DPI Multiple Select — 40 Questions

Question 1

A CISO is evaluating why security compliance failures continue to occur despite extensive policies. According to ITIL 4 guiding principles and GRC best practices, which THREE underlying root causes should the CISO investigate? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security and compliance teams operate in strict silos, failing to collaborate with business operations ('Collaborate and promote visibility').. Option B is correct because ITIL 4's 'Collaborate and promote visibility' principle warns that siloed security and compliance teams that do not work with business operations create blind spots, misaligned controls, and unenforced policies, which directly explains persistent compliance failures. Option C is correct because 'Keep it simple and practical' means policies that are overly bureaucratic and impractical drive employees to workarounds and shadow IT, so the controls exist on paper but are bypassed in practice, producing compliance failures. Option D is correct because 'Focus on value' requires risk management to be tied to customer and business value streams; when policies appear as arbitrary roadblocks disconnected from value, the business resists or ignores them, undermining compliance. Option A is not correct because ITIL 4 and GRC best practices do not treat eliminating human error through excessive automation as a root cause of compliance failure; over-automation is not the stated problem, and zero tolerance for human error is neither realistic nor a guiding principle. Option E is not correct because thoroughly examining the current state is a sound starting point in ITIL 4's 'Start where you are' principle, not a root cause of compliance failures.

Answer

The organization may have automated too many security controls, leaving zero room for human error.

Answer

The CISO may have started their assessment by looking at the current state too thoroughly.

Question 2

An organization is implementing a comprehensive KPI framework across its IT value streams. During the DPI review, the strategist identifies that several metrics are causing dysfunctional behaviors. Which THREE warning signs indicate that a KPI is poorly designed and driving negative behavior?

Accepted Answer

Teams artificially inflate ticket counts or close trivial tasks rapidly to boost productivity numbers.. Option A is correct because gaming a metric—such as artificially inflating ticket counts or rapidly closing trivial tasks—is a classic dysfunctional behavior showing the KPI rewards volume over value, which distorts true productivity. Option B is correct because hiding service failures or delays to protect a departmental scorecard indicates the metric drives fear and opacity rather than transparency and continuous improvement. Option E is correct because local KPI success while enterprise strategic goals fail demonstrates suboptimization, where the metric is misaligned with the broader value stream and organizational objectives. Option C does not belong because objective, automated data from ServiceNow is a desirable KPI design characteristic, not a warning sign of dysfunction. Option D does not belong because monthly trend review with business stakeholders is a healthy governance practice that supports alignment, not a negative behavioral indicator.

Answer

The metric is based on objective, automated data collected directly from ServiceNow.

Answer

The metric trend is reviewed monthly in collaboration with business stakeholders.

Question 3

An enterprise IT organization is designing a value-based measurement framework for cloud migration initiatives. Which THREE strategic considerations must the strategist address to ensure the framework accurately captures business value?

Accepted Answer

Linking cloud infrastructure investments directly to business agility, revenue growth, and risk reduction.. Option C is correct because a value-based framework must connect cloud spending to strategic business outcomes such as agility, revenue growth, and risk reduction, rather than treating infrastructure as an isolated IT cost. Option D is correct because measuring user adoption and productivity gains captures realized business value, whereas counting migrated VMs only reflects activity or output, not outcomes. Option E is correct because TCO combined with financial return (e.g., ROI/NPV) gives a complete economic picture, preventing decisions based only on low initial migration costs. Option A is incorrect because restricting metrics to raw CPU and memory utilization ignores business value and focuses narrowly on technical resource usage. Option B is incorrect because eliminating stakeholder feedback and qualitative assessments removes important context about perceived value, satisfaction, and adoption that quantitative metrics alone may miss.

Answer

Ensuring all metrics are restricted exclusively to raw server CPU and memory utilization.

Answer

Eliminating any requirement for stakeholder feedback or qualitative value assessments.

Question 4

An IT governance committee is designing a risk management training program for software engineers. Which THREE practices align with ITIL 4 guiding principles? (Choose three.)

Accepted Answer

Focusing the training on how risk management enables secure, continuous software delivery ('Focus on value').. Option B is correct because ITIL 4's 'Focus on value' principle directs that every activity should trace back to value for the customer and organization; framing risk management training around enabling secure, continuous software delivery ties the practice directly to the value engineers produce rather than treating compliance as an end in itself. Option D is correct because 'Keep it simple and practical' favors the minimum number of steps needed to achieve the outcome, so short, scenario-based modules embedded in developer onboarding deliver usable risk knowledge without over-engineering the program. Option E is correct because 'Collaborate and promote visibility' calls for working across silos with real stakeholder input, and co-creating content with both security experts and software engineers ensures the training reflects actual engineering constraints and gains buy-in. Option A does not belong because rote memorization of a 500-page statute is neither simple nor value-focused and does not build practical risk judgment. Option C does not belong because restricting training to executives and excluding engineers contradicts collaboration, visibility, and the shared-responsibility intent of the guiding principles.

Answer

Forcing engineers to memorize a 500-page regulatory compliance statute word-for-word before writing any code.

Answer

Making the training mandatory only for executives while completely excluding engineers from security awareness.

Question 5

An IT service manager is prioritizing a backlog of 50 continual improvement opportunities. Which TWO of the following prioritization criteria are commonly used in ITIL continual improvement practices? (Choose two)

Accepted Answer

Estimated implementation effort, cost, and resource requirements.. Option C is correct because ITIL continual improvement prioritization weighs the estimated implementation effort, cost, and resource requirements to assess feasibility and effort-to-value trade-offs before committing resources. Option E is correct because expected business value and return on investment (ROI) are core criteria for ranking improvement opportunities by the benefit they deliver to the organization and its services. Together, effort/cost and value/ROI form the standard cost-benefit basis for sequencing a continual improvement backlog. Options A, B, and D are not valid prioritization criteria: server hardware color, a submitter's birthdate or astrological sign, and a vendor account manager's surname have no bearing on business value, risk, cost, or improvement impact.

Answer

The physical color of the server hardware hosting the application.

Answer

The personal birthdate and astrological sign of the ticket submitter.

Answer

The exact alphabetical surname of the vendor account manager.

Question 6

An IT strategy execution team is reviewing potential causes for strategy failure during the operational planning phase. Which THREE common pitfalls should they guard against? (Choose three)

Accepted Answer

Failing to align operational metrics and daily tasks with strategic goals.. Option B is correct because a classic execution pitfall is a disconnect between high-level strategic goals and the operational metrics, KPIs, and daily tasks that employees actually perform, so the strategy never translates into measurable frontline action. Option D is correct because treating strategy as a one-time static event ignores the need for continuous monitoring, feedback loops, and adaptive adjustment as market and internal conditions change, which is a well-documented cause of strategy failure. Option E is correct because without visible, ongoing executive sponsorship and resource commitment, initiatives lose priority, funding, and accountability, and execution stalls. Options A and C are not pitfalls but rather recommended practices: cross-silo collaboration and iterative feedback from customers and employees both strengthen strategy execution, so they do not belong among the failure causes to guard against.

Answer

Actively collaborating across organizational silos.

Answer

Iteratively reviewing feedback from customers and employees.

Question 7

When applying 'Keep it simple and practical' to enterprise compliance and risk frameworks, which THREE practices should an organization adopt? (Choose three.)

Accepted Answer

Eliminating redundant approval steps that do not add measurable risk mitigation or business value.. Option A is correct because 'keep it simple and practical' means removing redundant approval steps that add no measurable risk mitigation or business value, thereby reducing bureaucracy while preserving effective controls. Option C is correct because focusing on the vital few controls that address the greatest threats reflects a risk-based, prioritized approach rather than trying to control everything equally, which is impractical and dilutes effort. Option D is correct because clear, straightforward policies that frontline staff can easily understand and execute make compliance practical and more likely to be followed consistently. Option B does not belong because requiring manual spreadsheet logging for every low-risk server ping is excessive, labor-intensive, and disproportionate to the minimal risk involved. Option E does not belong because drafting 1,000-page governance manuals for every minor IT service desk procedure is overly complex and contradicts the principle of simplicity and practicality.

Answer

Requiring manual spreadsheet logging for every single low-risk server ping.

Answer

Drafting 1,000-page governance manuals for every minor IT service desk procedure.

Question 8

According to ITIL 4 DPI, which TWO of the following statements correctly describe the scope and purpose of the DPI module? (Choose two.)

Accepted Answer

It integrates direction, planning, and improvement into a universal approach applicable across the entire SVS.. Option A is correct because ITIL 4's Direct, Plan and Improve (DPI) module is designed as a universal, cross-cutting approach that integrates direction, planning, and continual improvement across all components of the Service Value System (SVS), not just one part of it. Option C is correct because DPI provides practitioners with practical methods, tools, and techniques to align strategic intent with day-to-day operational execution, which is central to its purpose. Option B is incorrect because DPI is not limited to software application development methodologies; it applies broadly to governance, planning, and improvement across all value streams. Option D is incorrect because DPI is not a specialized practice reserved for IT security officers; it is intended for a wide range of roles and disciplines. Option E is incorrect because DPI does not replace the Service Value Chain; the Service Value Chain remains a core element of ITIL 4, and DPI supports and enhances how it is directed, planned, and improved.

Answer

It focuses exclusively on software application development methodologies.

Answer

It is a specialized practice used only by IT security officers.

Answer

It replaces the need for the Service Value Chain in ITIL 4.

Question 9

An organization is designing key performance indicators (KPIs) for its Continual Improvement practice. Which THREE of the following metrics provide a balanced assessment of both improvement velocity and value realization? (Choose three)

Accepted Answer

Average cycle time from improvement idea intake to final implementation.. Option B is correct because average cycle time from idea intake to final implementation directly measures improvement velocity—how quickly the Continual Improvement practice moves initiatives through its pipeline—making it a leading indicator of throughput and responsiveness. Option C is correct because the percentage of completed initiatives achieving pre-defined target outcomes measures value realization and effectiveness, ensuring speed is not pursued at the expense of actual results. Option D is correct because ROI or cost savings generated by implemented improvements quantifies the financial value delivered, providing the economic dimension of value realization that complements cycle time and outcome attainment. Together, B, C, and D form a balanced set covering velocity (B), outcome effectiveness (C), and financial value (D). Option A does not belong because counting physical desktops replaced by hardware support is an operational asset metric, not a measure of improvement velocity or value realization. Option E does not belong because total data center electricity consumption is a facility or sustainability metric that, absent a defined improvement target, does not assess the performance of the Continual Improvement practice itself.

Answer

Total number of physical desktop computers replaced by hardware support.

Answer

Total electricity consumption of the primary data center facility.

Question 10

When designing operational plans that cascade from a digital transformation strategy, which TWO considerations are vital? (Choose two)

Accepted Answer

Allocating necessary resources, funding, and talent for tactical execution.. Option B is correct because cascading a digital transformation strategy into operational plans requires concrete resourcing — budget, headcount, tools, and skills — so that tactical execution is actually achievable rather than aspirational. Option E is correct because effective operational planning depends on feedback loops (e.g., KPIs, OKRs, sprint reviews, or PDCA cycles) that track progress against the strategy and allow tactical steps to be adjusted as conditions change. The unmarked options do not belong: A is wrong because operational plans must be communicated to the teams executing them, not kept secret; C is wrong because relying on intuition without performance data removes the evidence needed to steer execution; and D is wrong because freezing schedules eliminates the adaptability that feedback-driven operational planning requires.

Answer

Ensuring operational plans remain secret from the teams executing them.

Answer

Relying entirely on intuition without tracking performance data.

Answer

Avoiding any changes to schedules once the plan is published.

Question 11

An organization is implementing the DPI module to enhance its strategic agility. Which THREE factors should leadership consider when defining the scope of direction, planning, and improvement?

Accepted Answer

The value streams, products, and services delivered to customers. Option A is correct because defining the scope of direction, planning, and improvement in the DPI (Digital and Product Innovation) module must be anchored on the value streams, products, and services delivered to customers, since these represent the tangible outcomes the organization exists to produce and improve. Option C is correct because governance structures, policies, and risk thresholds determine how direction is set, how planning decisions are authorized, and what boundaries constrain improvement initiatives, making them essential scope inputs. Option E is correct because the overarching organizational strategy, vision, and stakeholder expectations provide the top-level intent and success criteria that the DPI scope must align with and serve. Option B does not belong because the physical brand of coffee machines in breakrooms is a facility/amenity detail with no bearing on strategic direction, planning, or improvement scope. Option D does not belong because the personal social media handles of junior developers are private, individual matters unrelated to organizational governance, value delivery, or strategy.

Answer

The physical brand of coffee machines installed in breakrooms

Answer

The personal social media handles of junior developers

Question 12

During an IT operating model transformation, change fatigue becomes a major risk. Which TWO organizational practices help mitigate change fatigue?

Accepted Answer

Pause low-value projects to free up stakeholder bandwidth for critical transformations.. Option A is correct because pausing low-value projects reduces the number of concurrent change demands on stakeholders, freeing bandwidth and attention for the critical transformation, which directly lowers the cumulative load that drives change fatigue. Option D is correct because prioritizing and sequencing initiatives according to the organization's absorptive capacity (its realistic ability to absorb and adopt change at a given time) prevents overloading employees with overlapping changes, a root cause of change fatigue. The unmarked options do not belong: B (launching all remaining strategic projects simultaneously) increases concurrent change and accelerates fatigue rather than mitigating it; C (prohibiting paid time off during transformation cycles) removes recovery time and worsens burnout and fatigue; and E (daily mandatory all-hands broadcasts) adds meeting overhead and communication noise without reducing change load, likely increasing fatigue.

Answer

Launch all remaining strategic projects simultaneously to finish them faster.

Answer

Prohibit employees from taking any paid time off during transformation cycles.

Answer

Increase the frequency of mandatory all-hands meetings to daily broadcasts.

Question 13

An organization is using Jira Service Management to track continual improvement tasks. Which TWO of the following Jira features can be configured to manage workflow transitions and accountability for improvement items? (Choose two)

Accepted Answer

Workflow assignees and status transition rules (e.g., To Do, In Progress, Done).. Option D is correct because Jira's workflow engine lets you define statuses such as To Do, In Progress, and Done and attach transition rules, conditions, validators, and assignees to each transition, which is exactly how you drive and control the movement of continual improvement items and make someone accountable at each step. Option E is correct because custom fields (for example numeric or select-list fields for Value, Effort, and Strategic Alignment scores) can be added to the improvement issue type and used in screens, filters, and boards to capture the prioritization and accountability data that continual improvement tracking requires. The remaining options do not belong: A (automated magnetic tape backup scheduling agents), B (BIOS firmware flashing utilities for server blades), and C (direct SCSI disk array virtualization controllers) are hardware, firmware, or storage-infrastructure concerns that have no relationship to Jira workflow configuration or issue accountability.

Answer

Automated magnetic tape backup scheduling agents.

Answer

BIOS firmware flashing utilities for physical server blades.

Answer

Direct SCSI disk array virtualization controllers.

Question 14

A strategist is designing a Balanced Scorecard for an IT organization. Which TWO perspectives of the traditional Balanced Scorecard evaluate internal capabilities and future readiness rather than financial or customer results?

Accepted Answer

Internal Business Processes Perspective. The Internal Business Processes Perspective (A) is correct because it evaluates the operational capabilities and process efficiency of the IT organization, focusing on how well internal activities are performed rather than on financial or customer outcomes. The Learning and Growth Perspective (E) is correct because it assesses future readiness by examining intangible assets such as employee skills, training, information systems, and organizational culture that enable continuous improvement and long-term success. The Customer Perspective (B) is not correct because it measures customer satisfaction, retention, and value delivery, which are external results rather than internal capabilities. The Financial Perspective (C) is not correct because it focuses on financial performance indicators such as revenue, cost control, and profitability. Vendor Management Perspective (D) is not a traditional Balanced Scorecard perspective, as the classic four are Financial, Customer, Internal Business Processes, and Learning and Growth.

Answer

Customer Perspective

Answer

Financial Perspective

Answer

Vendor Management Perspective

Question 15

An organization is launching an enterprise-wide continual improvement campaign. Which TWO of the following communication strategies should leadership employ to ensure high engagement and transparency? (Choose two)

Accepted Answer

Publish regular updates on the Continual Improvement Register, highlighting completed initiatives and realized value.. Option B is correct because publishing regular updates on the Continual Improvement Register provides visible, ongoing transparency into which initiatives are completed and what value they have delivered, which sustains engagement across the enterprise. Option E is correct because celebrating milestones and recognizing teams that contribute improvement ideas reinforces positive behavior, builds momentum, and encourages continued participation in the campaign. The remaining options undermine engagement and transparency: A restricts information to senior executives, which breeds distrust and disengagement; C uses unannounced surveys with no feedback loop, which signals that input is ignored; and D eliminates team meetings and relies on cryptic email attachments, which blocks open communication and collaboration.

Answer

Keep all improvement plans strictly classified among senior executives to prevent panic.

Answer

Send annual unannounced surveys with no follow-up action or feedback.

Answer

Discontinue all team meetings and rely exclusively on cryptic email attachments.

Question 16

Which TWO of the following represent core principles of effective communication in organizational change management? Choose TWO correct options.

Accepted Answer

Trusted local peers and direct supervisors are often the most effective messengers for change.. Option B is correct because change-management research and practice show that messages about change are most credible when delivered by trusted local peers and direct supervisors, who understand the audience's context and can address concerns face-to-face, rather than by distant project or executive sponsors alone. Option E is correct because effective change communication uses multiple, reinforced channels (e.g., email, team meetings, intranet, manager briefings) and repeats key messages over time, since people absorb and act on change information at different rates and through different media. Options A, C, and D are incorrect: A is wrong because transparently acknowledging risks and negative impacts builds credibility rather than undermining it; C is wrong because communication must be continuous and iterative throughout the change lifecycle, not a one-time launch event; and D is wrong because withholding information among project managers until go-live breeds rumor and resistance, whereas timely, appropriately shared information supports adoption.

Answer

Communication content should avoid addressing potential risks or negative impacts.

Answer

Communication should be a one-time event executed strictly at the project launch.

Answer

Information should be kept strictly confidential among project managers until go-live.

Question 17

An organization is evaluating its value stream planning practices. Which THREE of the following considerations are critical when optimizing value streams during strategic planning? (Choose three.)

Accepted Answer

Eliminating non-value-adding activities and reducing waste.. Option C is correct because value stream optimization centers on lean thinking: systematically removing non-value-adding steps (muda/waste such as waiting, overprocessing, and rework) so that the proportion of value-adding time in the total lead time increases. Option D is correct because you cannot optimize a value stream without mapping the current-state flow of work and using techniques like value stream mapping to expose bottlenecks, constraints, and queue buildup, then applying Theory of Constraints to relieve them. Option E is correct because value is defined by the customer, not internally; identifying what the customer actually values establishes the baseline for distinguishing value-adding from non-value-adding activities and for prioritizing improvements. Option A is not correct because adding handoffs between silos increases wait time, coordination overhead, and failure demand, which is the opposite of optimization. Option B is not correct because implementing every improvement idea at once without prioritization ignores capacity, dependencies, and cost-benefit tradeoffs, and it undermines the incremental, prioritized improvement approach that value stream planning requires.

Answer

Maximizing the number of handoffs between silos to increase complexity.

Answer

Ensuring that all improvement ideas are implemented simultaneously without prioritization.

Question 18

A global financial institution is restructuring its compliance framework to support agile software delivery. Which THREE of the following strategies align with ITIL 4 guiding principles and modern GRC practices? (Choose three.)

Accepted Answer

Integrating risk and compliance professionals directly into agile scrum teams as active participants.. Option B is correct because embedding risk and compliance professionals directly into agile scrum teams as active participants embodies ITIL 4's 'collaborate and promote visibility' and 'think and work holistically' principles, breaking down silos between GRC and delivery so compliance requirements are addressed continuously rather than retrofitted. Option C is correct because lightweight, risk-based compliance gates that scale with the business criticality of the application reflect the 'focus on value' and 'start where you are' principles, applying proportionate controls so low-risk changes move quickly while high-risk systems receive stronger scrutiny. Option E is correct because replacing annual monolithic audits with continuous, automated compliance monitoring aligns with 'progress iteratively with feedback' and modern GRC's shift-left, evidence-as-code approach, enabling real-time detection and remediation instead of point-in-time snapshots. Option A does not belong because requiring physical board sign-off for every code commit is bureaucratic, manual, and unscalable, contradicting 'keep it simple and practical' and destroying agile flow. Option D does not belong because eliminating all regulatory oversight and delegating sign-offs entirely to junior developers abandons accountability and violates mandatory regulatory obligations in a financial institution, which no ITIL 4 principle or GRC practice endorses.

Answer

Requiring a physical paper sign-off from the board of directors for every single code commit.

Answer

Eliminating all regulatory oversight and delegating compliance sign-offs entirely to junior developers.

Question 19

An IT strategist is reviewing the organization's SLA (Service Level Agreement) reporting. Management notes that while 99% of SLAs are met, customer dissatisfaction remains high. According to ITIL 4, what are TWO likely reasons for this disconnect?

Accepted Answer

SLAs measure internal technical milestones rather than true end-user business outcomes and experience.. Option A is correct because ITIL 4 emphasizes that SLAs should reflect value co-creation and end-user experience; if SLAs track internal technical milestones (e.g., server uptime, ticket closure times) rather than business outcomes and customer experience, the organization can hit 99% compliance while customers remain dissatisfied. Option E is correct because a classic cause of this disconnect is that SLAs are defined around metrics that are convenient for IT to measure (e.g., mean time to restore, first-line resolution rate) instead of the outcomes customers actually care about, so compliance does not translate into perceived value. Option B is not a likely reason for the disconnect, since financial ROI tracking is a portfolio/investment concern, not an SLA design or reporting issue affecting customer satisfaction. Option C is not correct because reporting frequency (annual vs. monthly) affects visibility and timeliness of governance, but it does not by itself explain why met SLAs fail to satisfy customers. Option D is not correct because using automated data from ServiceNow is a sound measurement practice and does not inherently cause a disconnect between SLA compliance and customer satisfaction.

Answer

The organization is not tracking financial ROI within the service desk.

Answer

The reporting frequency of SLA compliance is too low (annual).

Answer

The SLAs are calculated using automated data from ServiceNow.

Question 20

An IT organization is migrating its GRC platform from an on-premises tool to ServiceNow GRC. Which THREE ITIL 4 guiding principle considerations are critical for a successful migration? (Choose three.)

Accepted Answer

Taking the opportunity to clean up and simplify outdated, bureaucratic control procedures during the migration ('Keep it simple and practical').. Option B is correct because ITIL 4's 'Keep it simple and practical' principle directs the organization to use the migration as an opportunity to eliminate outdated, bureaucratic control procedures rather than blindly porting them, reducing complexity in the new ServiceNow GRC platform. Option C is correct because 'Progress iteratively with feedback' supports phasing the migration module by module (Policy compliance, then Risk, then Vendor Risk), allowing lessons learned and user feedback from each increment to improve subsequent deployments. Option D is correct because 'Start where you are' requires assessing the existing legacy tool's controls and data structures before planning, so that valid existing content is reused and only what adds value is migrated. Option A is not correct because a single high-risk weekend 'big bang' deployment of all 10,000 custom scripts contradicts iterative, feedback-driven, and simplicity-focused principles. Option E is not correct because restricting migration knowledge to the lead architect violates ITIL 4's 'Collaborate and promote visibility' principle, which calls for transparency and stakeholder involvement.

Answer

Migrating all 10,000 custom scripts and legacy workflows in a single high-risk weekend deployment.

Answer

Ensuring that only the lead architect knows the migration plan to prevent unnecessary discussion.