DPI Guiding Principles And GRC Practice Test 3 — 15 Questions

Question 1

An IT service manager is reviewing the incident management process to ensure GDPR compliance during data breach reporting. The manager cuts out three redundant management approval steps that added no legal value. Which guiding principle is being applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Keep it simple and practical. The guiding principle 'Keep it simple and practical' from ITIL 4 focuses on simplifying work processes by eliminating non-value-adding steps. Here, the manager removed three redundant management approval steps that added no legal value to GDPR breach reporting, directly applying this principle. This ensures the incident management process is streamlined and efficient while still meeting compliance requirements.

Answer

Optimize and automate

Answer

Start where you are

Answer

Think and work holistically

Question 2

An enterprise is deploying a Zero Trust Architecture (ZTA). Rather than restricting access based solely on corporate network perimeter, ZTA verifies every user and device continuously. How does this architectural shift embody 'Think and work holistically' in the context of GRC?

Accepted Answer

It integrates identity, device telemetry, network context, and data classification into an end-to-end continuous risk evaluation model.. Zero Trust Architecture embodies 'Think and work holistically' by integrating identity, device telemetry, network context, and data classification into a single continuous risk evaluation model rather than treating security domains in isolation. This end-to-end view recognizes that risk emerges from the interaction of users, devices, networks, and data, not from any single layer. In GRC terms, it aligns controls across the whole system instead of relying on perimeter assumptions.

Answer

It delegates all security perimeter decisions entirely to end users.

Answer

It assumes internal network traffic is inherently trustworthy and secure.

Answer

It focuses exclusively on physical data center security.

Question 3

An IT team wants to improve their risk management maturity but does not know where their current vulnerabilities lie. What should be their very first step according to ITIL 4 guiding principles?

Accepted Answer

Assess current risk practices and vulnerabilities using direct observation and existing documentation.. According to ITIL 4 guiding principles, the first step in improving any practice is to understand the current state—often summarized as 'start where you are.' Option A directly applies this principle by assessing existing risk practices and vulnerabilities through direct observation and documentation review. This establishes a factual baseline before any changes are made, ensuring improvements are targeted and evidence-based rather than speculative.

Answer

Implement an expensive AI-powered risk scoring platform.

Answer

Outsource all risk management to an external Big Four auditing firm.

Answer

Rewrite all corporate risk policies from scratch.

Question 4

A software development organization is integrating static application security testing (SAST) into GitHub Actions. Developers complain that false positives block builds daily, leading them to disable the security checks. How should the security team apply ITIL 4 principles to correct this?

Accepted Answer

Iteratively tune SAST rule sets in collaboration with developers to minimize false positives while maintaining vulnerability detection.. False positives causing bypasses mean the rules are impractical or poorly tuned. Tuning rules iteratively with developer feedback applies 'Progress iteratively with feedback' and 'Keep it simple and practical'.

Answer

Mandate immediate termination for developers who disable security checks.

Answer

Disable SAST checks permanently to keep builds fast.

Answer

Move SAST checks to a manual review that occurs once a year.

Question 5

An organization is establishing an enterprise GRC dashboard in PowerBI. The risk team wants to track 150 different Key Risk Indicators (KRIs). Executive leadership complains that the dashboard is overwhelming and useless for decision-making. Which guiding principle should be applied to redesign the dashboard?

Accepted Answer

Apply 'Focus on value' and 'Keep it simple and practical' to streamline the dashboard down to the critical few KRIs that directly impact strategic business objectives.. Applying 'Focus on value' and 'Keep it simple and practical' means reducing the 150 KRIs to the critical few that directly impact strategic business objectives, making the dashboard actionable for executives. These two ITIL 4 guiding principles directly address the problem of information overload that renders a GRC dashboard useless for decision-making.

Answer

Automate email alerts to send all 150 KRIs to executives every hour.

Answer

Add 50 more operational metrics to ensure absolute coverage of every IT asset.

Answer

Acknowledge the dashboard failure and abandon risk metric reporting entirely.

Question 6

A financial services firm is deploying robotic process automation (RPA) bots to handle customer loan applications. Compliance requires that every bot decision be fully auditable. The development team wants to deploy bots immediately without logging logic. Which governance conflict does this represent regarding ITIL principles?

Accepted Answer

A conflict between 'Optimize and automate' and governance requirements for transparency and auditability.. The ITIL guiding principle 'Optimize and automate' encourages using technology like RPA to streamline processes, but it must be balanced with governance requirements for transparency and auditability. In a financial services context, compliance mandates that automated decisions be traceable, so deploying bots without logging logic directly conflicts with these governance obligations. Thus, the conflict is between the drive to automate quickly and the need for auditable controls.

Answer

A conflict between 'Think and work holistically' and HR hiring policies.

Answer

A conflict between 'Keep it simple and practical' and physical security.

Answer

A conflict between 'Focus on value' and 'Start where you are'.

Question 7

An enterprise risk management framework mandates that third-party cloud providers undergo annual SOC 2 Type II audits. A strategic AI startup vendor only possesses a SOC 2 Type I report. How should the enterprise apply ITIL 4 guiding principles to evaluate this risk without blocking innovation?

Accepted Answer

Apply risk-based evaluation ('Focus on value') and establish an iterative vendor development plan ('Progress iteratively with feedback') accepting Type I temporarily with a binding contract for Type II within 6 months.. It applies 'Focus on value' by recognizing that the startup's AI capabilities may deliver significant business value, and 'Progress iteratively with feedback' by accepting the SOC 2 Type I temporarily while contractually requiring Type II within 6 months. This balances risk management with innovation, allowing the enterprise to start realizing value while ensuring the vendor improves its security posture over time.

Answer

Rewrite the startup's security architecture yourself to achieve SOC 2 Type II compliance.

Answer

Waive all SOC 2 audit requirements permanently for AI vendors.

Answer

Instantly terminate negotiations with the AI startup to maintain strict compliance adherence.

Question 8

A company's internal audit department issues 200 findings per year, but IT can only remediate 20 due to resource constraints. The audit findings pile up year over year, creating massive regulatory exposure. How should IT and audit apply 'Focus on value' and 'Keep it simple and practical' to resolve this?

Accepted Answer

Jointly prioritize findings based on actual business risk and critical value stream impact, tackling remediation in manageable batches.. It applies 'Focus on value' by prioritizing findings based on business risk and value stream impact, and 'Keep it simple and practical' by tackling remediation in manageable batches. This approach ensures that limited resources are used effectively to address the most critical issues first, reducing regulatory exposure without overwhelming IT.

Answer

Ignore all future audit reports and operate without internal controls.

Answer

Hire 50 temporary auditors to write more findings.

Answer

Outsource audit remediation to an unvetted offshore contractor.

Question 9

A global financial institution is restructuring its compliance framework to support agile software delivery. Which THREE of the following strategies align with ITIL 4 guiding principles and modern GRC practices? (Choose three.)

Accepted Answer

Integrating risk and compliance professionals directly into agile scrum teams as active participants.. Option B is correct because embedding risk and compliance professionals directly into agile scrum teams as active participants embodies ITIL 4's 'collaborate and promote visibility' and 'think and work holistically' principles, breaking down silos between GRC and delivery so compliance requirements are addressed continuously rather than retrofitted. Option C is correct because lightweight, risk-based compliance gates that scale with the business criticality of the application reflect the 'focus on value' and 'start where you are' principles, applying proportionate controls so low-risk changes move quickly while high-risk systems receive stronger scrutiny. Option E is correct because replacing annual monolithic audits with continuous, automated compliance monitoring aligns with 'progress iteratively with feedback' and modern GRC's shift-left, evidence-as-code approach, enabling real-time detection and remediation instead of point-in-time snapshots. Option A does not belong because requiring physical board sign-off for every code commit is bureaucratic, manual, and unscalable, contradicting 'keep it simple and practical' and destroying agile flow. Option D does not belong because eliminating all regulatory oversight and delegating sign-offs entirely to junior developers abandons accountability and violates mandatory regulatory obligations in a financial institution, which no ITIL 4 principle or GRC practice endorses.

Answer

Requiring a physical paper sign-off from the board of directors for every single code commit.

Answer

Eliminating all regulatory oversight and delegating compliance sign-offs entirely to junior developers.

Question 10

Which TWO of the following behaviors best exemplify 'Collaborate and promote visibility' within an IT governance context? (Choose two.)

Accepted Answer

Displaying real-time security incident and compliance status dashboards on screens visible to all IT and business teams.. Option C is correct because displaying real-time security incident and compliance status dashboards to all IT and business teams directly promotes visibility, ensuring stakeholders share a common, current view of governance-relevant information. Option E is correct because involving development, operations, security, and legal teams in joint risk identification workshops exemplifies collaboration across silos, which is central to the 'Collaborate and promote visibility' principle. Options A, B, and D do not belong: restricting risk registers to executives (A) and writing policies secretly in legal (D) actively reduce transparency, while mandating all interdepartmental communication through multi-week written ticket queues (B) impedes collaboration and timely information sharing rather than fostering them.

Answer

Restricting access to risk registers to senior executive leadership only.

Answer

Mandating that all communication between departments must occur via formal, multi-week written ticket queues.

Answer

Writing compliance policies in secret within the legal department and releasing them without notice.

Question 11

An enterprise GRC committee is reviewing its risk management strategy. Which TWO practices effectively integrate ITIL 4 guiding principles into risk governance? (Choose two.)

Accepted Answer

Aligning risk appetites directly with the organization's key value streams and customer outcomes.. Option D is correct because ITIL 4's guiding principles include 'focus on value' and 'collaborate and promote visibility,' so aligning risk appetite with key value streams and customer outcomes ensures risk governance directly supports what the organization delivers to customers rather than existing as an abstract control exercise. Option E is correct because embedding automated compliance checks and risk assessments into CI/CD pipelines embodies the principles of 'progress iteratively with feedback' and 'optimize and automate,' enabling continuous, fast risk evaluation at the point of change instead of slow manual gates. Option A is wrong because isolating risk management from IT operations violates 'collaborate and promote visibility' and 'think and work holistically,' which require integrated, cross-functional risk ownership. Option B is wrong because hiding audit findings contradicts 'collaborate and promote visibility' and 'keep it simple and practical,' and it undermines transparency and continual improvement. Option C is wrong because a 12-month manual approval for minor patches violates 'progress iteratively with feedback,' 'optimize and automate,' and 'start where you are,' and it does not achieve zero risk while destroying flow and value delivery.

Answer

Treating risk management as an isolated, bureaucratic legal function completely separate from IT operations.

Answer

Hiding audit findings from development teams to prevent panic and maintain morale.

Answer

Mandating a 12-month manual approval process for all minor software patches to ensure zero risk.

Question 12

When applying 'Keep it simple and practical' to enterprise compliance and risk frameworks, which THREE practices should an organization adopt? (Choose three.)

Accepted Answer

Eliminating redundant approval steps that do not add measurable risk mitigation or business value.. Option A is correct because 'keep it simple and practical' means removing redundant approval steps that add no measurable risk mitigation or business value, thereby reducing bureaucracy while preserving effective controls. Option C is correct because focusing on the vital few controls that address the greatest threats reflects a risk-based, prioritized approach rather than trying to control everything equally, which is impractical and dilutes effort. Option D is correct because clear, straightforward policies that frontline staff can easily understand and execute make compliance practical and more likely to be followed consistently. Option B does not belong because requiring manual spreadsheet logging for every low-risk server ping is excessive, labor-intensive, and disproportionate to the minimal risk involved. Option E does not belong because drafting 1,000-page governance manuals for every minor IT service desk procedure is overly complex and contradicts the principle of simplicity and practicality.

Answer

Requiring manual spreadsheet logging for every single low-risk server ping.

Answer

Drafting 1,000-page governance manuals for every minor IT service desk procedure.

Question 13

Which TWO of the following indicators suggest an organization is failing to apply 'Think and work holistically'? (Choose two.)

Accepted Answer

The security team creates impenetrable firewalls without consulting the usability needs of customer-facing application teams.. Option C is correct because the security team optimizing firewalls in isolation, without considering customer-facing application usability, demonstrates siloed thinking rather than understanding how security interacts with the whole system of applications, users, and business outcomes. Option D is correct because compliance officers issuing findings without reviewing operational workflows shows a failure to understand the interconnectedness of compliance requirements and day-to-day IT operations, producing avoidable surprises. By contrast, option A reflects holistic thinking since post-mortems include all stakeholder groups to find root causes across the system, option B is holistic because cloud migration weighs cost, security, operational readiness, and business value together, and option E is holistic because it fosters cross-departmental communication among legal, HR, and IT.

Answer

Incident management post-mortems involve all stakeholder groups to determine root causes.

Answer

Cloud migration strategies take into account cost, security, operational readiness, and business value simultaneously.

Answer

The organization maintains regular communication channels between legal, HR, and IT departments.

Question 14

An IT governance board is evaluating how to apply 'Optimize and automate' to its vendor risk assessment process. Which THREE of the following initiatives represent correct applications of this principle? (Choose three.)

Accepted Answer

Configuring automated email reminders and escalation workflows for overdue vendor security certificates.. Option A is correct because automating reminders and escalation workflows for overdue vendor security certificates applies 'Optimize and automate' by removing manual follow-up and enforcing consistent, timely governance actions. Option B is correct because API integrations between Jira and ServiceNow automatically synchronize compliance remediation tasks, eliminating duplicate manual entry and improving workflow efficiency across tools. Option C is correct because automated vendor risk scoring driven by continuous threat intelligence feeds replaces periodic manual assessments with timely, data-driven, repeatable risk evaluation. Option D is not correct because abandoning verification and letting vendors self-grade removes necessary controls and oversight rather than optimizing the process. Option E is not correct because replacing computers with typewriters degrades capability and does not automate or improve the vendor risk assessment workflow.

Answer

Firing all risk analysts and letting vendors grade their own security compliance without verification.

Answer

Replacing all computers with manual typewriters to eliminate software vulnerabilities.

Question 15

Which TWO of the following scenarios demonstrate a failure to apply 'Progress iteratively with feedback'? (Choose two.)

Accepted Answer

A bank attempts to migrate all 100 legacy core banking systems to a new cloud GRC platform in a single weekend.. Option B is correct because attempting to migrate all 100 legacy core banking systems to a new cloud GRC platform in a single weekend is a classic 'big bang' approach that ignores iterative delivery and feedback; it concentrates all risk into one release with no opportunity to learn, validate, or adjust between increments. Option D is correct because spending 24 months writing an 800-page cybersecurity policy before testing any controls is a purely sequential, waterfall-style effort that produces no working feedback loop; without piloting or validating controls early, the organization cannot incorporate lessons learned until far too late. Options A, C, and E all reflect the principle properly: A uses monthly milestones with stakeholder reviews, C delivers weekly compliance updates and adjusts based on user feedback, and E runs monthly retrospectives to refine approval workflows, each creating short iterations with explicit feedback mechanisms.

Answer

A project manager breaks down a large ISO certification project into monthly milestones with stakeholder reviews.

Answer

A development team releases minor compliance updates to production every week and adjusts rules based on user feedback.

Answer

An IT director conducts regular monthly retrospectives with the compliance team to refine approval workflows.