DPI Guiding Principles And GRC — 25 Questions

Question 1

A compliance team is designing a new data privacy training module. Before creating new content, they review existing HR onboarding slides. Which guiding principle does this action represent?

Accepted Answer

Start where you are. The principle 'Start where you are' in ITIL 4 (and similar frameworks) emphasizes leveraging existing resources, processes, and knowledge rather than building from scratch. By reviewing existing HR onboarding slides before creating new content, the compliance team is applying this principle—they are using what already exists as a foundation. This approach saves time, reduces duplication, and ensures alignment with current organizational practices.

Answer

Focus on value

Answer

Optimize and automate

Answer

Think and work holistically

Question 2

An organization's internal audit department identifies that cloud resource provisioning lacks appropriate approval gates. The cloud team wants to use AWS Control Tower and Service Catalog to enforce governance without slowing down developers. Which guiding principle is best demonstrated by building guardrails into automated provisioning templates?

Accepted Answer

Optimize and automate. The guiding principle 'Optimize and automate' is best demonstrated because it emphasizes using automation to enforce governance and reduce manual effort. By embedding approval gates and guardrails into AWS Control Tower and Service Catalog templates, the organization automates the provisioning process while ensuring compliance, thus optimizing both speed and control. This aligns with the principle's focus on leveraging automation to improve efficiency and consistency.

Answer

Start where you are

Answer

Collaborate and promote visibility

Answer

Focus on value

Question 3

An organization is integrating ESG (Environmental, Social, and Governance) criteria into its IT sourcing strategy. Leadership wants to ensure that supplier selection doesn't just check boxes, but genuinely contributes to sustainability outcomes. Which combination of guiding principles should drive this GRC initiative?

Accepted Answer

Focus on value AND Think and work holistically. Integrating ESG into IT sourcing requires focusing on value (defining what sustainability outcomes actually matter to the business and society, not just checkbox compliance) and thinking and working holistically (recognizing that ESG touches procurement, legal, IT operations, suppliers, and reporting in an interconnected system). Together these principles prevent ESG from becoming a superficial audit exercise and instead embed it into decision-making.

Answer

Start where you are AND Progress iteratively with feedback

Answer

Keep it simple and practical AND Optimize and automate

Answer

Collaborate and promote visibility AND Keep it simple and practical

Question 4

An IT manager is holding a workshop to map out why security compliance approvals are taking three weeks. The manager invites representatives from legal, security, development, and operations. Which guiding principle is primarily being applied?

Accepted Answer

Collaborate and promote visibility. The scenario describes bringing together stakeholders from legal, security, development, and operations to understand a cross-functional workflow problem (slow compliance approvals). This is the definition of the 'Collaborate and promote visibility' guiding principle from ITIL 4, which emphasizes breaking down silos, sharing information, and involving the right people to improve value streams. The workshop format itself is a collaboration mechanism designed to surface bottlenecks that no single team can see alone.

Answer

Optimize and automate

Answer

Keep it simple and practical

Answer

Focus on value

Question 5

A company is implementing ISO/IEC 27001 information security controls. Instead of trying to certify all 114 controls across 50 business units simultaneously, the CISO selects 10 critical controls for the core payment platform first. Which guiding principles are primarily being utilized?

Accepted Answer

Progress iteratively with feedback AND Focus on value. Selecting 10 critical controls for the core payment platform first, rather than attempting all 114 controls across 50 business units at once, demonstrates 'Progress iteratively with feedback' (delivering improvements in small, manageable increments) and 'Focus on value' (prioritizing the controls that most directly protect the highest-value business asset). This phased, value-driven approach is a textbook application of these two ITIL 4 guiding principles.

Answer

Start where you are AND Collaborate and promote visibility

Answer

Optimize and automate AND Keep it simple and practical

Answer

Think and work holistically AND Start where you are

Question 6

A company is updating its disaster recovery (DR) plan. The compliance team mandates a 4-hour Recovery Time Objective (RTO) for all systems, including non-critical marketing blogs. The IT architect objects, pointing out the prohibitive cost. Which ITIL 4 principle should guide the resolution of this conflict?

Accepted Answer

Focus on value. The ITIL 4 guiding principle 'Focus on value' directs organizations to align all decisions and activities with what truly delivers value to the business, customers, and other stakeholders. In this scenario, applying a strict 4-hour RTO to non-critical marketing blogs would incur prohibitive costs without proportional business benefit, meaning the DR plan would not be value-focused. This principle encourages a nuanced, risk-based approach that differentiates critical systems from non-critical ones, ensuring that investments in resilience are justified by the value they protect. Thus, 'Focus on value' provides the rationale for challenging the blanket RTO mandate and advocating for a tiered DR strategy.

Answer

Start where you are

Answer

Keep it simple and practical

Answer

Optimize and automate

Question 7

An organization is beginning a compliance maturity assessment. The lead auditor insists on interviewing frontline service desk agents to understand how security policies are applied daily. Which guiding principle does this practice reflect?

Accepted Answer

Start where you are. Interviewing frontline service desk agents to understand how security policies are applied daily reflects the 'Start where you are' guiding principle. This principle advocates assessing the current state — including existing practices, knowledge, and workarounds — before designing improvements. Frontline agents possess valuable insights into actual policy application.

Answer

Think and work holistically

Answer

Focus on value

Answer

Optimize and automate

Question 8

A federal agency must comply with FedRAMP high security standards while adopting cloud-native microservices. The traditional security review process takes 12 months. To apply ITIL 4 principles, the architecture board introduces Policy-as-Code using OPA (Open Policy Agent) integrated into GitLab CI pipelines. Which combination of guiding principles is best demonstrated here?

Accepted Answer

Optimize and automate AND Keep it simple and practical. Policy-as-Code with OPA in CI pipelines automates security and compliance enforcement (Optimize and automate) while replacing a 12-month manual review with lightweight, codified policies that are practical and proportionate (Keep it simple and practical). Together these two guiding principles best describe the shift from slow manual gates to automated, codified governance. The other principle pairs do not capture the automation-plus-simplicity combination as precisely.

Answer

Progress iteratively with feedback AND Start where you are

Answer

Collaborate and promote visibility AND Focus on value

Answer

Start where you are AND Think and work holistically

Question 9

An internal auditor discovers that IT staff are storing passwords in an unencrypted Excel sheet. Instead of issuing a harsh reprimand, the security manager runs a workshop to explain password manager tools. Which principle is best exhibited by educating rather than just punishing?

Accepted Answer

Collaborate and promote visibility. Educating and working together rather than operating in a punitive vacuum reflects 'Collaborate and promote visibility' and 'Keep it simple and practical'.

Answer

Start where you are

Answer

Optimize and automate

Answer

Focus on value

Question 10

An IT team is designing a new compliance dashboard in ServiceNow. Before building custom widgets, they review the platform's out-of-the-box reporting templates. Which guiding principle does this represent?

Accepted Answer

Start where you are. Reviewing out-of-the-box features before building custom solutions represents 'Start where you are' and 'Keep it simple and practical'.

Answer

Focus on value

Answer

Think and work holistically

Answer

Optimize and automate

Question 11

Which TWO of the following actions best demonstrate the ITIL 4 guiding principle 'Start where you are'? (Choose two.)

Accepted Answer

Conducting a baseline audit of existing legacy software before planning migration activities.. Option B is correct because 'Start where you are' means assessing what already exists before making changes, and a baseline audit of legacy software directly captures the current state to inform migration planning. Option E is correct because reviewing ServiceNow's out-of-the-box compliance templates before building custom forms leverages existing capabilities rather than reinventing them, which is the essence of this guiding principle. Option A does not belong because mapping a complete end-to-end customer journey is more aligned with 'Focus on value' or 'Collaborate and promote visibility' than with assessing existing assets. Option C does not belong because establishing new cross-functional standups is about 'Collaborate and promote visibility' and creating new ways of working, not starting from the current state. Option D does not belong because automating deployment pipelines with GitHub Actions is an improvement/automation initiative better tied to 'Progress iteratively with feedback' or 'Optimize and automate', not to starting where you are.

Answer

Mapping out the complete end-to-end customer journey across multiple departments.

Answer

Establishing weekly cross-functional standup meetings between security and development teams.

Answer

Automating software deployment pipelines using GitHub Actions.

Question 12

An enterprise is implementing a comprehensive GRC transformation program. Which THREE of the following statements correctly apply ITIL 4 guiding principles to risk and compliance challenges? (Choose three.)

Accepted Answer

'Focus on value' means that security and compliance controls should be ignored if they cost any money.. Options A, B, and E reflect correct applications of holistic thinking, iterative progress, and value focus in GRC.

Question 13

A large healthcare organization is integrating ITIL 4 guiding principles into its HIPAA compliance and risk management practices. Which THREE of the following approaches demonstrate advanced application of the principles? (Choose three.)

Accepted Answer

Applying 'Progress iteratively with feedback' by piloting new electronic health record access controls in a single clinic before system-wide rollout.. Options A, B, and E correctly apply value focus, iteration, and holistic risk integration in healthcare GRC.

Answer

Applying 'Optimize and automate' by disabling all audit logging to speed up clinician login times.

Answer

Applying 'Start where you are' by assuming all legacy medical devices are secure without conducting asset discovery.

Question 14

An IT director wants to use the 'Progress iteratively with feedback' principle when implementing a new ISO 37001 Anti-Bribery management system. What is the most appropriate first action?

Accepted Answer

Implement the policy in a single department first, gather feedback, and refine before expanding.. 'progress iteratively with feedback' means starting small, learning from real-world implementation, and refining before scaling. Implementing in a single department first creates a controlled pilot where feedback can be gathered, issues identified, and the policy adjusted before broader rollout — reducing risk and increasing adoption across the organization.

Answer

Roll out the anti-bribery policy to all global offices simultaneously on day one.

Answer

Wait for external auditors to mandate specific policy sections before making any changes.

Answer

Draft a 500-page governance handbook before engaging any stakeholders.

Question 15

A multinational enterprise is updating its GRC framework in ServiceNow GRC to incorporate ITIL 4 guiding principles. The risk manager notices that compliance policies often delay agile software deployments. Which approach best applies the 'Keep it simple and practical' principle to this bottleneck?

Accepted Answer

Design lightweight, automated compliance checks embedded directly within the CI/CD pipeline.. It applies 'Keep it simple and practical' by replacing heavyweight, manual compliance gates with lightweight, automated checks embedded directly in the CI/CD pipeline. This reduces friction and delay while still enforcing compliance, making the process practical and proportionate to the risk. Automation ensures consistency and speed, allowing agile deployments to proceed without being blocked by bureaucratic reviews.

Answer

Delegate all risk management decisions entirely to the software development leads.

Answer

Conduct a 3-month comprehensive audit of all historical agile deployments before releasing new code.

Answer

Remove all compliance gates for agile teams to maximize deployment speed.

Question 16

An IT team is attempting to map out all enterprise risks at once, causing paralysis by analysis. Which ITIL 4 guiding principle should be used to get the risk assessment project moving again?

Accepted Answer

Keep it simple and practical. When a team is paralyzed by trying to map every enterprise risk at once, the 'keep it simple and practical' principle directs them to start with a manageable scope and iterate. Option A applies this principle by breaking the overwhelming task into practical, incremental steps.

Answer

Collaborate and promote visibility

Answer

Optimize and automate

Answer

Think and work holistically

Question 17

A financial institution uses Archer GRC for regulatory compliance tracking. The compliance team operates in a strict silo from the software development teams using Jira. Which guiding principle is most directly being violated by this organizational structure?

Accepted Answer

Collaborate and promote visibility. The scenario describes a compliance team and development teams working in isolated silos with no interaction, which directly contradicts the 'Collaborate and promote visibility' principle. This guiding principle emphasizes breaking down silos, sharing information, and working together across teams to achieve better outcomes. Archer GRC and Jira integration requires cross-team collaboration to be effective.

Answer

Start where you are

Answer

Focus on value

Answer

Keep it simple and practical

Question 18

During a high-severity incident review in Jira Service Management, the incident commander realizes that strict adherence to an outdated change management compliance policy prevented a rapid hotfix. How should the 'Think and work holistically' principle be applied to resolve this GRC conflict?

Accepted Answer

Redesign the end-to-end value stream by integrating risk evaluation criteria directly into automated emergency change models.. Redesigning the end-to-end value stream by integrating risk evaluation criteria directly into automated emergency change models applies holistic thinking by addressing the root cause: the outdated policy that conflicts with rapid incident response. This approach balances compliance and speed by embedding risk assessment into the change process, enabling fast hotfixes while maintaining governance. It resolves the GRC conflict by aligning the value stream with both operational needs and risk management.

Answer

Bypass the change advisory board (CAB) entirely for all future incidents without updating the formal risk policy.

Answer

Escalate the compliance officer's authority to veto any emergency changes to protect system stability.

Answer

Outsource incident response to a third party to avoid internal policy conflicts.

Question 19

A Chief Information Security Officer (CISO) is establishing a risk appetite statement. Business unit leaders are pushing back, claiming the security policies violate 'Focus on value' by slowing down revenue-generating features. How can the CISO reconcile value creation with risk protection using ITIL 4 concepts?

Accepted Answer

Align risk thresholds directly with the organization's specific value streams, treating risk management as an enabler of secure value co-creation.. ITIL 4's 'focus on value' principle does not mean ignoring risk; it means co-creating value with stakeholders, which requires managing risk within value streams. Option C aligns risk thresholds with specific value streams, positioning risk management as an enabler of secure value co-creation rather than a blocker.

Answer

Delegate risk appetite definitions entirely to software developers.

Answer

Transfer all risk to cyber insurance carriers and remove internal security controls.

Answer

Enforce strict compliance controls uniformly regardless of business impact to guarantee zero security breaches.

Question 20

An organization is evaluating its vendor risk management process using the 'Optimize and automate' guiding principle. Manual spreadsheet tracking of third-party compliance certificates has led to missed renewals. Which tool configuration best applies this principle?

Accepted Answer

Implement an automated vendor risk portal with automated alerting for certificate expirations and integrated scoring.. The 'Optimize and automate' guiding principle in DPI (Digital and Process Innovation) emphasizes using technology to streamline and automate repetitive, error-prone tasks. An automated vendor risk portal with alerting and integrated scoring directly applies this by replacing manual spreadsheet tracking with automated certificate expiration alerts and continuous risk scoring, reducing missed renewals and human error. This aligns with the principle's goal of improving efficiency, accuracy, and scalability in vendor risk management.

Answer

Switch from Excel spreadsheets to a shared Microsoft Word document.

Answer

Hire two additional compliance analysts to manually check spreadsheets daily.

Answer

Eliminate vendor risk reviews to speed up procurement.