DPI Guiding Principles And GRC Practice Test 2 — 15 Questions

Question 1

A global bank is deploying a new AI-driven credit scoring system. The model's decision-making logic is a black box, creating potential regulatory compliance issues under fair lending laws. How should the enterprise apply ITIL guiding principles to address this GRC challenge?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Integrate Explainable AI (XAI) techniques, legal compliance reviews, and cross-functional validation into the model deployment lifecycle.. Explainable AI requires visibility, stakeholder collaboration, and holistic evaluation of regulatory impact. 'Collaborate and promote visibility' combined with risk governance is critical.

Answer

Deploy the black-box model immediately and address regulatory complaints only if auditors notice.

Answer

Outsource the credit scoring process entirely to an unregulated fintech startup.

Answer

Abandon all machine learning initiatives and return exclusively to manual paper-based scoring.

Question 2

An organization is integrating ESG (Environmental, Social, and Governance) criteria into its IT sourcing strategy. Leadership wants to ensure that supplier selection doesn't just check boxes, but genuinely contributes to sustainability outcomes. Which combination of guiding principles should drive this GRC initiative?

Accepted Answer

Focus on value AND Think and work holistically. Focus on value ensures the ESG criteria align with true stakeholder outcomes, while Think and work holistically ensures supply chain and environmental impacts are considered end-to-end.

Answer

Start where you are AND Progress iteratively with feedback

Answer

Keep it simple and practical AND Optimize and automate

Answer

Collaborate and promote visibility AND Keep it simple and practical

Question 3

An IT manager is holding a workshop to map out why security compliance approvals are taking three weeks. The manager invites representatives from legal, security, development, and operations. Which guiding principle is primarily being applied?

Accepted Answer

Collaborate and promote visibility. Inviting multiple stakeholder groups to a workshop to map a process directly applies 'Collaborate and promote visibility'.

Answer

Optimize and automate

Answer

Keep it simple and practical

Answer

Focus on value

Question 4

A company is implementing ISO/IEC 27001 information security controls. Instead of trying to certify all 114 controls across 50 business units simultaneously, the CISO selects 10 critical controls for the core payment platform first. Which guiding principles are primarily being utilized?

Accepted Answer

Progress iteratively with feedback AND Focus on value. Selecting a subset of controls for a core platform is 'Progress iteratively with feedback' combined with 'Focus on value' (starting with payment platform value).

Answer

Start where you are AND Collaborate and promote visibility

Answer

Optimize and automate AND Keep it simple and practical

Answer

Think and work holistically AND Start where you are

Question 5

When conducting a risk assessment for a new cloud migration project, the project manager lists all potential failure points without prioritizing them, leading to decision fatigue. Which guiding principle should be applied to prioritize the risks?

Accepted Answer

Focus on value. Prioritizing what matters most aligns with 'Focus on value' and 'Keep it simple and practical'.

Answer

Optimize and automate

Answer

Start where you are

Answer

Collaborate and promote visibility

Question 6

An enterprise GRC committee discovers that shadow IT (unapproved SaaS tools) is rampant because the official procurement and compliance review process takes 90 days. To fix this, the committee establishes a 'fast-track' pre-vetted catalog of SaaS tools. How does this solution align with ITIL 4 principles?

Accepted Answer

It applies 'Keep it simple and practical' by removing bureaucratic friction while maintaining compliance guardrails through pre-vetting.. The 90-day review was impractical. Creating a pre-vetted catalog applies 'Keep it simple and practical' and addresses user needs ('Focus on value') while maintaining governance.

Answer

It applies 'Optimize and automate' by deploying spyware on employee laptops to detect unapproved software.

Answer

It applies 'Start where you are' by punishing employees who used shadow IT in the past.

Answer

It eliminates all governance to allow employees to buy whatever software they want.

Question 7

An internal audit reveals that privileged access management (PAM) policies are frequently bypassed by systems administrators during critical outages. The security team wants to enforce rigid automated lockdowns. How should the 'Collaborate and promote visibility' and 'Think and work holistically' principles be combined to address this?

Accepted Answer

Engage system administrators and auditors together to design transparent, auditable 'break-glass' emergency access workflows.. Rigid lockdowns cause bypasses. Holistic thinking and collaboration require understanding *why* admins bypass controls during outages and co-creating break-glass procedures that maintain visibility without causing outages.

Answer

Outsource all outage troubleshooting to external vendors who are subject to PAM controls.

Answer

Suspend all PAM controls permanently so administrators can never be blocked during an outage.

Answer

Implement immediate automated termination for any admin who bypasses PAM, regardless of outage severity.

Question 8

A company is updating its disaster recovery (DR) plan. The compliance team mandates a 4-hour Recovery Time Objective (RTO) for all systems, including non-critical marketing blogs. The IT architect objects, pointing out the prohibitive cost. Which ITIL 4 principle should guide the resolution of this conflict?

Accepted Answer

Focus on value. Applying tiered DR based on business criticality embodies 'Focus on value' and 'Think and work holistically'.

Answer

Start where you are

Answer

Keep it simple and practical

Answer

Optimize and automate

Question 9

An organization is beginning a compliance maturity assessment. The lead auditor insists on interviewing frontline service desk agents to understand how security policies are applied daily. Which guiding principle does this practice reflect?

Accepted Answer

Start where you are. Interviewing frontline staff to understand actual daily practice reflects 'Start where you are'.

Answer

Think and work holistically

Answer

Focus on value

Answer

Optimize and automate

Question 10

A multinational corporation is consolidating its regional GRC tools into a single global instance of ServiceNow GRC. The project team attempts to migrate all 5,000 legacy control procedures simultaneously on a single weekend, resulting in massive data corruption and audit failures. Which guiding principle was violated?

Accepted Answer

Progress iteratively with feedback. Attempting a massive simultaneous migration of 5,000 controls without staging violates 'Progress iteratively with feedback'.

Answer

Focus on value

Answer

Keep it simple and practical

Answer

Collaborate and promote visibility

Question 11

A federal agency must comply with FedRAMP high security standards while adopting cloud-native microservices. The traditional security review process takes 12 months. To apply ITIL 4 principles, the architecture board introduces Policy-as-Code using OPA (Open Policy Agent) integrated into GitLab CI pipelines. Which combination of guiding principles is best demonstrated here?

Accepted Answer

Optimize and automate AND Keep it simple and practical. Writing compliance rules as code and automating them in the pipeline embodies 'Optimize and automate' while keeping the review practical and fast ('Keep it simple and practical').

Answer

Progress iteratively with feedback AND Start where you are

Answer

Collaborate and promote visibility AND Focus on value

Answer

Start where you are AND Think and work holistically

Question 12

A company's risk management department operates independently of the enterprise architecture team. As a result, new software purchased by architecture frequently fails security risk reviews. Which guiding principle should be used to rectify this disconnect?

Accepted Answer

Collaborate and promote visibility. Disconnected departments need to work together and see each other's pipelines. 'Collaborate and promote visibility' addresses this organizational silo.

Answer

Focus on value

Answer

Optimize and automate

Answer

Keep it simple and practical

Question 13

An IT service manager is reviewing the incident management process to ensure GDPR compliance during data breach reporting. The manager cuts out three redundant management approval steps that added no legal value. Which guiding principle is being applied?

Accepted Answer

Keep it simple and practical. Removing redundant steps that add no value embodies 'Keep it simple and practical' and 'Focus on value'.

Answer

Optimize and automate

Answer

Start where you are

Answer

Think and work holistically

Question 14

An enterprise is deploying a Zero Trust Architecture (ZTA). Rather than restricting access based solely on corporate network perimeter, ZTA verifies every user and device continuously. How does this architectural shift embody 'Think and work holistically' in the context of GRC?

Accepted Answer

It integrates identity, device telemetry, network context, and data classification into an end-to-end continuous risk evaluation model.. Zero Trust looks at identity, device posture, location, and data sensitivity across the entire ecosystem rather than trusting a single perimeter, reflecting holistic thinking and comprehensive risk management.

Answer

It delegates all security perimeter decisions entirely to end users.

Answer

It assumes internal network traffic is inherently trustworthy and secure.

Answer

It focuses exclusively on physical data center security.

Question 15

An IT team wants to improve their risk management maturity but does not know where their current vulnerabilities lie. What should be their very first step according to ITIL 4 guiding principles?

Accepted Answer

Assess current risk practices and vulnerabilities using direct observation and existing documentation.. Not knowing where vulnerabilities lie means assessing the current state using 'Start where you are'.

Answer

Implement an expensive AI-powered risk scoring platform.

Answer

Outsource all risk management to an external Big Four auditing firm.

Answer

Rewrite all corporate risk policies from scratch.