DPI Practice Questions 1 — 50 Questions

Question 1

A CISO is evaluating why security compliance failures continue to occur despite extensive policies. According to ITIL 4 guiding principles and GRC best practices, which THREE underlying root causes should the CISO investigate? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security and compliance teams operate in strict silos, failing to collaborate with business operations ('Collaborate and promote visibility').. Option B is correct because ITIL 4's 'Collaborate and promote visibility' principle warns that siloed security and compliance teams that do not work with business operations create blind spots, misaligned controls, and unenforced policies, which directly explains persistent compliance failures. Option C is correct because 'Keep it simple and practical' means policies that are overly bureaucratic and impractical drive employees to workarounds and shadow IT, so the controls exist on paper but are bypassed in practice, producing compliance failures. Option D is correct because 'Focus on value' requires risk management to be tied to customer and business value streams; when policies appear as arbitrary roadblocks disconnected from value, the business resists or ignores them, undermining compliance. Option A is not correct because ITIL 4 and GRC best practices do not treat eliminating human error through excessive automation as a root cause of compliance failure; over-automation is not the stated problem, and zero tolerance for human error is neither realistic nor a guiding principle. Option E is not correct because thoroughly examining the current state is a sound starting point in ITIL 4's 'Start where you are' principle, not a root cause of compliance failures.

Answer

The organization may have automated too many security controls, leaving zero room for human error.

Answer

The CISO may have started their assessment by looking at the current state too thoroughly.

Question 2

An organization is implementing a comprehensive KPI framework across its IT value streams. During the DPI review, the strategist identifies that several metrics are causing dysfunctional behaviors. Which THREE warning signs indicate that a KPI is poorly designed and driving negative behavior?

Accepted Answer

Teams artificially inflate ticket counts or close trivial tasks rapidly to boost productivity numbers.. Option A is correct because gaming a metric—such as artificially inflating ticket counts or rapidly closing trivial tasks—is a classic dysfunctional behavior showing the KPI rewards volume over value, which distorts true productivity. Option B is correct because hiding service failures or delays to protect a departmental scorecard indicates the metric drives fear and opacity rather than transparency and continuous improvement. Option E is correct because local KPI success while enterprise strategic goals fail demonstrates suboptimization, where the metric is misaligned with the broader value stream and organizational objectives. Option C does not belong because objective, automated data from ServiceNow is a desirable KPI design characteristic, not a warning sign of dysfunction. Option D does not belong because monthly trend review with business stakeholders is a healthy governance practice that supports alignment, not a negative behavioral indicator.

Answer

The metric is based on objective, automated data collected directly from ServiceNow.

Answer

The metric trend is reviewed monthly in collaboration with business stakeholders.

Question 3

An internal audit reveals that privileged access management (PAM) policies are frequently bypassed by systems administrators during critical outages. The security team wants to enforce rigid automated lockdowns. How should the 'Collaborate and promote visibility' and 'Think and work holistically' principles be combined to address this?

Accepted Answer

Engage system administrators and auditors together to design transparent, auditable 'break-glass' emergency access workflows.. Engaging system administrators and auditors together to design transparent, auditable 'break-glass' emergency access workflows combines 'Collaborate and promote visibility' (bringing stakeholders together for shared understanding) with 'Think and work holistically' (addressing the entire access lifecycle, including emergencies). This produces a solution that respects operational urgency while maintaining auditability and control.

Answer

Outsource all outage troubleshooting to external vendors who are subject to PAM controls.

Answer

Suspend all PAM controls permanently so administrators can never be blocked during an outage.

Answer

Implement immediate automated termination for any admin who bypasses PAM, regardless of outage severity.

Question 4

An enterprise IT organization is designing a value-based measurement framework for cloud migration initiatives. Which THREE strategic considerations must the strategist address to ensure the framework accurately captures business value?

Accepted Answer

Linking cloud infrastructure investments directly to business agility, revenue growth, and risk reduction.. Option C is correct because a value-based framework must connect cloud spending to strategic business outcomes such as agility, revenue growth, and risk reduction, rather than treating infrastructure as an isolated IT cost. Option D is correct because measuring user adoption and productivity gains captures realized business value, whereas counting migrated VMs only reflects activity or output, not outcomes. Option E is correct because TCO combined with financial return (e.g., ROI/NPV) gives a complete economic picture, preventing decisions based only on low initial migration costs. Option A is incorrect because restricting metrics to raw CPU and memory utilization ignores business value and focuses narrowly on technical resource usage. Option B is incorrect because eliminating stakeholder feedback and qualitative assessments removes important context about perceived value, satisfaction, and adoption that quantitative metrics alone may miss.

Answer

Ensuring all metrics are restricted exclusively to raw server CPU and memory utilization.

Answer

Eliminating any requirement for stakeholder feedback or qualitative value assessments.

Question 5

During the execution of an organization-wide continual improvement initiative, leadership notices that improvements are implemented locally but rarely sustained. What communication and OCM gap is the root cause?

Accepted Answer

Communication was treated as a one-off launch event rather than an ongoing campaign tied to cultural reinforcement.. Sustaining improvements requires embedding new behaviors into performance metrics, reward systems, and cultural norms, rather than treating communication as a one-time launch event.

Answer

The IT service desk failed to categorize incidents according to ITIL 4 service desk practices.

Answer

The steering committee held meetings via video conference instead of in-person boardrooms.

Answer

The continual improvement register was stored in a spreadsheet instead of a relational database.

Question 6

An IT improvement team using Confluence and Jira is reviewing completed improvement actions. They want to conduct a structured 'lessons learned' review to capture what went well and what could be improved for future cycles. Which technique should the facilitator employ?

Accepted Answer

Conduct an Agile Retrospective meeting using structured brainstorming and categorization boards.. An Agile Retrospective is the structured ceremony designed precisely for reviewing completed work to capture what went well, what did not, and what to improve next cycle. Using brainstorming and categorization boards (for example, Start/Stop/Continue or Mad/Sad/Glad) gives the facilitator a repeatable format that surfaces themes and produces actionable improvements.

Answer

Initiate a Major Problem Review with external vendors.

Answer

Perform a SWOT analysis on the enterprise organizational structure.

Answer

Execute a root cause analysis using the Ishikawa (fishbone) diagram.

Question 7

An organization is defining its long-term aspirations. Which element specifically articulates the ultimate goal of what the organization intends to become in the future?

Accepted Answer

Vision statement. A vision statement articulates the ultimate future state the organization intends to become — it is aspirational, forward-looking, and describes 'what we want to be.' It differs from a mission statement, which describes the organization's purpose and reason for existing in the present. The vision is the north star that strategy and operational plans align to.

Answer

Value stream map

Answer

Operational plan

Answer

Mission statement

Question 8

A telecommunications company is planning a major value stream transformation to support a new 5G service offering. During the planning phase, the team maps out customer demand, design, build, test, and release. They notice that testing takes 80% of the total lead time. What is the most strategic planning intervention?

Accepted Answer

Invest in test automation and continuous testing infrastructure within the value stream plan.. When testing consumes 80% of total lead time, the dominant constraint is the test phase, so the highest-leverage planning intervention is to invest in test automation and continuous testing infrastructure. This directly attacks the bottleneck, reducing test cycle time, enabling faster feedback, and shrinking overall lead time without sacrificing quality. Value stream transformation planning should target the largest source of delay first.

Answer

Increase the size of development batches to reduce test frequency.

Answer

Eliminate testing phases to accelerate service release.

Answer

Outsource development while keeping testing manual and internal.

Question 9

A strategic planning team is translating the corporate vision into actionable goals for various business units. Which approach best ensures effective strategy cascading?

Accepted Answer

Ensuring every operational objective directly supports and traces back to the strategic vision.. Effective strategy cascading requires line-of-sight traceability: every operational objective must demonstrably support and roll up to the strategic vision. This ensures resources, metrics, and accountability align across levels and prevents departments from drifting into activities that do not advance enterprise goals.

Answer

Isolating executive leadership from operational teams to maintain top-down control.

Answer

Relying strictly on informal communication without documented metrics.

Answer

Allowing individual departments to create strategies completely independent of the enterprise.

Question 10

What is the primary function of setting organizational direction?

Accepted Answer

To establish a clear purpose and destination that guides decision-making at all levels.. Setting organizational direction means defining a clear purpose, vision, and destination that aligns decision-making across all levels of the organization. It provides the strategic context that guides priorities, resource allocation, and day-to-day choices so that teams work toward common goals rather than in isolation.

Answer

To write individual lines of code for software applications.

Answer

To order office supplies and stationery.

Answer

To repair broken physical server hardware.

Question 11

An IT service provider is implementing continual improvement practices across multiple global business units. Resistance varies wildly across regions due to differing local labor laws and management styles. What OCM framework adjustment is essential?

Accepted Answer

Establish a flexible OCM framework that empowers regional change agents to tailor execution to local laws and cultural norms.. A flexible OCM framework that empowers regional change agents to adapt execution to local labor laws and cultural norms is essential when resistance varies by region. This balances global consistency of the continual improvement initiative with local relevance, which is the core principle of glocalized change management.

Answer

Abolish all regional business units and manage all operations from global headquarters.

Answer

Abandon the continual improvement initiative entirely in regions that show any initial resistance.

Answer

Enforce a single, rigid global change plan without exception to ensure standardization.

Question 12

An organization is defining its overall vision and mission to establish a long-term destination. How should this high-level direction be translated into actionable operational plans according to ITIL 4 DPI?

Accepted Answer

By cascading strategy directly into operational plans through sequential objectives and value stream mapping.. It describes the ITIL 4 DPI approach of cascading strategy into operational plans through sequential objectives and value stream mapping. This ensures that high-level vision and mission are translated into actionable, aligned activities at the operational level. Value stream mapping identifies the steps and interactions needed to deliver value, connecting strategic intent to daily work.

Answer

By allowing individual teams to independently determine their own vision without alignment.

Answer

By replacing operational plans entirely with the high-level mission statement.

Answer

By exclusively focusing on tactical budgets while ignoring long-term goals.

Question 13

Which ITIL continual improvement model step corresponds to executing the plan?

Accepted Answer

Step 5. The ITIL continual improvement model has seven steps, and Step 5 is 'Take action'—which corresponds to executing the plan. The steps are: 1) What is the vision? 2) Where are we now? 3) Where do we want to be? 4) How do we get there? 5) Take action. 6) Did we get there? 7) How do we keep the momentum going? Therefore, executing the plan is Step 5.

Answer

Step 7

Answer

Step 4

Answer

Step 3

Question 14

An IT governance committee is designing a risk management training program for software engineers. Which THREE practices align with ITIL 4 guiding principles? (Choose three.)

Accepted Answer

Focusing the training on how risk management enables secure, continuous software delivery ('Focus on value').. Option B is correct because ITIL 4's 'Focus on value' principle directs that every activity should trace back to value for the customer and organization; framing risk management training around enabling secure, continuous software delivery ties the practice directly to the value engineers produce rather than treating compliance as an end in itself. Option D is correct because 'Keep it simple and practical' favors the minimum number of steps needed to achieve the outcome, so short, scenario-based modules embedded in developer onboarding deliver usable risk knowledge without over-engineering the program. Option E is correct because 'Collaborate and promote visibility' calls for working across silos with real stakeholder input, and co-creating content with both security experts and software engineers ensures the training reflects actual engineering constraints and gains buy-in. Option A does not belong because rote memorization of a 500-page statute is neither simple nor value-focused and does not build practical risk judgment. Option C does not belong because restricting training to executives and excluding engineers contradicts collaboration, visibility, and the shared-responsibility intent of the guiding principles.

Answer

Forcing engineers to memorize a 500-page regulatory compliance statute word-for-word before writing any code.

Answer

Making the training mandatory only for executives while completely excluding engineers from security awareness.

Question 15

An IT service manager is prioritizing a backlog of 50 continual improvement opportunities. Which TWO of the following prioritization criteria are commonly used in ITIL continual improvement practices? (Choose two)

Accepted Answer

Estimated implementation effort, cost, and resource requirements.. Option C is correct because ITIL continual improvement prioritization weighs the estimated implementation effort, cost, and resource requirements to assess feasibility and effort-to-value trade-offs before committing resources. Option E is correct because expected business value and return on investment (ROI) are core criteria for ranking improvement opportunities by the benefit they deliver to the organization and its services. Together, effort/cost and value/ROI form the standard cost-benefit basis for sequencing a continual improvement backlog. Options A, B, and D are not valid prioritization criteria: server hardware color, a submitter's birthdate or astrological sign, and a vendor account manager's surname have no bearing on business value, risk, cost, or improvement impact.

Answer

The physical color of the server hardware hosting the application.

Answer

The personal birthdate and astrological sign of the ticket submitter.

Answer

The exact alphabetical surname of the vendor account manager.

Question 16

What is the primary role of the Continual Improvement Register (CIR)?

Accepted Answer

To document, prioritize, and track improvement opportunities through their lifecycle.. The Continual Improvement Register (CIR) is a tool used to document, prioritize, and track improvement opportunities throughout their lifecycle. It captures ideas from various sources, assesses their value and effort, and monitors their progress from initiation to completion. It is a key artifact of the continual improvement practice in ITIL 4.

Answer

To record major security breaches and regulatory compliance violations.

Answer

To log customer complaints and service desk support tickets.

Answer

To inventory all hardware assets and software licenses across the enterprise.

Question 17

An IT strategy execution team is reviewing potential causes for strategy failure during the operational planning phase. Which THREE common pitfalls should they guard against? (Choose three)

Accepted Answer

Failing to align operational metrics and daily tasks with strategic goals.. Option B is correct because a classic execution pitfall is a disconnect between high-level strategic goals and the operational metrics, KPIs, and daily tasks that employees actually perform, so the strategy never translates into measurable frontline action. Option D is correct because treating strategy as a one-time static event ignores the need for continuous monitoring, feedback loops, and adaptive adjustment as market and internal conditions change, which is a well-documented cause of strategy failure. Option E is correct because without visible, ongoing executive sponsorship and resource commitment, initiatives lose priority, funding, and accountability, and execution stalls. Options A and C are not pitfalls but rather recommended practices: cross-silo collaboration and iterative feedback from customers and employees both strengthen strategy execution, so they do not belong among the failure causes to guard against.

Answer

Actively collaborating across organizational silos.

Answer

Iteratively reviewing feedback from customers and employees.

Question 18

When applying 'Keep it simple and practical' to enterprise compliance and risk frameworks, which THREE practices should an organization adopt? (Choose three.)

Accepted Answer

Eliminating redundant approval steps that do not add measurable risk mitigation or business value.. Option A is correct because 'keep it simple and practical' means removing redundant approval steps that add no measurable risk mitigation or business value, thereby reducing bureaucracy while preserving effective controls. Option C is correct because focusing on the vital few controls that address the greatest threats reflects a risk-based, prioritized approach rather than trying to control everything equally, which is impractical and dilutes effort. Option D is correct because clear, straightforward policies that frontline staff can easily understand and execute make compliance practical and more likely to be followed consistently. Option B does not belong because requiring manual spreadsheet logging for every low-risk server ping is excessive, labor-intensive, and disproportionate to the minimal risk involved. Option E does not belong because drafting 1,000-page governance manuals for every minor IT service desk procedure is overly complex and contradicts the principle of simplicity and practicality.

Answer

Requiring manual spreadsheet logging for every single low-risk server ping.

Answer

Drafting 1,000-page governance manuals for every minor IT service desk procedure.

Question 19

According to ITIL 4 DPI, which TWO of the following statements correctly describe the scope and purpose of the DPI module? (Choose two.)

Accepted Answer

It integrates direction, planning, and improvement into a universal approach applicable across the entire SVS.. Option A is correct because ITIL 4's Direct, Plan and Improve (DPI) module is designed as a universal, cross-cutting approach that integrates direction, planning, and continual improvement across all components of the Service Value System (SVS), not just one part of it. Option C is correct because DPI provides practitioners with practical methods, tools, and techniques to align strategic intent with day-to-day operational execution, which is central to its purpose. Option B is incorrect because DPI is not limited to software application development methodologies; it applies broadly to governance, planning, and improvement across all value streams. Option D is incorrect because DPI is not a specialized practice reserved for IT security officers; it is intended for a wide range of roles and disciplines. Option E is incorrect because DPI does not replace the Service Value Chain; the Service Value Chain remains a core element of ITIL 4, and DPI supports and enhances how it is directed, planned, and improved.

Answer

It focuses exclusively on software application development methodologies.

Answer

It is a specialized practice used only by IT security officers.

Answer

It replaces the need for the Service Value Chain in ITIL 4.

Question 20

A digital transformation program uses value-based measurement to report progress to the steering committee. One key initiative involves migrating legacy workloads to Amazon Web Services (AWS). Rather than reporting on server uptime, the strategist proposes reporting on 'cost per active digital customer.' Why is this metric superior in the context of ITIL 4 DPI?

Accepted Answer

It directly links cloud consumption costs to business outcomes and customer adoption.. Value-based measurement focuses on outcomes and value co-creation for the consumer rather than internal technical activities.

Answer

It measures internal infrastructure efficiency and hypervisor performance directly.

Answer

It simplifies the data collection process by removing the need for ServiceNow data integration.

Answer

It automates cloud cost optimization alerts through AWS Trusted Advisor.