DPI Guiding Principles And GRC Practice Test 2 — 15 Questions

Question 1

An IT team is attempting to map out all enterprise risks at once, causing paralysis by analysis. Which ITIL 4 guiding principle should be used to get the risk assessment project moving again?

Accepted Answer

Keep it simple and practical. When a team is paralyzed by trying to map every enterprise risk at once, the 'keep it simple and practical' principle directs them to start with a manageable scope and iterate. Option A applies this principle by breaking the overwhelming task into practical, incremental steps.

Answer

Collaborate and promote visibility

Answer

Optimize and automate

Answer

Think and work holistically

Question 2

A financial institution uses Archer GRC for regulatory compliance tracking. The compliance team operates in a strict silo from the software development teams using Jira. Which guiding principle is most directly being violated by this organizational structure?

Accepted Answer

Collaborate and promote visibility. The scenario describes a compliance team and development teams working in isolated silos with no interaction, which directly contradicts the 'Collaborate and promote visibility' principle. This guiding principle emphasizes breaking down silos, sharing information, and working together across teams to achieve better outcomes. Archer GRC and Jira integration requires cross-team collaboration to be effective.

Answer

Start where you are

Answer

Focus on value

Answer

Keep it simple and practical

Question 3

During a high-severity incident review in Jira Service Management, the incident commander realizes that strict adherence to an outdated change management compliance policy prevented a rapid hotfix. How should the 'Think and work holistically' principle be applied to resolve this GRC conflict?

Accepted Answer

Redesign the end-to-end value stream by integrating risk evaluation criteria directly into automated emergency change models.. Redesigning the end-to-end value stream by integrating risk evaluation criteria directly into automated emergency change models applies holistic thinking by addressing the root cause: the outdated policy that conflicts with rapid incident response. This approach balances compliance and speed by embedding risk assessment into the change process, enabling fast hotfixes while maintaining governance. It resolves the GRC conflict by aligning the value stream with both operational needs and risk management.

Answer

Bypass the change advisory board (CAB) entirely for all future incidents without updating the formal risk policy.

Answer

Escalate the compliance officer's authority to veto any emergency changes to protect system stability.

Answer

Outsource incident response to a third party to avoid internal policy conflicts.

Question 4

A Chief Information Security Officer (CISO) is establishing a risk appetite statement. Business unit leaders are pushing back, claiming the security policies violate 'Focus on value' by slowing down revenue-generating features. How can the CISO reconcile value creation with risk protection using ITIL 4 concepts?

Accepted Answer

Align risk thresholds directly with the organization's specific value streams, treating risk management as an enabler of secure value co-creation.. ITIL 4's 'focus on value' principle does not mean ignoring risk; it means co-creating value with stakeholders, which requires managing risk within value streams. Option C aligns risk thresholds with specific value streams, positioning risk management as an enabler of secure value co-creation rather than a blocker.

Answer

Delegate risk appetite definitions entirely to software developers.

Answer

Transfer all risk to cyber insurance carriers and remove internal security controls.

Answer

Enforce strict compliance controls uniformly regardless of business impact to guarantee zero security breaches.

Question 5

An organization is evaluating its vendor risk management process using the 'Optimize and automate' guiding principle. Manual spreadsheet tracking of third-party compliance certificates has led to missed renewals. Which tool configuration best applies this principle?

Accepted Answer

Implement an automated vendor risk portal with automated alerting for certificate expirations and integrated scoring.. The 'Optimize and automate' guiding principle in DPI (Digital and Process Innovation) emphasizes using technology to streamline and automate repetitive, error-prone tasks. An automated vendor risk portal with alerting and integrated scoring directly applies this by replacing manual spreadsheet tracking with automated certificate expiration alerts and continuous risk scoring, reducing missed renewals and human error. This aligns with the principle's goal of improving efficiency, accuracy, and scalability in vendor risk management.

Answer

Switch from Excel spreadsheets to a shared Microsoft Word document.

Answer

Hire two additional compliance analysts to manually check spreadsheets daily.

Answer

Eliminate vendor risk reviews to speed up procurement.

Question 6

An organization is launching a new DevOps pipeline and wants to ensure that all team members feel psychological safety and ownership while complying with corporate audit standards. Which guiding principle should the release manager emphasize first to balance innovation with structure?

Accepted Answer

Collaborate and promote visibility. 'Collaborate and promote visibility' directly supports psychological safety and ownership by encouraging open communication, shared decision-making, and transparency across teams. In a DevOps context, this principle ensures that audit requirements are visible to everyone and that teams collaborate with compliance rather than treating it as a separate gate. This balance allows innovation to proceed with structure because audit standards become part of the shared workflow instead of an external blocker.

Answer

Think and work holistically

Answer

Optimize and automate

Answer

Focus on value

Question 7

When auditing a legacy application, an IT governance team discovers that no documentation exists. Instead of demanding a massive documentation project, the team applies 'Start where you are'. What should they do?

Accepted Answer

Inspect the running application code and configuration directly to establish an accurate baseline of its current state.. 'Start where you are' directs the team to assess the actual current state rather than launching a documentation or rewrite project. Inspecting the running application code and configuration directly establishes an accurate baseline of what exists today, which is the essence of the principle.

Answer

Scrap the application immediately and rewrite it from scratch.

Answer

Assume the application is fully compliant based on its age and sign off on the audit.

Answer

Hire an external consultant to write a 200-page historical report.

Question 8

A healthcare provider is configuring access controls in Epic EHR to comply with HIPAA regulations. Clinicians complain that multi-factor authentication (MFA) prompts every 15 minutes disrupt patient care. How should the governance board apply ITIL 4 principles to balance security compliance with clinical value?

Accepted Answer

Apply 'Keep it simple and practical' and 'Focus on value' to adjust session timeout rules and implement context-aware authentication (e.g., badge-tap proximity access).. It applies two ITIL 4 principles simultaneously: 'keep it simple and practical' (don't over-engineer security controls in ways that create workarounds and clinical risk) and 'focus on value' (the value here is safe, timely patient care, not maximal authentication friction). Context-aware authentication like badge-tap proximity access maintains security while removing the repetitive MFA burden that disrupts care.

Answer

Remove MFA entirely for all clinical staff to maximize speed of care.

Answer

Transfer patient care tasks to administrative staff to handle logins.

Answer

Increase MFA frequency to every 5 minutes to ensure maximum compliance rigor.

Question 9

An enterprise risk management (ERM) framework requires annual risk assessments across 500 IT services. The process takes 6 months, rendering the output obsolete by completion. Which ITIL 4 principle-driven strategy resolves this GRC flaw?

Accepted Answer

Replace annual monolithic risk reviews with continuous, automated risk monitoring integrated into CI/CD pipelines.. It applies the ITIL 4 principles of 'progress iteratively with feedback' and 'optimize and automate' — replacing a 6-month annual monolithic review with continuous, automated risk monitoring integrated into CI/CD pipelines keeps risk data current and actionable. This directly resolves the GRC flaw of obsolete output by making risk assessment a real-time, embedded practice rather than a periodic snapshot.

Answer

Conduct risk assessments only when a severe regulatory fine is issued.

Answer

Hire 10 more risk analysts to complete the annual spreadsheets in 3 weeks.

Answer

Abolish the ERM framework and rely entirely on intuition during major incidents.

Question 10

A global bank is deploying a new AI-driven credit scoring system. The model's decision-making logic is a black box, creating potential regulatory compliance issues under fair lending laws. How should the enterprise apply ITIL guiding principles to address this GRC challenge?

Accepted Answer

Integrate Explainable AI (XAI) techniques, legal compliance reviews, and cross-functional validation into the model deployment lifecycle.. Integrating Explainable AI (XAI) techniques, legal compliance reviews, and cross-functional validation into the model deployment lifecycle directly addresses the black-box problem by making decision logic transparent and auditable. This applies ITIL guiding principles like 'Collaborate and promote visibility' and 'Think and work holistically' to a GRC challenge involving fair lending regulations.

Answer

Deploy the black-box model immediately and address regulatory complaints only if auditors notice.

Answer

Outsource the credit scoring process entirely to an unregulated fintech startup.

Answer

Abandon all machine learning initiatives and return exclusively to manual paper-based scoring.

Question 11

When conducting a risk assessment for a new cloud migration project, the project manager lists all potential failure points without prioritizing them, leading to decision fatigue. Which guiding principle should be applied to prioritize the risks?

Accepted Answer

Focus on value. When a risk list is unprioritized and causing decision fatigue, the guiding principle to apply is 'focus on value.' This principle directs the team to prioritize work — including risk mitigation — based on what delivers the most value and what most threatens that value. By assessing risks in terms of their potential impact on value delivery, the project manager can rank them and focus attention where it matters most.

Answer

Optimize and automate

Answer

Start where you are

Answer

Collaborate and promote visibility

Question 12

An enterprise GRC committee discovers that shadow IT (unapproved SaaS tools) is rampant because the official procurement and compliance review process takes 90 days. To fix this, the committee establishes a 'fast-track' pre-vetted catalog of SaaS tools. How does this solution align with ITIL 4 principles?

Accepted Answer

It applies 'Keep it simple and practical' by removing bureaucratic friction while maintaining compliance guardrails through pre-vetting.. The fast-track pre-vetted catalog directly applies 'keep it simple and practical' — it removes the bureaucratic friction of a 90-day review while preserving compliance guardrails through pre-vetting. Employees get approved tools quickly, and the organization retains control over security, data privacy, and vendor risk. This is a textbook example of simplifying a process without abandoning governance.

Answer

It applies 'Optimize and automate' by deploying spyware on employee laptops to detect unapproved software.

Answer

It applies 'Start where you are' by punishing employees who used shadow IT in the past.

Answer

It eliminates all governance to allow employees to buy whatever software they want.

Question 13

An internal audit reveals that privileged access management (PAM) policies are frequently bypassed by systems administrators during critical outages. The security team wants to enforce rigid automated lockdowns. How should the 'Collaborate and promote visibility' and 'Think and work holistically' principles be combined to address this?

Accepted Answer

Engage system administrators and auditors together to design transparent, auditable 'break-glass' emergency access workflows.. Engaging system administrators and auditors together to design transparent, auditable 'break-glass' emergency access workflows combines 'Collaborate and promote visibility' (bringing stakeholders together for shared understanding) with 'Think and work holistically' (addressing the entire access lifecycle, including emergencies). This produces a solution that respects operational urgency while maintaining auditability and control.

Answer

Outsource all outage troubleshooting to external vendors who are subject to PAM controls.

Answer

Suspend all PAM controls permanently so administrators can never be blocked during an outage.

Answer

Implement immediate automated termination for any admin who bypasses PAM, regardless of outage severity.

Question 14

A multinational corporation is consolidating its regional GRC tools into a single global instance of ServiceNow GRC. The project team attempts to migrate all 5,000 legacy control procedures simultaneously on a single weekend, resulting in massive data corruption and audit failures. Which guiding principle was violated?

Accepted Answer

Progress iteratively with feedback. The scenario describes attempting a massive, all-at-once migration of 5,000 control procedures in a single weekend, which directly violates the 'Progress iteratively with feedback' principle. This ITIL 4 guiding principle advocates breaking work into smaller, manageable iterations so that feedback can be gathered and course corrections made before scaling up. Migrating everything simultaneously eliminates any opportunity for validation, rollback, or learning between batches, which is exactly why corruption and audit failures occurred.

Answer

Focus on value

Answer

Keep it simple and practical

Answer

Collaborate and promote visibility

Question 15

A company's risk management department operates independently of the enterprise architecture team. As a result, new software purchased by architecture frequently fails security risk reviews. Which guiding principle should be used to rectify this disconnect?

Accepted Answer

Collaborate and promote visibility. The disconnect is a communication and silo problem: risk management and architecture are not sharing information, so purchases fail reviews. 'Collaborate and promote visibility' directly addresses breaking silos and ensuring cross-team information flow. Applying this principle means architecture and risk teams work together early, so security requirements are known before purchases are made.

Answer

Focus on value

Answer

Optimize and automate

Answer

Keep it simple and practical