DPI Guiding Principles And GRC Practice Test 1 — 15 Questions

Question 1

A compliance team is designing a new data privacy training module. Before creating new content, they review existing HR onboarding slides. Which guiding principle does this action represent?

Accepted Answer

Start where you are. The principle 'Start where you are' in ITIL 4 (and similar frameworks) emphasizes leveraging existing resources, processes, and knowledge rather than building from scratch. By reviewing existing HR onboarding slides before creating new content, the compliance team is applying this principle—they are using what already exists as a foundation. This approach saves time, reduces duplication, and ensures alignment with current organizational practices.

Answer

Focus on value

Answer

Optimize and automate

Answer

Think and work holistically

Question 2

An organization's internal audit department identifies that cloud resource provisioning lacks appropriate approval gates. The cloud team wants to use AWS Control Tower and Service Catalog to enforce governance without slowing down developers. Which guiding principle is best demonstrated by building guardrails into automated provisioning templates?

Accepted Answer

Optimize and automate. The guiding principle 'Optimize and automate' is best demonstrated because it emphasizes using automation to enforce governance and reduce manual effort. By embedding approval gates and guardrails into AWS Control Tower and Service Catalog templates, the organization automates the provisioning process while ensuring compliance, thus optimizing both speed and control. This aligns with the principle's focus on leveraging automation to improve efficiency and consistency.

Answer

Start where you are

Answer

Collaborate and promote visibility

Answer

Focus on value

Question 3

An organization is integrating ESG (Environmental, Social, and Governance) criteria into its IT sourcing strategy. Leadership wants to ensure that supplier selection doesn't just check boxes, but genuinely contributes to sustainability outcomes. Which combination of guiding principles should drive this GRC initiative?

Accepted Answer

Focus on value AND Think and work holistically. Integrating ESG into IT sourcing requires focusing on value (defining what sustainability outcomes actually matter to the business and society, not just checkbox compliance) and thinking and working holistically (recognizing that ESG touches procurement, legal, IT operations, suppliers, and reporting in an interconnected system). Together these principles prevent ESG from becoming a superficial audit exercise and instead embed it into decision-making.

Answer

Start where you are AND Progress iteratively with feedback

Answer

Keep it simple and practical AND Optimize and automate

Answer

Collaborate and promote visibility AND Keep it simple and practical

Question 4

An IT manager is holding a workshop to map out why security compliance approvals are taking three weeks. The manager invites representatives from legal, security, development, and operations. Which guiding principle is primarily being applied?

Accepted Answer

Collaborate and promote visibility. The scenario describes bringing together stakeholders from legal, security, development, and operations to understand a cross-functional workflow problem (slow compliance approvals). This is the definition of the 'Collaborate and promote visibility' guiding principle from ITIL 4, which emphasizes breaking down silos, sharing information, and involving the right people to improve value streams. The workshop format itself is a collaboration mechanism designed to surface bottlenecks that no single team can see alone.

Answer

Optimize and automate

Answer

Keep it simple and practical

Answer

Focus on value

Question 5

A company is implementing ISO/IEC 27001 information security controls. Instead of trying to certify all 114 controls across 50 business units simultaneously, the CISO selects 10 critical controls for the core payment platform first. Which guiding principles are primarily being utilized?

Accepted Answer

Progress iteratively with feedback AND Focus on value. Selecting 10 critical controls for the core payment platform first, rather than attempting all 114 controls across 50 business units at once, demonstrates 'Progress iteratively with feedback' (delivering improvements in small, manageable increments) and 'Focus on value' (prioritizing the controls that most directly protect the highest-value business asset). This phased, value-driven approach is a textbook application of these two ITIL 4 guiding principles.

Answer

Start where you are AND Collaborate and promote visibility

Answer

Optimize and automate AND Keep it simple and practical

Answer

Think and work holistically AND Start where you are

Question 6

A company is updating its disaster recovery (DR) plan. The compliance team mandates a 4-hour Recovery Time Objective (RTO) for all systems, including non-critical marketing blogs. The IT architect objects, pointing out the prohibitive cost. Which ITIL 4 principle should guide the resolution of this conflict?

Accepted Answer

Focus on value. The ITIL 4 guiding principle 'Focus on value' directs organizations to align all decisions and activities with what truly delivers value to the business, customers, and other stakeholders. In this scenario, applying a strict 4-hour RTO to non-critical marketing blogs would incur prohibitive costs without proportional business benefit, meaning the DR plan would not be value-focused. This principle encourages a nuanced, risk-based approach that differentiates critical systems from non-critical ones, ensuring that investments in resilience are justified by the value they protect. Thus, 'Focus on value' provides the rationale for challenging the blanket RTO mandate and advocating for a tiered DR strategy.

Answer

Start where you are

Answer

Keep it simple and practical

Answer

Optimize and automate

Question 7

An organization is beginning a compliance maturity assessment. The lead auditor insists on interviewing frontline service desk agents to understand how security policies are applied daily. Which guiding principle does this practice reflect?

Accepted Answer

Start where you are. Interviewing frontline service desk agents to understand how security policies are applied daily reflects the 'Start where you are' guiding principle. This principle advocates assessing the current state — including existing practices, knowledge, and workarounds — before designing improvements. Frontline agents possess valuable insights into actual policy application.

Answer

Think and work holistically

Answer

Focus on value

Answer

Optimize and automate

Question 8

A federal agency must comply with FedRAMP high security standards while adopting cloud-native microservices. The traditional security review process takes 12 months. To apply ITIL 4 principles, the architecture board introduces Policy-as-Code using OPA (Open Policy Agent) integrated into GitLab CI pipelines. Which combination of guiding principles is best demonstrated here?

Accepted Answer

Optimize and automate AND Keep it simple and practical. Policy-as-Code with OPA in CI pipelines automates security and compliance enforcement (Optimize and automate) while replacing a 12-month manual review with lightweight, codified policies that are practical and proportionate (Keep it simple and practical). Together these two guiding principles best describe the shift from slow manual gates to automated, codified governance. The other principle pairs do not capture the automation-plus-simplicity combination as precisely.

Answer

Progress iteratively with feedback AND Start where you are

Answer

Collaborate and promote visibility AND Focus on value

Answer

Start where you are AND Think and work holistically

Question 9

An internal auditor discovers that IT staff are storing passwords in an unencrypted Excel sheet. Instead of issuing a harsh reprimand, the security manager runs a workshop to explain password manager tools. Which principle is best exhibited by educating rather than just punishing?

Accepted Answer

Collaborate and promote visibility. Educating and working together rather than operating in a punitive vacuum reflects 'Collaborate and promote visibility' and 'Keep it simple and practical'.

Answer

Start where you are

Answer

Optimize and automate

Answer

Focus on value

Question 10

An IT team is designing a new compliance dashboard in ServiceNow. Before building custom widgets, they review the platform's out-of-the-box reporting templates. Which guiding principle does this represent?

Accepted Answer

Start where you are. Reviewing out-of-the-box features before building custom solutions represents 'Start where you are' and 'Keep it simple and practical'.

Answer

Focus on value

Answer

Think and work holistically

Answer

Optimize and automate

Question 11

Which TWO of the following actions best demonstrate the ITIL 4 guiding principle 'Start where you are'? (Choose two.)

Accepted Answer

Conducting a baseline audit of existing legacy software before planning migration activities.. Option B is correct because 'Start where you are' means assessing what already exists before making changes, and a baseline audit of legacy software directly captures the current state to inform migration planning. Option E is correct because reviewing ServiceNow's out-of-the-box compliance templates before building custom forms leverages existing capabilities rather than reinventing them, which is the essence of this guiding principle. Option A does not belong because mapping a complete end-to-end customer journey is more aligned with 'Focus on value' or 'Collaborate and promote visibility' than with assessing existing assets. Option C does not belong because establishing new cross-functional standups is about 'Collaborate and promote visibility' and creating new ways of working, not starting from the current state. Option D does not belong because automating deployment pipelines with GitHub Actions is an improvement/automation initiative better tied to 'Progress iteratively with feedback' or 'Optimize and automate', not to starting where you are.

Answer

Mapping out the complete end-to-end customer journey across multiple departments.

Answer

Establishing weekly cross-functional standup meetings between security and development teams.

Answer

Automating software deployment pipelines using GitHub Actions.

Question 12

An enterprise is implementing a comprehensive GRC transformation program. Which THREE of the following statements correctly apply ITIL 4 guiding principles to risk and compliance challenges? (Choose three.)

Accepted Answer

'Focus on value' means that security and compliance controls should be ignored if they cost any money.. Options A, B, and E reflect correct applications of holistic thinking, iterative progress, and value focus in GRC.

Question 13

A large healthcare organization is integrating ITIL 4 guiding principles into its HIPAA compliance and risk management practices. Which THREE of the following approaches demonstrate advanced application of the principles? (Choose three.)

Accepted Answer

Applying 'Progress iteratively with feedback' by piloting new electronic health record access controls in a single clinic before system-wide rollout.. Options A, B, and E correctly apply value focus, iteration, and holistic risk integration in healthcare GRC.

Answer

Applying 'Optimize and automate' by disabling all audit logging to speed up clinician login times.

Answer

Applying 'Start where you are' by assuming all legacy medical devices are secure without conducting asset discovery.

Question 14

An IT director wants to use the 'Progress iteratively with feedback' principle when implementing a new ISO 37001 Anti-Bribery management system. What is the most appropriate first action?

Accepted Answer

Implement the policy in a single department first, gather feedback, and refine before expanding.. 'progress iteratively with feedback' means starting small, learning from real-world implementation, and refining before scaling. Implementing in a single department first creates a controlled pilot where feedback can be gathered, issues identified, and the policy adjusted before broader rollout — reducing risk and increasing adoption across the organization.

Answer

Roll out the anti-bribery policy to all global offices simultaneously on day one.

Answer

Wait for external auditors to mandate specific policy sections before making any changes.

Answer

Draft a 500-page governance handbook before engaging any stakeholders.

Question 15

A multinational enterprise is updating its GRC framework in ServiceNow GRC to incorporate ITIL 4 guiding principles. The risk manager notices that compliance policies often delay agile software deployments. Which approach best applies the 'Keep it simple and practical' principle to this bottleneck?

Accepted Answer

Design lightweight, automated compliance checks embedded directly within the CI/CD pipeline.. It applies 'Keep it simple and practical' by replacing heavyweight, manual compliance gates with lightweight, automated checks embedded directly in the CI/CD pipeline. This reduces friction and delay while still enforcing compliance, making the process practical and proportionate to the risk. Automation ensures consistency and speed, allowing agile deployments to proceed without being blocked by bureaucratic reviews.

Answer

Delegate all risk management decisions entirely to the software development leads.

Answer

Conduct a 3-month comprehensive audit of all historical agile deployments before releasing new code.

Answer

Remove all compliance gates for agile teams to maximize deployment speed.