DPI Guiding Principles And GRC Practice Test 3 — 15 Questions

Question 1

A software development organization is integrating static application security testing (SAST) into GitHub Actions. Developers complain that false positives block builds daily, leading them to disable the security checks. How should the security team apply ITIL 4 principles to correct this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Iteratively tune SAST rule sets in collaboration with developers to minimize false positives while maintaining vulnerability detection.. False positives causing bypasses mean the rules are impractical or poorly tuned. Tuning rules iteratively with developer feedback applies 'Progress iteratively with feedback' and 'Keep it simple and practical'.

Answer

Mandate immediate termination for developers who disable security checks.

Answer

Disable SAST checks permanently to keep builds fast.

Answer

Move SAST checks to a manual review that occurs once a year.

Question 2

An organization is establishing an enterprise GRC dashboard in PowerBI. The risk team wants to track 150 different Key Risk Indicators (KRIs). Executive leadership complains that the dashboard is overwhelming and useless for decision-making. Which guiding principle should be applied to redesign the dashboard?

Accepted Answer

Apply 'Focus on value' and 'Keep it simple and practical' to streamline the dashboard down to the critical few KRIs that directly impact strategic business objectives.. Too many metrics cause cognitive overload. Filtering down to the few vital metrics aligns with 'Focus on value' and 'Keep it simple and practical'.

Answer

Automate email alerts to send all 150 KRIs to executives every hour.

Answer

Add 50 more operational metrics to ensure absolute coverage of every IT asset.

Answer

Acknowledge the dashboard failure and abandon risk metric reporting entirely.

Question 3

An internal auditor discovers that IT staff are storing passwords in an unencrypted Excel sheet. Instead of issuing a harsh reprimand, the security manager runs a workshop to explain password manager tools. Which principle is best exhibited by educating rather than just punishing?

Accepted Answer

Collaborate and promote visibility. Educating and working together rather than operating in a punitive vacuum reflects 'Collaborate and promote visibility' and 'Keep it simple and practical'.

Answer

Start where you are

Answer

Optimize and automate

Answer

Focus on value

Question 4

A financial services firm is deploying robotic process automation (RPA) bots to handle customer loan applications. Compliance requires that every bot decision be fully auditable. The development team wants to deploy bots immediately without logging logic. Which governance conflict does this represent regarding ITIL principles?

Accepted Answer

A conflict between 'Optimize and automate' and governance requirements for transparency and auditability.. Deploying bots without logging ignores risk governance and transparency ('Collaborate and promote visibility').

Answer

A conflict between 'Think and work holistically' and HR hiring policies.

Answer

A conflict between 'Keep it simple and practical' and physical security.

Answer

A conflict between 'Focus on value' and 'Start where you are'.

Question 5

An enterprise risk management framework mandates that third-party cloud providers undergo annual SOC 2 Type II audits. A strategic AI startup vendor only possesses a SOC 2 Type I report. How should the enterprise apply ITIL 4 guiding principles to evaluate this risk without blocking innovation?

Accepted Answer

Apply risk-based evaluation ('Focus on value') and establish an iterative vendor development plan ('Progress iteratively with feedback') accepting Type I temporarily with a binding contract for Type II within 6 months.. A rigid binary rejection (Type I vs Type II) ignores value and adaptability. Applying 'Progress iteratively with feedback' and 'Focus on value' allows the enterprise to accept a Type I temporarily while requiring an accelerated path to Type II.

Answer

Rewrite the startup's security architecture yourself to achieve SOC 2 Type II compliance.

Answer

Waive all SOC 2 audit requirements permanently for AI vendors.

Answer

Instantly terminate negotiations with the AI startup to maintain strict compliance adherence.

Question 6

An IT team is designing a new compliance dashboard in ServiceNow. Before building custom widgets, they review the platform's out-of-the-box reporting templates. Which guiding principle does this represent?

Accepted Answer

Start where you are. Reviewing out-of-the-box features before building custom solutions represents 'Start where you are' and 'Keep it simple and practical'.

Answer

Focus on value

Answer

Think and work holistically

Answer

Optimize and automate

Question 7

A company's internal audit department issues 200 findings per year, but IT can only remediate 20 due to resource constraints. The audit findings pile up year over year, creating massive regulatory exposure. How should IT and audit apply 'Focus on value' and 'Keep it simple and practical' to resolve this?

Accepted Answer

Jointly prioritize findings based on actual business risk and critical value stream impact, tackling remediation in manageable batches.. Trying to fix 200 findings fails. Collaborating to prioritize the top risks that threaten critical business value resolves the backlog.

Answer

Ignore all future audit reports and operate without internal controls.

Answer

Hire 50 temporary auditors to write more findings.

Answer

Outsource audit remediation to an unvetted offshore contractor.

Question 8

Which TWO of the following actions best demonstrate the ITIL 4 guiding principle 'Start where you are'? (Choose two.)

Accepted Answer

Conducting a baseline audit of existing legacy software before planning migration activities.. 'Start where you are' involves investigating the current state directly and reusing existing working practices. Options A and D directly reflect this.

Answer

Mapping out the complete end-to-end customer journey across multiple departments.

Answer

Establishing weekly cross-functional standup meetings between security and development teams.

Answer

Automating software deployment pipelines using GitHub Actions.

Question 9

A global financial institution is restructuring its compliance framework to support agile software delivery. Which THREE of the following strategies align with ITIL 4 guiding principles and modern GRC practices? (Choose three.)

Accepted Answer

Integrating risk and compliance professionals directly into agile scrum teams as active participants.. Options A, C, and D embody practical, value-focused, and automated GRC strategies in agile environments.

Answer

Requiring a physical paper sign-off from the board of directors for every single code commit.

Answer

Eliminating all regulatory oversight and delegating compliance sign-offs entirely to junior developers.

Question 10

Which TWO of the following behaviors best exemplify 'Collaborate and promote visibility' within an IT governance context? (Choose two.)

Accepted Answer

Displaying real-time security incident and compliance status dashboards on screens visible to all IT and business teams.. Options B and D directly promote transparency and cross-functional collaboration.

Answer

Restricting access to risk registers to senior executive leadership only.

Answer

Mandating that all communication between departments must occur via formal, multi-week written ticket queues.

Answer

Writing compliance policies in secret within the legal department and releasing them without notice.

Question 11

An enterprise GRC committee is reviewing its risk management strategy. Which TWO practices effectively integrate ITIL 4 guiding principles into risk governance? (Choose two.)

Accepted Answer

Aligning risk appetites directly with the organization's key value streams and customer outcomes.. Options B and E represent integrating risk governance with practical, value-driven, and holistic ITIL principles.

Answer

Treating risk management as an isolated, bureaucratic legal function completely separate from IT operations.

Answer

Hiding audit findings from development teams to prevent panic and maintain morale.

Answer

Mandating a 12-month manual approval process for all minor software patches to ensure zero risk.

Question 12

When applying 'Keep it simple and practical' to enterprise compliance and risk frameworks, which THREE practices should an organization adopt? (Choose three.)

Accepted Answer

Eliminating redundant approval steps that do not add measurable risk mitigation or business value.. Options A, B, and E represent streamlining, removing waste, and focusing on essential practices.

Answer

Requiring manual spreadsheet logging for every single low-risk server ping.

Answer

Drafting 1,000-page governance manuals for every minor IT service desk procedure.

Question 13

Which TWO of the following indicators suggest an organization is failing to apply 'Think and work holistically'? (Choose two.)

Accepted Answer

The security team creates impenetrable firewalls without consulting the usability needs of customer-facing application teams.. Options A and C indicate siloed thinking and lack of holistic visibility across the organization.

Answer

Incident management post-mortems involve all stakeholder groups to determine root causes.

Answer

Cloud migration strategies take into account cost, security, operational readiness, and business value simultaneously.

Answer

The organization maintains regular communication channels between legal, HR, and IT departments.

Question 14

An IT governance board is evaluating how to apply 'Optimize and automate' to its vendor risk assessment process. Which THREE of the following initiatives represent correct applications of this principle? (Choose three.)

Accepted Answer

Configuring automated email reminders and escalation workflows for overdue vendor security certificates.. Options A, C, and E represent automation and optimization of vendor risk workflows.

Answer

Firing all risk analysts and letting vendors grade their own security compliance without verification.

Answer

Replacing all computers with manual typewriters to eliminate software vulnerabilities.

Question 15

Which TWO of the following scenarios demonstrate a failure to apply 'Progress iteratively with feedback'? (Choose two.)

Accepted Answer

A bank attempts to migrate all 100 legacy core banking systems to a new cloud GRC platform in a single weekend.. Options A and C represent monolithic 'big bang' approaches that ignore iterative feedback.

Answer

A project manager breaks down a large ISO certification project into monthly milestones with stakeholder reviews.

Answer

A development team releases minor compliance updates to production every week and adjusts rules based on user feedback.

Answer

An IT director conducts regular monthly retrospectives with the compliance team to refine approval workflows.