business process owners to participate in future exercises. A BCP exercise should involve business process owners to validate that the plan supports business continuity beyond IT. Option A (failover test) is too narrow and does not address the lack of business involvement. Option B focuses on increasing the frequency of IT-only exercises, which does not solve the participation gap. Option D adds a data restoration test, which is technical and does not ensure business unit coordination.

Answer

Perform a failover test of the production environment

Answer

Increase the frequency of IT-only exercises

Answer

Include a data restoration test in the exercise

Question 3

A large enterprise recently experienced a data breach due to an insider threat. The IT governance committee is reviewing the incident and considering measures to prevent recurrence. Which of the following is the BEST course of action to address the root cause?

Accepted Answer

Implement a privileged access management (PAM) solution to control and monitor elevated access.. A privileged access management (PAM) solution directly addresses the root cause of an insider threat by controlling, monitoring, and auditing elevated access rights. Since the breach was caused by an insider, limiting and tracking privileged accounts prevents unauthorized or excessive use of administrative credentials, which is the most effective preventive measure against recurrence.

Answer

Increase logging and auditing of all user activities.

Answer

Deploy a security information and event management (SIEM) tool.

Answer

Terminate the employment of the insider who caused the breach.

Question 4

A multinational corporation is adopting a hybrid cloud strategy. The IT governance board must decide on a framework to ensure alignment with business objectives and regulatory compliance. Which framework is MOST appropriate?

Accepted Answer

COBIT 2019. COBIT 2019 is the most appropriate framework because it is specifically designed for IT governance, providing a comprehensive set of controls and processes to align IT with business objectives and ensure regulatory compliance. In a hybrid cloud strategy, COBIT 2019's focus on governance objectives, stakeholder needs, and risk management directly addresses the board's need for oversight across on-premises and cloud environments, unlike frameworks that target service management, security, or project management.

Answer

ITIL 4 Service Value System

Answer

ISO/IEC 27001 Information Security Management

Answer

PMBOK Guide

Question 5

An organization's IT strategy must be aligned with business strategy. Which of the following is the PRIMARY benefit of this alignment?

Accepted Answer

Increased value of IT investments to business objectives. When IT strategy is aligned with business strategy, every IT investment is directly tied to achieving specific business objectives, such as increasing revenue, improving customer experience, or enabling new business models. This alignment ensures that resources are allocated to projects that deliver measurable business value, rather than being spent on technology for its own sake. The primary benefit is therefore the increased value of IT investments to business objectives, as misalignment often leads to wasted expenditure on systems that do not support core business goals.

Answer

Faster adoption of new technologies

Answer

Enhanced security posture

Answer

Reduced IT operational costs

Question 6

A financial institution is evaluating its IT governance structure. Which of the following roles is BEST suited to ensure independent oversight of IT investments?

Accepted Answer

IT Audit Committee. The IT Audit Committee is the correct answer because it provides independent oversight of IT investments by operating outside of management's direct reporting structure. Unlike the CIO, PMO director, or CISO, who are all part of management and may have vested interests in project approvals or resource allocation, the IT Audit Committee reports to the board of directors and ensures that IT investments align with enterprise strategy, risk appetite, and regulatory requirements without bias.

Answer

Chief Information Officer (CIO)

Answer

Project Management Office (PMO) director

Answer

Chief Information Security Officer (CISO)

Question 7

An organization is implementing a new ERP system. The project sponsor requests a change that will significantly increase project scope without additional budget. Which of the following is the BEST action for the project manager?

Accepted Answer

Initiate the formal change control process and escalate to the steering committee.. The project manager must follow the formal change control process to evaluate the impact of a scope change that lacks additional budget. Escalating to the steering committee is appropriate because they have the authority to approve or reject changes that affect project constraints, ensuring alignment with organizational governance and IT strategy.

Answer

Accept the change and adjust the project timeline accordingly.

Answer

Implement the change and inform the steering committee later.

Answer

Reject the change because it is outside the original scope.

Question 8

An IT manager needs to ensure that the organization's IT resources are used efficiently. Which of the following is the BEST metric to measure IT resource utilization?

Accepted Answer

Average server CPU utilization. Average server CPU utilization directly measures how much of the computing capacity is being consumed over time, making it the most relevant metric for assessing whether IT resources are being used efficiently. High or low CPU utilization can indicate over-provisioning, under-utilization, or potential performance bottlenecks, enabling the IT manager to optimize resource allocation.

Answer

System uptime percentage

Answer

Number of help desk tickets resolved per day

Answer

Percentage of projects completed on time

Question 9

A company's IT governance policy requires that all critical systems have a documented business continuity plan (BCP). During an audit, an IT auditor finds that the BCP for a critical financial system has not been updated in three years. Which of the following is the BEST recommendation?

Accepted Answer

Update the BCP to reflect current processes and conduct a test.. IT governance policies require that BCPs remain current to reflect actual operational processes. An outdated BCP (three years stale) may contain obsolete recovery procedures, contact information, or dependencies, rendering it ineffective during a real incident. Updating the BCP and then testing it validates that the documented steps align with the current system architecture and can be executed successfully, which is a core requirement of the BCP lifecycle per ISACA guidelines.

Answer

Archive the outdated BCP and develop a new one from scratch.

Answer

Accept the risk because the system has been stable.

Answer

Implement a new system with built-in redundancy.

Question 10

Which of the following is the PRIMARY purpose of an IT governance framework?

Accepted Answer

To ensure IT aligns with and supports business strategy. The primary purpose of an IT governance framework is to ensure that IT investments, strategies, and operations are aligned with and support the overall business strategy, enabling the organization to achieve its goals. This alignment is achieved through mechanisms such as strategic planning, portfolio management, and performance measurement, which are core to frameworks like COBIT 2019. Without this alignment, IT may operate in isolation, leading to wasted resources and missed business opportunities.

Answer

To ensure compliance with laws and regulations

Answer

To protect IT assets from cyber threats

Answer

To reduce IT operational costs