CISA Governance and Management of IT — Timed 15 Questions

Question 1

A company's IT governance policy requires that all critical systems have a documented business continuity plan (BCP). During an audit, an IT auditor finds that the BCP for a critical financial system has not been updated in three years. Which of the following is the BEST recommendation?

15 minute time limit — choose an answer to begin.

Accepted Answer

Update the BCP to reflect current processes and conduct a test.. IT governance policies require that BCPs remain current to reflect actual operational processes. An outdated BCP (three years stale) may contain obsolete recovery procedures, contact information, or dependencies, rendering it ineffective during a real incident. Updating the BCP and then testing it validates that the documented steps align with the current system architecture and can be executed successfully, which is a core requirement of the BCP lifecycle per ISACA guidelines.

Answer

Archive the outdated BCP and develop a new one from scratch.

Answer

Accept the risk because the system has been stable.

Answer

Implement a new system with built-in redundancy.

Question 2

Which TWO of the following are key components of an IT governance framework?

Accepted Answer

Strategic alignment. Strategic alignment (B) is a key component of an IT governance framework because it ensures that IT strategies, investments, and operations are directly linked to business goals and objectives. This alignment is achieved through mechanisms such as balanced scorecards, IT steering committees, and portfolio management, which translate business strategy into IT priorities. Without strategic alignment, IT may operate in a silo, leading to wasted resources and missed opportunities for business value.

Answer

Resource management

Answer

Performance measurement

Answer

Risk management

Question 3

Which TWO of the following are key responsibilities of an IT steering committee?

Accepted Answer

Approving the annual IT budget and major capital expenditures. An IT steering committee is a governance body that provides strategic direction and oversight, so option A (approving the annual IT budget and major capital expenditures) is correct because allocating and authorizing funding for IT investments is a core governance responsibility that ensures projects align with business strategy. Option C (defining IT policies and standards) is also correct because the steering committee sets the high-level rules, standards, and priorities that guide the IT organization and ensure consistency, compliance, and risk management. The remaining options are operational or hands-on technical tasks: B (daily system monitoring and incident response) belongs to IT operations or a SOC, D (writing application code) belongs to software developers, and E (configuring firewall rules and network access controls) belongs to network or security engineers, none of which are steering-committee responsibilities.

Answer

Performing daily system monitoring and incident response

Answer

Writing application code for new software features

Answer

Configuring firewall rules and network access controls

Question 4

Match each COBIT 5 domain to its description.

Accepted Answer

EDM: Ensures stakeholder needs are addressed, governance objectives are met, and the enterprise is directed and monitored.. COBIT 5 has five process domains: EDM (governance), APO (planning), BAI (acquisition/implementation), DSS (delivery/support), and MEA (monitoring). Correct matches are as above; common confusions involve swapping APO/MEA or DSS/APO.

Answer

MEA: Manages IT resources and capabilities to optimize performance.

Answer

DSS: Ensures alignment of IT strategy with business goals.

Question 5

Match each log type to its typical content.

Accepted Answer

Audit Log: Records user activities and changes for compliance.. Logs are essential for monitoring and forensics. Correct matches: Audit Log tracks user activities and compliance, Security Log tracks security events, System Log tracks OS events, Application Log tracks application events. Common confusions include mixing system events with audit logs and application errors with security logs.

Answer

Audit Log: Records system startup/shutdown events.

Answer

Security Log: Records application errors.

Question 6

A small business lacks formal IT governance. What is the FIRST step to establish governance?

Accepted Answer

Conduct a risk assessment. The first step in establishing IT governance is to conduct a risk assessment, because governance decisions (policies, roles, controls) must be driven by an understanding of the organization's risks and objectives. Without knowing what risks exist, any policies or structures created would be arbitrary. Risk assessment informs the scope and priorities of the governance framework.

Answer

Assign an IT manager

Answer

Define IT policies

Answer

Implement COBIT

Question 7

A financial institution is required by regulators to demonstrate that IT controls are effective. Which of the following provides the BEST evidence?

Accepted Answer

Service organization control (SOC) reports. Service organization control (SOC) reports are independent audits of control effectiveness, highly regarded by regulators. Internal audit reports are valuable but may lack independence; risk register and balanced scorecard are not direct evidence of control effectiveness.

Answer

IT balanced scorecard

Answer

Internal audit reports

Answer

IT risk register

Question 8

An organization is implementing IT governance based on COBIT. Which THREE of the following are enablers? (Select exactly three.)

Accepted Answer

Organizational structures. In COBIT 2019, governance is implemented through seven enablers, and the correct answers here are B, C, and E. Organizational structures (B) are an enabler because COBIT defines them as the formal decision-making and accountability arrangements (e.g., boards, committees, roles) that direct and monitor governance activities. Culture, ethics, and behavior (C) are an enabler because COBIT recognizes that individual and organizational values, ethics, and behavioral patterns are essential to making governance work in practice. Processes (E) are an enabler because COBIT describes processes as organized sets of practices and activities that achieve governance and management objectives. Options A and D are not COBIT enablers: application software and network infrastructure are specific technology assets or resources, which COBIT addresses under the broader enabler of 'information, technology, and infrastructure' rather than as separate enablers.

Answer

Application software

Answer

Network infrastructure

Question 9

Refer to the exhibit. Based on the governance status report, which component should be addressed as a priority?

Accepted Answer

Resource Optimization. Resource Optimization is the correct answer because the governance status report likely shows it as the component with the most critical gaps or lowest maturity, making it the priority for improvement. In IT governance frameworks like COBIT, resource optimization ensures that IT resources (applications, information, infrastructure, and people) are allocated and managed efficiently to support business objectives. When this area is deficient, it directly impacts the organization's ability to deliver value and can lead to wasted investments, making it a high-priority concern.

Answer

Strategy Alignment

Answer

Performance Measurement

Answer

Risk Management

Question 10

Refer to the exhibit. The organization is planning to achieve the target level. What is the MOST appropriate action?

Accepted Answer

Implement process metrics and statistical controls. To move from Level 3 (Established) to Level 4 (Predictable), the process must be measured and controlled using statistical techniques. Implementing metrics and statistical controls directly addresses the gap. Documentation, ownership, and training are earlier-level activities.

Answer

Assign a process owner

Answer

Conduct awareness training

Answer

Increase process documentation

Question 11

Refer to the exhibit. Which perspective shows the greatest deviation from target?

Accepted Answer

Learning & Growth. The Learning & Growth perspective shows the greatest deviation from target, as indicated in the exhibit (likely a balanced scorecard dashboard). This perspective focuses on employee training, culture, and innovation, which are leading indicators for future performance.

Answer

Customer

Answer

Financial

Answer

Internal Process

Question 12

Which TWO of the following are key components of an IT governance framework?

Accepted Answer

IT strategy committee. An IT governance framework defines the decision-making structures and processes that ensure IT supports and enables business strategy, and the IT strategy committee (A) is a core structural component because it provides executive-level direction, oversight, and accountability for aligning IT investments with organizational objectives. IT risk management (C) is likewise a key component, since governance requires identifying, assessing, and mitigating technology-related risks to acceptable levels in line with the organization's risk appetite. By contrast, an IT asset inventory (B) is an operational/configuration-management artifact, IT project portfolio management (D) is a delivery and prioritization discipline that supports but does not itself constitute the governance framework, and an IT help desk ticketing system (E) is a service-management tool, none of which are the defining components of governance.

Answer

IT asset inventory

Answer

IT project portfolio management

Answer

IT help desk ticketing system

Question 13

An organization is adopting COBIT 2019. Which TWO of the following are components of the governance system?

Accepted Answer

Processes. In COBIT 2019, the governance system is built from a set of governance system components (formerly called enablers), and Processes (A) is one of them — it covers the defined practices and activities that achieve governance and management objectives. Organizational structures (D) is also a core component, describing the decision-making entities such as boards, committees, and roles that carry out governance. The other listed items are not COBIT 2019 governance system components: IT hardware inventory (B) is an asset/infrastructure detail, Information flows (C) is not one of the defined components (COBIT addresses information as part of the 'Information' component, not 'information flows'), and Employee satisfaction surveys (E) are a measurement/feedback tool rather than a governance system component.

Answer

IT hardware inventory

Answer

Information flows

Answer

Employee satisfaction surveys

Question 14

Which of the following is a potential risk in this RACI matrix?

Accepted Answer

The Change Manager is responsible but lacks authority to approve.. In a RACI matrix, the 'Responsible' party does the work, while the 'Accountable' party has final decision authority. If the Change Manager is marked Responsible but lacks authority to approve changes, this creates a governance risk: the person executing the change cannot ensure proper approval, leading to unauthorized or poorly vetted changes. This is a classic segregation-of-duties issue.

Answer

The IT Director is accountable but not informed of all changes.

Answer

IT Operations is informed, but should be responsible for implementation.

Answer

The Business Process Owner is consulted, which may delay approvals.

Question 15

What is the MOST significant weakness in the planned remediation?

Accepted Answer

The remediation may not eliminate the segregation of duties issue.. The remediation's core purpose is to resolve a segregation of duties (SoD) conflict, so the most significant weakness is whether it actually eliminates that conflict. If the remediation merely reassigns or masks the conflicting access without truly separating the incompatible duties, the underlying SoD risk persists. CISA exam logic prioritizes whether the root cause is addressed over scope, technology choice, or compensating controls.

Answer

The remediation only addresses a subset of projects.

Answer

The remediation relies on technology rather than process.

Answer

The remediation does not include a compensating control.