Courseiva

CCNA Guiding Principles And GRC Questions

41 questions · Guiding Principles And GRC · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

An IT team wants to improve their risk management maturity but does not know where their current vulnerabilities lie. What should be their very first step according to ITIL 4 guiding principles?

A.Assess current risk practices and vulnerabilities using direct observation and existing documentation.
B.Implement an expensive AI-powered risk scoring platform.
C.Outsource all risk management to an external Big Four auditing firm.
D.Rewrite all corporate risk policies from scratch.
AnswerA

Understanding current risk practices and vulnerabilities through observation and documentation establishes the baseline before any improvement. This satisfies the stem's requirement for a first step, reflecting 'start where you are' rather than assuming unknown gaps.

Why this answer

According to ITIL 4 guiding principles, the first step in improving any practice is to understand the current state—often summarized as 'start where you are.' Option A directly applies this principle by assessing existing risk practices and vulnerabilities through direct observation and documentation review. This establishes a factual baseline before any changes are made, ensuring improvements are targeted and evidence-based rather than speculative.

Exam trap

The trap here is that candidates may think the most advanced or expensive solution (like AI or external auditors) is the best first step, but ITIL 4 emphasizes starting with a current-state assessment to avoid wasted effort and ensure improvements are grounded in reality.

How to eliminate wrong answers

Option B is wrong because implementing an expensive AI-powered risk scoring platform before understanding current vulnerabilities violates the 'start where you are' principle and likely leads to misaligned or premature investment. Option C is wrong because outsourcing all risk management to an external firm abdicates internal ownership and does not build internal maturity; ITIL 4 emphasizes collaboration and keeping control of core practices. Option D is wrong because rewriting all policies from scratch ignores existing practices that may already be effective and contradicts the principle of 'progress iteratively with feedback' by attempting a big-bang overhaul without assessment.

Practice this question →
2
MCQmedium

A financial services firm is adopting the ITIL 4 guiding principle 'Focus on value' for its new IT governance, risk, and compliance (GRC) platform. The platform will serve multiple stakeholders: the board, regulators, IT operations, and business units. During a workshop, the team debates what 'value' means. Which action best ensures the principle is applied effectively?

A.Implement all features requested by the most vocal stakeholder group to ensure their support and sponsorship.
B.Adopt the vendor's default GRC configuration without customization, as it represents best practice across industries.
C.Define value exclusively as regulatory compliance, since the board's primary concern is avoiding fines.
D.Map the GRC platform's outcomes to the specific value each stakeholder group expects, then prioritize features that deliver the greatest combined value.
AnswerD

Focusing on value means identifying what is valuable to each stakeholder and making decisions that maximize overall value. By mapping outcomes to stakeholder expectations—regulators need evidence, IT needs efficient controls, business units need minimal friction—the team can prioritize features that satisfy multiple needs. This approach aligns with the principle's intent to understand value from the consumer's perspective and avoid delivering outputs that nobody values.

Why this answer

The 'Focus on value' principle requires understanding what constitutes value for each stakeholder and making decisions that optimize that value. Mapping outcomes to stakeholder expectations and prioritizing features accordingly ensures the GRC platform delivers tangible benefits to all parties. This avoids the pitfalls of a one-sided definition, political prioritization, or uncritical adoption of generic configurations, all of which can reduce overall value.

Exam trap

The trap here is assuming that value is synonymous with compliance or that it can be defined by a single stakeholder group, rather than recognizing that value must be understood from multiple stakeholder perspectives.

Practice this question →
3
MCQhard

An organization is establishing an enterprise GRC dashboard in PowerBI. The risk team wants to track 150 different Key Risk Indicators (KRIs). Executive leadership complains that the dashboard is overwhelming and useless for decision-making. Which guiding principle should be applied to redesign the dashboard?

A.Automate email alerts to send all 150 KRIs to executives every hour.
B.Apply 'Focus on value' and 'Keep it simple and practical' to streamline the dashboard down to the critical few KRIs that directly impact strategic business objectives.
C.Add 50 more operational metrics to ensure absolute coverage of every IT asset.
D.Acknowledge the dashboard failure and abandon risk metric reporting entirely.
AnswerB

Focus on value and Keep it simple and practical together strip the dashboard to the critical few KRIs tied to strategic objectives. This directly addresses the executive complaint: 150 indicators obscure decision-making, whereas a streamlined set restores actionable insight aligned to business outcomes.

Why this answer

Applying 'Focus on value' and 'Keep it simple and practical' means reducing the 150 KRIs to the critical few that directly impact strategic business objectives, making the dashboard actionable for executives. These two ITIL 4 guiding principles directly address the problem of information overload that renders a GRC dashboard useless for decision-making.

Exam trap

The trap is assuming that more data equals better governance; candidates may pick the option that 'ensures coverage' when the scenario explicitly signals that the dashboard is already overwhelming and useless.

How to eliminate wrong answers

Option A is wrong because automating hourly delivery of all 150 KRIs amplifies the overload problem rather than solving it, and executives will simply ignore the alerts. Option C is wrong because adding 50 more metrics worsens the dashboard's usability and contradicts the goal of simplifying for decision-making. Option D is wrong because abandoning risk metric reporting entirely is an overreaction that eliminates a valuable governance capability instead of refining it.

Practice this question →
4
MCQmedium

A company's risk management department operates independently of the enterprise architecture team. As a result, new software purchased by architecture frequently fails security risk reviews. Which guiding principle should be used to rectify this disconnect?

A.Focus on value
B.Optimize and automate
C.Keep it simple and practical
D.Collaborate and promote visibility
AnswerD

Collaborating and promoting visibility directly addresses the disconnect by requiring the risk and architecture teams to share decision-making and surface security requirements early. This satisfies the stem's constraint: independent operation causing repeated review failures. Joint engagement embeds risk criteria into procurement, so purchased software passes review rather than being rejected after the fact.

Why this answer

The disconnect is a communication and silo problem: risk management and architecture are not sharing information, so purchases fail reviews. 'Collaborate and promote visibility' directly addresses breaking silos and ensuring cross-team information flow. Applying this principle means architecture and risk teams work together early, so security requirements are known before purchases are made.

Exam trap

The trap is choosing a principle that sounds collaborative or efficient (like 'focus on value' or 'optimize and automate') when the scenario is specifically about siloed teams failing to share information — which maps directly to 'collaborate and promote visibility.'

How to eliminate wrong answers

Option A is wrong because 'focus on value' is about aligning work to business outcomes, not fixing cross-team communication gaps. Option B is wrong because 'optimize and automate' concerns efficiency and automation of processes, not the organizational disconnect described. Option C is wrong because 'keep it simple and practical' is about avoiding over-engineering, which doesn't address the silo between risk and architecture.

Practice this question →
5
Multi-Selecthard

An enterprise risk management committee wants to overhaul its risk assessment methodology. Which THREE of the following approaches integrate ITIL 4 guiding principles into modern enterprise risk management? (Choose three.)

Select 3 answers
A.Leveraging API-driven telemetry from cloud security posture management (CSPM) tools to automate risk scoring ('Optimize and automate').
B.Integrating operational, financial, cybersecurity, and regulatory risks into a holistic, enterprise-wide risk model ('Think and work holistically').
C.Requiring all risk assessments to be performed manually on physical paper forms to prevent digital tampering.
D.Collaborating closely with product owners, developers, and compliance officers to co-create risk mitigation plans ('Collaborate and promote visibility').
E.Operating risk management entirely independently of business strategy to maintain uncompromised objectivity.
AnswersA, B, D

API-driven telemetry from CSPM tools directly satisfies the committee's need for automated, continuous risk scoring, embodying the 'optimise and automate' guiding principle. Rather than manual periodic assessments, machine-speed data feeds replace human effort, letting the committee focus judgement on prioritisation and treatment decisions across the enterprise.

Why this answer

Option A is correct because using API-driven telemetry from CSPM tools to automate risk scoring directly embodies the ITIL 4 guiding principle 'Optimize and automate' — it leverages technology to streamline and improve the efficiency of risk assessment rather than relying on manual effort. Option B is correct because integrating operational, financial, cybersecurity, and regulatory risks into a holistic, enterprise-wide risk model reflects the guiding principle 'Think and work holistically,' recognizing that risk in one domain affects the whole organization and must be managed as an interconnected system. Option D is correct because collaborating with product owners, developers, and compliance officers to co-create risk mitigation plans exemplifies 'Collaborate and promote visibility,' ensuring diverse stakeholders share information and work together to produce more effective, transparent risk outcomes.

Option C is not correct because mandating manual paper-based assessments contradicts the 'Optimize and automate' principle and does not reflect modern enterprise risk management practice. Option E is not correct because isolating risk management from business strategy violates the holistic principle — risk management must align with and inform business strategy to be effective.

Practice this question →
6
MCQhard

An enterprise risk management framework mandates that third-party cloud providers undergo annual SOC 2 Type II audits. A strategic AI startup vendor only possesses a SOC 2 Type I report. How should the enterprise apply ITIL 4 guiding principles to evaluate this risk without blocking innovation?

A.Rewrite the startup's security architecture yourself to achieve SOC 2 Type II compliance.
B.Apply risk-based evaluation ('Focus on value') and establish an iterative vendor development plan ('Progress iteratively with feedback') accepting Type I temporarily with a binding contract for Type II within 6 months.
C.Waive all SOC 2 audit requirements permanently for AI vendors.
D.Instantly terminate negotiations with the AI startup to maintain strict compliance adherence.
AnswerB

Balances the annual SOC 2 Type II mandate against innovation by treating Type I as a temporary, risk-accepted state. 'Focus on value' justifies not blocking the vendor, while 'progress iteratively with feedback' converts the gap into a contractual six-month remediation milestone, satisfying the framework's audit intent without immediate exclusion.

Why this answer

Option B is correct because it applies 'Focus on value' by recognizing that the startup's AI capabilities may deliver significant business value, and 'Progress iteratively with feedback' by accepting the SOC 2 Type I temporarily while contractually requiring Type II within 6 months. This balances risk management with innovation, allowing the enterprise to start realizing value while ensuring the vendor improves its security posture over time.

Exam trap

The trap is choosing an extreme option (terminate or waive all requirements) instead of a balanced, iterative approach that applies ITIL 4 principles to manage risk while enabling innovation.

How to eliminate wrong answers

Option A is wrong because rewriting the startup's security architecture yourself is not feasible, scalable, or appropriate; it oversteps the enterprise's role and does not address the vendor's compliance gap. Option C is wrong because permanently waiving all SOC 2 audit requirements for AI vendors creates an unacceptable risk exposure and violates the enterprise risk framework. Option D is wrong because instantly terminating negotiations is a rigid, all-or-nothing approach that blocks innovation and ignores the potential value the startup could provide, contrary to ITIL 4 principles.

Practice this question →
7
Multi-Selectmedium

An IT governance committee is designing a risk management training program for software engineers. Which THREE practices align with ITIL 4 guiding principles? (Choose three.)

Select 3 answers
A.Forcing engineers to memorize a 500-page regulatory compliance statute word-for-word before writing any code.
B.Focusing the training on how risk management enables secure, continuous software delivery ('Focus on value').
C.Making the training mandatory only for executives while completely excluding engineers from security awareness.
D.Designing short, practical, scenario-based training modules embedded directly into the developer onboarding workflow ('Keep it simple and practical').
E.Co-creating the training content with both security experts and software engineers ('Collaborate and promote visibility').
AnswersB, D, E

Framing risk management training around secure, continuous delivery directly applies 'focus on value', tying every risk activity to the outcome engineers actually deliver. This satisfies the committee's need for practices aligned to ITIL 4 guiding principles rather than abstract compliance.

Why this answer

Option B is correct because ITIL 4's 'Focus on value' principle directs that every activity should trace back to value for the customer and organization; framing risk management training around enabling secure, continuous software delivery ties the practice directly to the value engineers produce rather than treating compliance as an end in itself. Option D is correct because 'Keep it simple and practical' favors the minimum number of steps needed to achieve the outcome, so short, scenario-based modules embedded in developer onboarding deliver usable risk knowledge without over-engineering the program. Option E is correct because 'Collaborate and promote visibility' calls for working across silos with real stakeholder input, and co-creating content with both security experts and software engineers ensures the training reflects actual engineering constraints and gains buy-in.

Option A does not belong because rote memorization of a 500-page statute is neither simple nor value-focused and does not build practical risk judgment. Option C does not belong because restricting training to executives and excluding engineers contradicts collaboration, visibility, and the shared-responsibility intent of the guiding principles.

Exam trap

The trap is selecting options that sound rigorous (e.g., memorizing a 500-page statute) or exclusive (e.g., training only executives) — these violate ITIL 4 principles of simplicity, practicality, and inclusivity.

Practice this question →
8
Multi-Selecteasy

Which TWO of the following behaviors best exemplify 'Collaborate and promote visibility' within an IT governance context? (Choose two.)

Select 2 answers
A.Restricting access to risk registers to senior executive leadership only.
B.Mandating that all communication between departments must occur via formal, multi-week written ticket queues.
C.Displaying real-time security incident and compliance status dashboards on screens visible to all IT and business teams.
D.Writing compliance policies in secret within the legal department and releasing them without notice.
E.Involving development, operations, security, and legal teams in joint risk identification workshops.
AnswersC, E

Visible real-time dashboards make security and compliance status transparent across IT and business teams, directly embodying 'collaborate and promote visibility' by sharing information openly. This satisfies the stem's requirement for behaviours exemplifying that principle in governance.

Why this answer

Option C is correct because displaying real-time security incident and compliance status dashboards to all IT and business teams directly promotes visibility, ensuring stakeholders share a common, current view of governance-relevant information. Option E is correct because involving development, operations, security, and legal teams in joint risk identification workshops exemplifies collaboration across silos, which is central to the 'Collaborate and promote visibility' principle. Options A, B, and D do not belong: restricting risk registers to executives (A) and writing policies secretly in legal (D) actively reduce transparency, while mandating all interdepartmental communication through multi-week written ticket queues (B) impedes collaboration and timely information sharing rather than fostering them.

Practice this question →
9
MCQeasy

When auditing a legacy application, an IT governance team discovers that no documentation exists. Instead of demanding a massive documentation project, the team applies 'Start where you are'. What should they do?

A.Scrap the application immediately and rewrite it from scratch.
B.Inspect the running application code and configuration directly to establish an accurate baseline of its current state.
C.Assume the application is fully compliant based on its age and sign off on the audit.
D.Hire an external consultant to write a 200-page historical report.
AnswerB

Inspecting running code and configuration establishes an accurate baseline of the application's actual current state, which is precisely what 'Start where you are' requires. This avoids a costly documentation project while grounding subsequent decisions in observed reality rather than assumption.

Why this answer

'Start where you are' directs the team to assess the actual current state rather than launching a documentation or rewrite project. Inspecting the running application code and configuration directly establishes an accurate baseline of what exists today, which is the essence of the principle.

Exam trap

The trap is that candidates equate 'start where you are' with 'do nothing' or 'accept the status quo' — the principle actually requires active assessment of current state, so the correct answer is the one that inspects reality, not the one that avoids work.

How to eliminate wrong answers

Option A is wrong because scrapping and rewriting is the opposite of 'Start where you are' — it discards existing working assets and institutional knowledge. Option C is wrong because assuming compliance based on age is a baseless shortcut that ignores the principle's requirement to actually assess current state. Option D is wrong because commissioning a 200-page historical report is a heavyweight, backward-looking exercise that does not reflect the pragmatic, evidence-based assessment the principle calls for.

Practice this question →
10
Multi-Selecteasy

Which TWO of the following actions best demonstrate the principle 'Focus on value' in an IT governance framework? (Choose two.)

Select 2 answers
A.Eliminating all risk management activities to maximize short-term financial returns at any cost.
B.Measuring the success of a GRC program by the reduction of actual business risk and improved stakeholder trust.
C.Spending 90% of the IT budget on administrative paperwork rather than system security.
D.Prioritizing security investments that protect critical customer data and maintain core revenue-generating value streams.
E.Implementing compliance controls solely because an auditor asked for them, regardless of whether they protect business assets.
AnswersB, D

Measuring GRC success by reduced business risk and improved stakeholder trust ties outcomes directly to value delivered, not activity counts. This satisfies the stem's demand to demonstrate 'Focus on value' by evidencing tangible business benefit rather than compliance outputs alone.

Why this answer

Option B is correct because 'Focus on value' means governance and GRC efforts are judged by outcomes that matter to the business, such as measurable reduction of actual business risk and stronger stakeholder trust, rather than by activity volume or checkbox compliance. Option D is correct because directing security spending toward protecting critical customer data and core revenue-generating value streams aligns controls and investments with the organization's highest-value assets and mission, which is the essence of value-focused governance. The unmarked options fail this principle: A destroys value by eliminating risk management for short-term returns, C misallocates budget to paperwork instead of protecting systems, and E implements controls for auditor appeasement without regard to protecting business assets, which is compliance theater rather than value creation.

Practice this question →
11
MCQhard

An enterprise GRC committee discovers that shadow IT (unapproved SaaS tools) is rampant because the official procurement and compliance review process takes 90 days. To fix this, the committee establishes a 'fast-track' pre-vetted catalog of SaaS tools. How does this solution align with ITIL 4 principles?

A.It applies 'Optimize and automate' by deploying spyware on employee laptops to detect unapproved software.
B.It applies 'Start where you are' by punishing employees who used shadow IT in the past.
C.It eliminates all governance to allow employees to buy whatever software they want.
D.It applies 'Keep it simple and practical' by removing bureaucratic friction while maintaining compliance guardrails through pre-vetting.
AnswerD

A pre-vetted catalogue removes the 90-day bottleneck while retaining compliance guardrails, embodying 'keep it simple and practical' by eliminating bureaucratic waste rather than abandoning control. This directly addresses the shadow IT constraint described in the stem.

Why this answer

Option D is correct because the fast-track pre-vetted catalog directly applies 'keep it simple and practical' — it removes the bureaucratic friction of a 90-day review while preserving compliance guardrails through pre-vetting. Employees get approved tools quickly, and the organization retains control over security, data privacy, and vendor risk. This is a textbook example of simplifying a process without abandoning governance.

Exam trap

The trap is treating shadow IT as a discipline problem solvable by punishment or surveillance, or as a governance problem solvable by eliminating rules — the correct ITIL 4 lens is process simplification that preserves guardrails, and candidates who pick punitive or deregulatory options miss it.

How to eliminate wrong answers

Option A is wrong because deploying spyware to detect unapproved software is a surveillance-heavy, trust-destroying approach that doesn't address the root cause (slow procurement) and violates the spirit of 'optimize and automate' by automating enforcement rather than improving the process. Option B is wrong because punishing past shadow IT users is punitive and backward-looking; 'start where you are' means understanding the current state and improving it, not penalizing people for working around a broken process. Option C is wrong because eliminating all governance creates unacceptable risk — unvetted SaaS tools can introduce data breaches, compliance violations, and uncontrolled costs; the goal is to streamline governance, not abolish it.

Practice this question →
12
Multi-Selecthard

A global financial institution is restructuring its compliance framework to support agile software delivery. Which THREE of the following strategies align with ITIL 4 guiding principles and modern GRC practices? (Choose three.)

Select 3 answers
A.Requiring a physical paper sign-off from the board of directors for every single code commit.
B.Integrating risk and compliance professionals directly into agile scrum teams as active participants.
C.Designing lightweight, risk-based compliance gates that scale according to the business criticality of the application.
D.Eliminating all regulatory oversight and delegating compliance sign-offs entirely to junior developers.
E.Replacing annual monolithic compliance audits with continuous, automated compliance monitoring.
AnswersB, C, E

Embedding risk and compliance specialists within scrum teams satisfies the stem's agile delivery constraint by shifting governance from periodic gatekeeping to continuous, collaborative engagement. This aligns with ITIL 4's collaborate-and-promote-visibility principle, letting compliance expertise shape backlog decisions in real time rather than arriving as late-stage audit findings.

Why this answer

Option B is correct because embedding risk and compliance professionals directly into agile scrum teams as active participants embodies ITIL 4's 'collaborate and promote visibility' and 'think and work holistically' principles, breaking down silos between GRC and delivery so compliance requirements are addressed continuously rather than retrofitted. Option C is correct because lightweight, risk-based compliance gates that scale with the business criticality of the application reflect the 'focus on value' and 'start where you are' principles, applying proportionate controls so low-risk changes move quickly while high-risk systems receive stronger scrutiny. Option E is correct because replacing annual monolithic audits with continuous, automated compliance monitoring aligns with 'progress iteratively with feedback' and modern GRC's shift-left, evidence-as-code approach, enabling real-time detection and remediation instead of point-in-time snapshots.

Option A does not belong because requiring physical board sign-off for every code commit is bureaucratic, manual, and unscalable, contradicting 'keep it simple and practical' and destroying agile flow. Option D does not belong because eliminating all regulatory oversight and delegating sign-offs entirely to junior developers abandons accountability and violates mandatory regulatory obligations in a financial institution, which no ITIL 4 principle or GRC practice endorses.

Practice this question →
13
MCQhard

A multinational corporation is implementing ITIL 4's governance component within its IT organization. The board has approved a new risk appetite statement that permits higher risk-taking in innovation projects but mandates strict risk avoidance for core transactional systems. The IT director must translate this into operational guidance. Which approach best aligns with ITIL 4 governance principles?

A.Establish a tiered risk management framework where innovation projects follow a flexible, value-driven process and core systems follow a strict, compliance-driven process.
B.Maintain the existing risk process but require all risk exceptions to be approved by the board, regardless of project size.
C.Apply a uniform risk management process across all projects to ensure consistency and avoid confusion.
D.Delegate all risk decisions to project managers, allowing them to interpret the risk appetite as they see fit.
AnswerA

This approach directly operationalizes the board's risk appetite by differentiating controls based on system criticality and project type. Innovation projects benefit from agility and tolerance for failure, while core systems require rigorous risk mitigation. ITIL 4 governance emphasizes that controls should be proportionate to risk and aligned with organizational objectives. A tiered framework provides clear guidance, maintains accountability, and enables appropriate risk-taking without compromising essential services.

Why this answer

ITIL 4 governance requires aligning operational practices with strategic direction. The board's differentiated risk appetite necessitates a tiered approach: flexible for innovation, strict for core systems. This translates governance into actionable guidance, balancing risk and reward.

The other options either ignore the nuance, abdicate responsibility, or create inefficiency, failing to reflect the governance principles of direction, control, and value creation.

Exam trap

The trap here is treating governance as a one-size-fits-all mandate or as complete delegation, rather than as a mechanism to translate strategic risk appetite into differentiated, actionable controls.

Practice this question →
14
MCQhard

A global bank is deploying a new AI-driven credit scoring system. The model's decision-making logic is a black box, creating potential regulatory compliance issues under fair lending laws. How should the enterprise apply ITIL guiding principles to address this GRC challenge?

A.Integrate Explainable AI (XAI) techniques, legal compliance reviews, and cross-functional validation into the model deployment lifecycle.
B.Deploy the black-box model immediately and address regulatory complaints only if auditors notice.
C.Outsource the credit scoring process entirely to an unregulated fintech startup.
D.Abandon all machine learning initiatives and return exclusively to manual paper-based scoring.
AnswerA

Explainable AI techniques, legal review and cross-functional validation make the black-box model's logic auditable, satisfying fair lending compliance. This applies ITIL principles of collaboration and feedback, embedding governance controls into the deployment lifecycle rather than bolting them on after release.

Why this answer

Integrating Explainable AI (XAI) techniques, legal compliance reviews, and cross-functional validation into the model deployment lifecycle directly addresses the black-box problem by making decision logic transparent and auditable. This applies ITIL guiding principles like 'Collaborate and promote visibility' and 'Think and work holistically' to a GRC challenge involving fair lending regulations.

Exam trap

The trap is treating AI deployment as a purely technical exercise; candidates may overlook that GRC requires embedding compliance, explainability, and cross-functional review into the lifecycle rather than bolting them on afterward.

How to eliminate wrong answers

Option B is wrong because deploying a black-box model and waiting for auditors to notice is a reactive, non-compliant approach that exposes the bank to regulatory penalties and reputational damage. Option C is wrong because outsourcing to an unregulated fintech startup does not absolve the bank of regulatory responsibility and likely worsens compliance risk. Option D is wrong because abandoning all machine learning is a disproportionate overreaction that forfeits competitive advantage instead of managing the risk.

Practice this question →
15
MCQeasy

An IT director wants to use the 'Progress iteratively with feedback' principle when implementing a new ISO 37001 Anti-Bribery management system. What is the most appropriate first action?

A.Roll out the anti-bribery policy to all global offices simultaneously on day one.
B.Wait for external auditors to mandate specific policy sections before making any changes.
C.Draft a 500-page governance handbook before engaging any stakeholders.
D.Implement the policy in a single department first, gather feedback, and refine before expanding.
AnswerD

Piloting in one department creates a controlled feedback loop, letting the organisation refine anti-bribery controls before wider rollout. This directly satisfies the principle's requirement to break work into manageable iterations, each informed by real feedback, rather than attempting a single organisation-wide implementation that risks unvalidated controls and undetected failures.

Why this answer

Option D is correct because 'progress iteratively with feedback' means starting small, learning from real-world implementation, and refining before scaling. Implementing in a single department first creates a controlled pilot where feedback can be gathered, issues identified, and the policy adjusted before broader rollout — reducing risk and increasing adoption across the organization.

Exam trap

The trap is equating thoroughness with big-bang, comprehensive rollouts or exhaustive documentation — candidates who think 'more upfront planning equals better implementation' miss that 'progress iteratively with feedback' explicitly favors small starts and learning loops.

How to eliminate wrong answers

Option A is wrong because rolling out to all global offices simultaneously on day one is the opposite of iterative — it's a big-bang deployment that leaves no room for feedback, no opportunity to correct course, and maximum blast radius if something goes wrong. Option B is wrong because waiting for external auditors to mandate specific policy sections is reactive and passive; it abdicates ownership of the anti-bribery program and delays progress indefinitely. Option C is wrong because drafting a 500-page handbook before engaging stakeholders is analysis paralysis — it front-loads documentation over learning, ignores feedback, and likely produces a policy that doesn't fit operational reality.

Practice this question →
16
MCQmedium

An organization is evaluating its vendor risk management process using the 'Optimize and automate' guiding principle. Manual spreadsheet tracking of third-party compliance certificates has led to missed renewals. Which tool configuration best applies this principle?

A.Switch from Excel spreadsheets to a shared Microsoft Word document.
B.Hire two additional compliance analysts to manually check spreadsheets daily.
C.Implement an automated vendor risk portal with automated alerting for certificate expirations and integrated scoring.
D.Eliminate vendor risk reviews to speed up procurement.
AnswerC

An automated vendor risk portal records each certificate with its expiry date, alerts owners well ahead of renewal, escalates if nothing happens, and scores vendors consistently, removing the manual checking that caused missed renewals. That is the 'optimise and automate' principle: simplify the process, then automate the repetitive, rule-based parts, so people focus on judgement work such as assessing high-risk suppliers.

Why this answer

The 'Optimize and automate' guiding principle in DPI (Digital and Process Innovation) emphasizes using technology to streamline and automate repetitive, error-prone tasks. An automated vendor risk portal with alerting and integrated scoring directly applies this by replacing manual spreadsheet tracking with automated certificate expiration alerts and continuous risk scoring, reducing missed renewals and human error. This aligns with the principle's goal of improving efficiency, accuracy, and scalability in vendor risk management.

Exam trap

The trap here is confusing 'optimize and automate' with simply reducing effort or cost, leading candidates to choose options that either replace one manual tool with another (A) or add manual labor (B), rather than implementing true automation that addresses the root cause.

How to eliminate wrong answers

Option A is wrong because switching from Excel to Word does not automate anything; it merely changes the manual tool and likely worsens data management, as Word lacks structured data handling and automation capabilities. Option B is wrong because hiring more analysts to manually check spreadsheets increases labor costs and does not address the root cause of human error; it is a 'people' solution, not an automation solution, and contradicts the 'Optimize and automate' principle. Option D is wrong because eliminating vendor risk reviews removes necessary risk controls entirely, which is not optimization but abandonment of due diligence, and would increase organizational risk exposure.

Practice this question →
17
Multi-Selectmedium

An IT governance board is evaluating how to apply 'Optimize and automate' to its vendor risk assessment process. Which THREE of the following initiatives represent correct applications of this principle? (Choose three.)

Select 3 answers
A.Configuring automated email reminders and escalation workflows for overdue vendor security certificates.
B.Using API integrations between Jira and ServiceNow to automatically sync compliance remediation tasks.
C.Implementing automated vendor risk scoring based on continuous threat intelligence feeds.
D.Firing all risk analysts and letting vendors grade their own security compliance without verification.
E.Replacing all computers with manual typewriters to eliminate software vulnerabilities.
AnswersA, B, C

Automated reminders and escalation workflows replace manual chasing of overdue vendor certificates, removing repetitive human effort while standardising the process. This directly applies 'Optimize and automate' by streamlining an existing workflow before considering deeper automation, satisfying the principle's intent for the vendor risk assessment process.

Why this answer

Option A is correct because automating reminders and escalation workflows for overdue vendor security certificates applies 'Optimize and automate' by removing manual follow-up and enforcing consistent, timely governance actions. Option B is correct because API integrations between Jira and ServiceNow automatically synchronize compliance remediation tasks, eliminating duplicate manual entry and improving workflow efficiency across tools. Option C is correct because automated vendor risk scoring driven by continuous threat intelligence feeds replaces periodic manual assessments with timely, data-driven, repeatable risk evaluation.

Option D is not correct because abandoning verification and letting vendors self-grade removes necessary controls and oversight rather than optimizing the process. Option E is not correct because replacing computers with typewriters degrades capability and does not automate or improve the vendor risk assessment workflow.

Exam trap

The trap here is conflating automation with elimination of human roles or regression to manual methods, which are extreme misinterpretations of 'Optimize and automate'.

Practice this question →
18
MCQeasy

An organization is launching a new DevOps pipeline and wants to ensure that all team members feel psychological safety and ownership while complying with corporate audit standards. Which guiding principle should the release manager emphasize first to balance innovation with structure?

A.Collaborate and promote visibility
B.Think and work holistically
C.Optimize and automate
D.Focus on value
AnswerA

Collaborate and promote visibility directly addresses psychological safety by making work, decisions and impediments transparent across the team, which builds the ownership the stem requires. It also satisfies corporate audit standards, since visible artefacts, logs and approvals create the traceable evidence auditors demand without imposing rigid stage gates that would stifle innovation.

Why this answer

Option A is correct because 'Collaborate and promote visibility' directly supports psychological safety and ownership by encouraging open communication, shared decision-making, and transparency across teams. In a DevOps context, this principle ensures that audit requirements are visible to everyone and that teams collaborate with compliance rather than treating it as a separate gate. This balance allows innovation to proceed with structure because audit standards become part of the shared workflow instead of an external blocker.

Exam trap

The trap is confusing 'Focus on value' or 'Think and work holistically' as the first principle to emphasize when the question specifically mentions psychological safety and ownership, which are directly tied to collaboration and visibility.

How to eliminate wrong answers

Option B is wrong because 'Think and work holistically' focuses on understanding the entire system and its interactions, which is important but does not specifically address psychological safety or ownership in the way collaboration and visibility do. Option C is wrong because 'Optimize and automate' is about efficiency and eliminating waste, which can actually undermine psychological safety if applied too early without trust and transparency. Option D is wrong because 'Focus on value' is about aligning work to business outcomes, but it does not directly create the safe, transparent environment needed for teams to feel ownership while meeting audit standards.

Practice this question →
19
Multi-Selectmedium

An IT organization is embedding the ITIL 4 guiding principle 'Collaborate and promote visibility' into its GRC practices. The compliance manager wants to ensure that risk and compliance information is shared effectively across teams, including development, operations, and security. Which TWO actions best demonstrate this principle in a GRC context? (Choose two.)

Select 2 answers
A.Restrict access to compliance reports to senior management to prevent misinterpretation by technical teams.
B.Document all risk decisions in a secure repository accessible only to the risk management team, to maintain confidentiality.
C.Hold regular cross-functional risk review meetings where development, operations, and security jointly assess and prioritize risks.
D.Create a centralized GRC dashboard that provides real-time visibility into risk status, compliance posture, and audit findings for all stakeholders.
E.Assign a single risk owner who works independently to avoid conflicting opinions and streamline decision-making.
AnswersC, D

Cross-functional meetings bring diverse perspectives together, promoting collaboration and shared understanding of risks. They make risk information visible across teams and enable collective decision-making. This practice embodies 'Collaborate and promote visibility' by breaking down departmental barriers and ensuring that risk assessments consider operational, security, and development impacts. It also builds ownership and accountability for risk treatment across the organization.

Why this answer

The 'Collaborate and promote visibility' principle requires breaking down silos and ensuring that relevant information is shared. A centralized dashboard and cross-functional risk reviews both achieve this by making risk and compliance data accessible and fostering joint decision-making. The other options limit visibility or collaboration, which contradicts the principle and hinders effective GRC.

Exam trap

The trap here is equating confidentiality with limiting access, rather than recognizing that appropriate visibility and collaboration are essential for effective risk management.

Practice this question →
20
MCQmedium

A multinational corporation is consolidating its regional GRC tools into a single global instance of ServiceNow GRC. The project team attempts to migrate all 5,000 legacy control procedures simultaneously on a single weekend, resulting in massive data corruption and audit failures. Which guiding principle was violated?

A.Focus on value
B.Keep it simple and practical
C.Progress iteratively with feedback
D.Collaborate and promote visibility
AnswerC

Migrating all 5,000 controls in one weekend ignores incremental delivery and validation. Progress iteratively with feedback requires small batches, testing, and learning between iterations, which would have surfaced corruption early instead of causing mass audit failure.

Why this answer

The scenario describes attempting a massive, all-at-once migration of 5,000 control procedures in a single weekend, which directly violates the 'Progress iteratively with feedback' principle. This ITIL 4 guiding principle advocates breaking work into smaller, manageable iterations so that feedback can be gathered and course corrections made before scaling up. Migrating everything simultaneously eliminates any opportunity for validation, rollback, or learning between batches, which is exactly why corruption and audit failures occurred.

Exam trap

DPI often tests the distinction between the seven ITIL 4 guiding principles by embedding a scenario where the failure is clearly about batching or sequencing — candidates who focus on 'collaboration' or 'simplicity' miss that the core violation is the absence of iterative delivery with feedback.

How to eliminate wrong answers

Option A is wrong because 'Focus on value' concerns aligning work to what the customer or business actually needs, not the sequencing or batching of migration work. Option B is wrong because 'Keep it simple and practical' is about eliminating unnecessary complexity in processes and solutions, not about the size or cadence of migration batches. Option D is wrong because 'Collaborate and promote visibility' is about involving stakeholders and sharing information, which was not the failure mode here — the failure was the lack of incremental delivery and feedback loops.

Practice this question →
21
MCQhard

An enterprise is deploying a Zero Trust Architecture (ZTA). Rather than restricting access based solely on corporate network perimeter, ZTA verifies every user and device continuously. How does this architectural shift embody 'Think and work holistically' in the context of GRC?

A.It delegates all security perimeter decisions entirely to end users.
B.It assumes internal network traffic is inherently trustworthy and secure.
C.It focuses exclusively on physical data center security.
D.It integrates identity, device telemetry, network context, and data classification into an end-to-end continuous risk evaluation model.
AnswerD

Continuous verification demands correlating identity, device health, network signals and data sensitivity rather than trusting a perimeter. This end-to-end risk model satisfies Zero Trust's requirement to evaluate every access request holistically, unifying governance, risk and compliance controls across previously siloed domains.

Why this answer

Zero Trust Architecture embodies 'Think and work holistically' by integrating identity, device telemetry, network context, and data classification into a single continuous risk evaluation model rather than treating security domains in isolation. This end-to-end view recognizes that risk emerges from the interaction of users, devices, networks, and data, not from any single layer. In GRC terms, it aligns controls across the whole system instead of relying on perimeter assumptions.

Exam trap

The trap is confusing ZTA with perimeter security or user-delegated trust — candidates who retain the 'trusted internal network' mental model pick options that contradict ZTA's core continuous-verification premise.

How to eliminate wrong answers

Option A is wrong because ZTA does not delegate security decisions to end users — it centralizes policy enforcement through a policy decision point and policy enforcement points. Option B is wrong because ZTA explicitly rejects the assumption that internal network traffic is trustworthy; that assumption is the hallmark of perimeter-based security, which ZTA replaces. Option C is wrong because ZTA is not limited to physical data center security — it spans cloud, remote work, and hybrid environments, focusing on identity and context rather than physical location.

Practice this question →
22
Multi-Selecteasy

Which TWO of the following indicators suggest an organization is failing to apply 'Think and work holistically'? (Choose two.)

Select 2 answers
A.Incident management post-mortems involve all stakeholder groups to determine root causes.
B.Cloud migration strategies take into account cost, security, operational readiness, and business value simultaneously.
C.The security team creates impenetrable firewalls without consulting the usability needs of customer-facing application teams.
D.Compliance audits consistently surprise IT teams because compliance officers never review operational workflows before issuing findings.
E.The organization maintains regular communication channels between legal, HR, and IT departments.
AnswersC, D

Siloed security hardening that ignores customer-facing usability needs shows optimisation of one part at the expense of the whole system, the opposite of holistic thinking. The firewall team optimises its own risk metrics while degrading end-to-end service value delivered by application teams.

Why this answer

Option C is correct because the security team optimizing firewalls in isolation, without considering customer-facing application usability, demonstrates siloed thinking rather than understanding how security interacts with the whole system of applications, users, and business outcomes. Option D is correct because compliance officers issuing findings without reviewing operational workflows shows a failure to understand the interconnectedness of compliance requirements and day-to-day IT operations, producing avoidable surprises. By contrast, option A reflects holistic thinking since post-mortems include all stakeholder groups to find root causes across the system, option B is holistic because cloud migration weighs cost, security, operational readiness, and business value together, and option E is holistic because it fosters cross-departmental communication among legal, HR, and IT.

Exam trap

DPI often tests the ability to distinguish between indicators of holistic thinking (collaboration, cross-functional involvement) and siloed behavior (lack of consultation, surprise audits); candidates must recognize that the latter are failures.

Practice this question →
23
MCQeasy

An IT team is attempting to map out all enterprise risks at once, causing paralysis by analysis. Which ITIL 4 guiding principle should be used to get the risk assessment project moving again?

A.Keep it simple and practical
B.Collaborate and promote visibility
C.Optimize and automate
D.Think and work holistically
AnswerA

Keep it simple and practical counters paralysis by analysis: start with a minimum viable risk assessment, iterate, and discard steps that add no value. This satisfies the stem's constraint of mapping all enterprise risks at once by narrowing scope progressively, so the team resumes progress instead of attempting exhaustive completeness upfront.

Why this answer

When a team is paralyzed by trying to map every enterprise risk at once, the 'keep it simple and practical' principle directs them to start with a manageable scope and iterate. Option A applies this principle by breaking the overwhelming task into practical, incremental steps.

Exam trap

DPI often tests the confusion between guiding principles that sound relevant (collaborate, optimize, think holistically) and the one that directly addresses over-scoping, tempting candidates to pick a principle that would actually worsen the paralysis.

How to eliminate wrong answers

Option B is wrong because collaboration and visibility address stakeholder engagement and transparency, not the paralysis caused by over-scoping. Option C is wrong because optimize and automate applies to improving and streamlining existing workflows, not to reducing the initial scope of an analysis effort. Option D is wrong because thinking and working holistically encourages considering the whole system, which would worsen rather than resolve the paralysis by analysis.

Practice this question →
24
MCQeasy

A hospital's IT department is revising its change management process to align with ITIL 4's 'Start where you are' principle. The current process is heavily bureaucratic, requiring multiple approvals for every change, including minor ones. The team wants to streamline without losing control. What should they do first?

A.Benchmark against other hospitals and copy their change management process exactly, as they have already solved similar issues.
B.Implement a new, industry-standard change management tool that automates approvals and enforces best practices.
C.Eliminate all approvals for minor changes immediately to speed up the process, then add controls back if problems arise.
D.Conduct a value stream mapping exercise to understand the current change process, identify bottlenecks, and determine which controls are essential.
AnswerD

Value stream mapping helps visualize the current process, revealing where delays and unnecessary approvals occur. This aligns with 'Start where you are' by using existing data and observations to inform improvements. It allows the team to identify which controls are truly necessary for patient safety and compliance, and which can be streamlined. This evidence-based approach ensures changes are targeted and effective, rather than adopting a generic solution.

Why this answer

The 'Start where you are' principle requires assessing the current state before making changes. Value stream mapping provides a clear picture of the existing change process, highlighting waste and essential controls. This enables targeted improvements that streamline without compromising safety.

The other options either skip assessment, remove controls recklessly, or ignore organizational context, all of which contradict the principle.

Exam trap

The trap here is thinking that 'Start where you are' means immediately adopting new tools or copying others, rather than first understanding and leveraging the existing process.

Practice this question →
25
MCQmedium

A financial institution uses Archer GRC for regulatory compliance tracking. The compliance team operates in a strict silo from the software development teams using Jira. Which guiding principle is most directly being violated by this organizational structure?

A.Start where you are
B.Collaborate and promote visibility
C.Focus on value
D.Keep it simple and practical
AnswerB

Siloing Archer GRC compliance work from Jira development teams blocks information flow and shared understanding across groups. The collaborate and promote visibility principle requires breaking down silos, involving stakeholders, and sharing knowledge so compliance and delivery teams align on regulatory obligations and risks.

Why this answer

The scenario describes a compliance team and development teams working in isolated silos with no interaction, which directly contradicts the 'Collaborate and promote visibility' principle. This guiding principle emphasizes breaking down silos, sharing information, and working together across teams to achieve better outcomes. Archer GRC and Jira integration requires cross-team collaboration to be effective.

Exam trap

The trap here is confusing 'Collaborate and promote visibility' with 'Focus on value' — candidates may think the silo is a value problem, but the core issue is the lack of cross-team collaboration and information sharing.

How to eliminate wrong answers

Option A is wrong because 'Start where you are' relates to leveraging existing resources and capabilities rather than building everything from scratch, not about organizational silos. Option C is wrong because 'Focus on value' concerns understanding what outcomes matter to customers and the business, not specifically about team collaboration structures. Option D is wrong because 'Keep it simple and practical' advocates for minimizing complexity in processes and tools, which is unrelated to the silo problem described.

Practice this question →
26
MCQmedium

A software development organization is integrating static application security testing (SAST) into GitHub Actions. Developers complain that false positives block builds daily, leading them to disable the security checks. How should the security team apply ITIL 4 principles to correct this?

A.Mandate immediate termination for developers who disable security checks.
B.Disable SAST checks permanently to keep builds fast.
C.Move SAST checks to a manual review that occurs once a year.
D.Iteratively tune SAST rule sets in collaboration with developers to minimize false positives while maintaining vulnerability detection.
AnswerD

Iteratively tuning SAST rule sets with developers directly addresses the false-positive constraint driving build blocks and check disablement. This embodies ITIL 4's progress iteratively with feedback and collaborate and promote visibility principles, reducing noise without sacrificing vulnerability detection, so builds pass and developers retain trust in the security gates.

Why this answer

False positives causing bypasses mean the rules are impractical or poorly tuned. Tuning rules iteratively with developer feedback applies 'Progress iteratively with feedback' and 'Keep it simple and practical'.

Practice this question →
27
Multi-Selecthard

A CISO is evaluating why security compliance failures continue to occur despite extensive policies. According to ITIL 4 guiding principles and GRC best practices, which THREE underlying root causes should the CISO investigate? (Choose three.)

Select 3 answers
A.The organization may have automated too many security controls, leaving zero room for human error.
B.Security and compliance teams operate in strict silos, failing to collaborate with business operations ('Collaborate and promote visibility').
C.Policies may be overly bureaucratic and impractical, causing employees to create workarounds and shadow IT ('Keep it simple and practical').
D.Risk management policies may be disconnected from customer and business value streams, making them appear as arbitrary roadblocks ('Focus on value').
E.The CISO may have started their assessment by looking at the current state too thoroughly.
AnswersB, C, D

Siloed security and compliance teams cannot surface the operational realities that drive non-compliance, so failures persist unseen. The 'collaborate and promote visibility' principle directly addresses this root cause by requiring shared information and cross-functional cooperation, exposing where policies break down in practise.

Why this answer

Option B is correct because ITIL 4's 'Collaborate and promote visibility' principle warns that siloed security and compliance teams that do not work with business operations create blind spots, misaligned controls, and unenforced policies, which directly explains persistent compliance failures. Option C is correct because 'Keep it simple and practical' means policies that are overly bureaucratic and impractical drive employees to workarounds and shadow IT, so the controls exist on paper but are bypassed in practice, producing compliance failures. Option D is correct because 'Focus on value' requires risk management to be tied to customer and business value streams; when policies appear as arbitrary roadblocks disconnected from value, the business resists or ignores them, undermining compliance.

Option A is not correct because ITIL 4 and GRC best practices do not treat eliminating human error through excessive automation as a root cause of compliance failure; over-automation is not the stated problem, and zero tolerance for human error is neither realistic nor a guiding principle. Option E is not correct because thoroughly examining the current state is a sound starting point in ITIL 4's 'Start where you are' principle, not a root cause of compliance failures.

Practice this question →
28
MCQeasy

An IT service manager is reviewing the incident management process to ensure GDPR compliance during data breach reporting. The manager cuts out three redundant management approval steps that added no legal value. Which guiding principle is being applied?

A.Optimize and automate
B.Keep it simple and practical
C.Start where you are
D.Think and work holistically
AnswerB

Removing redundant approval steps that added no legal value streamlines the process while preserving GDPR breach-reporting obligations. This directly applies 'Keep it simple and practical' by eliminating waste rather than adding complexity to achieve the same compliant outcome.

Why this answer

The guiding principle 'Keep it simple and practical' from ITIL 4 focuses on simplifying work processes by eliminating non-value-adding steps. Here, the manager removed three redundant management approval steps that added no legal value to GDPR breach reporting, directly applying this principle. This ensures the incident management process is streamlined and efficient while still meeting compliance requirements.

Exam trap

DPI often tests the subtle differences between ITIL 4 guiding principles, and candidates may confuse 'Keep it simple and practical' with 'Optimize and automate' when the scenario involves process improvement, but the key is whether the action is simplification or automation.

How to eliminate wrong answers

Option A is wrong because 'Optimize and automate' emphasizes using technology to optimize workflows and automate tasks, but the scenario involves removing manual steps, not automating them. Option C is wrong because 'Start where you are' encourages leveraging existing resources and processes rather than starting from scratch, which is not the focus here. Option D is wrong because 'Think and work holistically' involves understanding how all parts of an organization work together as a whole, which is not the primary principle applied when simplifying a specific process.

Practice this question →
29
Multi-Selecteasy

Which TWO of the following scenarios demonstrate a failure to apply 'Progress iteratively with feedback'? (Choose two.)

Select 2 answers
A.A project manager breaks down a large ISO certification project into monthly milestones with stakeholder reviews.
B.A bank attempts to migrate all 100 legacy core banking systems to a new cloud GRC platform in a single weekend.
C.A development team releases minor compliance updates to production every week and adjusts rules based on user feedback.
D.An enterprise spends 24 months writing a massive 800-page cybersecurity policy before testing any controls in practice.
E.An IT director conducts regular monthly retrospectives with the compliance team to refine approval workflows.
AnswersB, D

A single-weekend cutover of 100 systems is a big-bang release with no incremental delivery or feedback loop. Iterative progress requires phased migration, pilot validation and course correction between waves; compressing everything into one change window eliminates the feedback that would surface integration failures early.

Why this answer

Option B is correct because attempting to migrate all 100 legacy core banking systems to a new cloud GRC platform in a single weekend is a classic 'big bang' approach that ignores iterative delivery and feedback; it concentrates all risk into one release with no opportunity to learn, validate, or adjust between increments. Option D is correct because spending 24 months writing an 800-page cybersecurity policy before testing any controls is a purely sequential, waterfall-style effort that produces no working feedback loop; without piloting or validating controls early, the organization cannot incorporate lessons learned until far too late. Options A, C, and E all reflect the principle properly: A uses monthly milestones with stakeholder reviews, C delivers weekly compliance updates and adjusts based on user feedback, and E runs monthly retrospectives to refine approval workflows, each creating short iterations with explicit feedback mechanisms.

Exam trap

The trap is that options describing structured milestones or retrospectives can look iterative, but the exam tests whether feedback is actually used to adjust work—big-bang or long-delay efforts are the tell.

Practice this question →
30
MCQhard

An internal audit reveals that privileged access management (PAM) policies are frequently bypassed by systems administrators during critical outages. The security team wants to enforce rigid automated lockdowns. How should the 'Collaborate and promote visibility' and 'Think and work holistically' principles be combined to address this?

A.Engage system administrators and auditors together to design transparent, auditable 'break-glass' emergency access workflows.
B.Outsource all outage troubleshooting to external vendors who are subject to PAM controls.
C.Suspend all PAM controls permanently so administrators can never be blocked during an outage.
D.Implement immediate automated termination for any admin who bypasses PAM, regardless of outage severity.
AnswerA

Engaging administrators and auditors jointly produces break-glass workflows that remain transparent and auditable, directly satisfying the audit's finding that PAM policies are bypassed during outages. This combines visibility with holistic thinking: rather than imposing rigid lockdowns that administrators would circumvent under pressure, the design legitimises emergency access, preserving both operational continuity and auditability.

Why this answer

Engaging system administrators and auditors together to design transparent, auditable 'break-glass' emergency access workflows combines 'Collaborate and promote visibility' (bringing stakeholders together for shared understanding) with 'Think and work holistically' (addressing the entire access lifecycle, including emergencies). This produces a solution that respects operational urgency while maintaining auditability and control.

Exam trap

The trap is framing the problem as a binary choice between security controls and operational speed; candidates may pick a rigid enforcement option or a permissive one instead of the collaborative, holistic break-glass design.

How to eliminate wrong answers

Option B is wrong because outsourcing outage troubleshooting to external vendors does not solve the internal PAM bypass problem and may introduce new access risks. Option C is wrong because permanently suspending PAM controls eliminates all security oversight, creating an unacceptable risk posture. Option D is wrong because immediate automated termination for any bypass is a zero-tolerance policy that ignores the legitimate need for emergency access during critical outages and would deter necessary action.

Practice this question →
31
MCQhard

During a high-severity incident review in Jira Service Management, the incident commander realizes that strict adherence to an outdated change management compliance policy prevented a rapid hotfix. How should the 'Think and work holistically' principle be applied to resolve this GRC conflict?

A.Bypass the change advisory board (CAB) entirely for all future incidents without updating the formal risk policy.
B.Escalate the compliance officer's authority to veto any emergency changes to protect system stability.
C.Redesign the end-to-end value stream by integrating risk evaluation criteria directly into automated emergency change models.
D.Outsource incident response to a third party to avoid internal policy conflicts.
AnswerC

Holistic thinking examines the whole value stream rather than isolated silos. Embedding risk evaluation into automated emergency change models removes the compliance bottleneck while preserving governance, resolving the GRC conflict by redesigning the end-to-end flow instead of merely relaxing or enforcing the outdated policy.

Why this answer

Redesigning the end-to-end value stream by integrating risk evaluation criteria directly into automated emergency change models applies holistic thinking by addressing the root cause: the outdated policy that conflicts with rapid incident response. This approach balances compliance and speed by embedding risk assessment into the change process, enabling fast hotfixes while maintaining governance. It resolves the GRC conflict by aligning the value stream with both operational needs and risk management.

Exam trap

DPI often tests the misconception that compliance and speed are mutually exclusive; the holistic approach is to integrate risk evaluation into automated processes rather than bypassing or escalating, which are short-sighted fixes.

How to eliminate wrong answers

Option A is wrong because bypassing the CAB entirely without updating policy creates risk and non-compliance, and does not resolve the underlying conflict. Option B is wrong because escalating the compliance officer's authority to veto emergency changes would further hinder rapid response and exacerbate the conflict. Option D is wrong because outsourcing incident response avoids internal policy conflicts but does not address the root cause and may introduce new risks and costs.

Practice this question →
32
Multi-Selectmedium

An enterprise GRC committee is reviewing its risk management strategy. Which TWO practices effectively integrate ITIL 4 guiding principles into risk governance? (Choose two.)

Select 2 answers
A.Treating risk management as an isolated, bureaucratic legal function completely separate from IT operations.
B.Hiding audit findings from development teams to prevent panic and maintain morale.
C.Mandating a 12-month manual approval process for all minor software patches to ensure zero risk.
D.Aligning risk appetites directly with the organization's key value streams and customer outcomes.
E.Embedding automated compliance checks and risk assessments directly into CI/CD deployment pipelines.
AnswersD, E

Aligning risk appetite with value streams and customer outcomes operationalises ITIL 4's "focus on value" principle, ensuring risk decisions are judged by their contribution to stakeholder value rather than isolated control metrics. This satisfies the stem's integration requirement by embedding risk governance within the organisation's actual service delivery pathways.

Why this answer

Option D is correct because ITIL 4's guiding principles include 'focus on value' and 'collaborate and promote visibility,' so aligning risk appetite with key value streams and customer outcomes ensures risk governance directly supports what the organization delivers to customers rather than existing as an abstract control exercise. Option E is correct because embedding automated compliance checks and risk assessments into CI/CD pipelines embodies the principles of 'progress iteratively with feedback' and 'optimize and automate,' enabling continuous, fast risk evaluation at the point of change instead of slow manual gates. Option A is wrong because isolating risk management from IT operations violates 'collaborate and promote visibility' and 'think and work holistically,' which require integrated, cross-functional risk ownership.

Option B is wrong because hiding audit findings contradicts 'collaborate and promote visibility' and 'keep it simple and practical,' and it undermines transparency and continual improvement. Option C is wrong because a 12-month manual approval for minor patches violates 'progress iteratively with feedback,' 'optimize and automate,' and 'start where you are,' and it does not achieve zero risk while destroying flow and value delivery.

Exam trap

The trap is selecting options that sound like 'strong governance' (isolated legal function, lengthy approvals, hiding findings) when ITIL 4 principles actually reward integration, transparency, proportionality, and automation — candidates must distinguish bureaucratic control from principled governance.

Practice this question →
33
MCQhard

A Chief Information Security Officer (CISO) is establishing a risk appetite statement. Business unit leaders are pushing back, claiming the security policies violate 'Focus on value' by slowing down revenue-generating features. How can the CISO reconcile value creation with risk protection using ITIL 4 concepts?

A.Delegate risk appetite definitions entirely to software developers.
B.Transfer all risk to cyber insurance carriers and remove internal security controls.
C.Align risk thresholds directly with the organization's specific value streams, treating risk management as an enabler of secure value co-creation.
D.Enforce strict compliance controls uniformly regardless of business impact to guarantee zero security breaches.
AnswerC

Tying risk thresholds to specific value streams makes protection proportionate to each stream's value contribution, so security enables rather than blocks co-creation. This directly resolves the stem's tension between 'Focus on value' and risk appetite.

Why this answer

ITIL 4's 'focus on value' principle does not mean ignoring risk; it means co-creating value with stakeholders, which requires managing risk within value streams. Option C aligns risk thresholds with specific value streams, positioning risk management as an enabler of secure value co-creation rather than a blocker.

Exam trap

DPI often tests the misconception that 'focus on value' means prioritizing speed over security, tempting candidates to choose options that either eliminate controls or enforce uniform strict compliance instead of aligning risk with value streams.

How to eliminate wrong answers

Option A is wrong because delegating risk appetite entirely to developers abdicates governance responsibility and produces inconsistent, unmanaged risk exposure. Option B is wrong because transferring all risk to insurers and removing internal controls is neither feasible nor sound; insurance cannot cover reputational, regulatory, and operational damage. Option D is wrong because uniform strict controls regardless of business impact ignore the 'focus on value' and 'progress iteratively' principles, creating friction without proportional benefit.

Practice this question →
34
MCQhard

An enterprise risk management (ERM) framework requires annual risk assessments across 500 IT services. The process takes 6 months, rendering the output obsolete by completion. Which ITIL 4 principle-driven strategy resolves this GRC flaw?

A.Conduct risk assessments only when a severe regulatory fine is issued.
B.Hire 10 more risk analysts to complete the annual spreadsheets in 3 weeks.
C.Replace annual monolithic risk reviews with continuous, automated risk monitoring integrated into CI/CD pipelines.
D.Abolish the ERM framework and rely entirely on intuition during major incidents.
AnswerC

Continuous automated monitoring replaces the six-month annual cycle, so risk data reflects current state rather than becoming obsolete before completion. Embedding checks into CI/CD pipelines satisfies the ERM requirement for timely, accurate risk assessment across 500 services.

Why this answer

Option C is correct because it applies the ITIL 4 principles of 'progress iteratively with feedback' and 'optimize and automate' — replacing a 6-month annual monolithic review with continuous, automated risk monitoring integrated into CI/CD pipelines keeps risk data current and actionable. This directly resolves the GRC flaw of obsolete output by making risk assessment a real-time, embedded practice rather than a periodic snapshot.

Exam trap

DPI often tests whether candidates apply ITIL 4 guiding principles (especially 'progress iteratively with feedback' and 'optimize and automate') to GRC problems, and whether they recognize that scaling a broken process (more analysts, faster spreadsheets) is not a fix.

How to eliminate wrong answers

Option A is wrong because conducting risk assessments only after a regulatory fine is reactive, not proactive, and violates the ITIL 4 principle of 'focus on value' by letting risk accumulate until it materializes. Option B is wrong because hiring more analysts to complete the same annual spreadsheet faster treats the symptom (speed) rather than the root cause (monolithic, point-in-time assessment), and the output still becomes obsolete. Option D is wrong because abolishing the ERM framework and relying on intuition eliminates governance entirely, which is the opposite of what a GRC flaw requires — it increases risk rather than resolving it.

Practice this question →
35
MCQeasy

When conducting a risk assessment for a new cloud migration project, the project manager lists all potential failure points without prioritizing them, leading to decision fatigue. Which guiding principle should be applied to prioritize the risks?

A.Focus on value
B.Optimize and automate
C.Start where you are
D.Collaborate and promote visibility
AnswerA

Focus on value directs prioritisation toward risks that most threaten valuable outcomes, rather than treating every failure point equally. This resolves the decision fatigue caused by unranked risks, concentrating assessment effort where it protects value.

Why this answer

When a risk list is unprioritized and causing decision fatigue, the guiding principle to apply is 'focus on value.' This principle directs the team to prioritize work — including risk mitigation — based on what delivers the most value and what most threatens that value. By assessing risks in terms of their potential impact on value delivery, the project manager can rank them and focus attention where it matters most.

Exam trap

DPI often tests the misconception that any guiding principle can apply to any situation, tempting candidates to choose a principle that sounds relevant (like 'collaborate and promote visibility' for risk discussions) instead of the one that specifically addresses prioritization by value.

How to eliminate wrong answers

Option B is wrong because 'optimize and automate' is about making processes efficient and using technology to reduce manual effort — it does not address how to prioritize risks. Option C is wrong because 'start where you are' is about leveraging existing resources, capabilities, and data rather than building from scratch — it does not provide a prioritization lens. Option D is wrong because 'collaborate and promote visibility' is about working across boundaries and making work visible — while useful for risk identification, it does not tell you how to rank risks when facing decision fatigue.

Practice this question →
36
MCQmedium

A company's internal audit department issues 200 findings per year, but IT can only remediate 20 due to resource constraints. The audit findings pile up year over year, creating massive regulatory exposure. How should IT and audit apply 'Focus on value' and 'Keep it simple and practical' to resolve this?

A.Ignore all future audit reports and operate without internal controls.
B.Jointly prioritize findings based on actual business risk and critical value stream impact, tackling remediation in manageable batches.
C.Hire 50 temporary auditors to write more findings.
D.Outsource audit remediation to an unvetted offshore contractor.
AnswerB

Joint risk-based triage lets audit and IT concentrate scarce remediation capacity on findings threatening critical value streams, rather than chasing volume. Batching makes progress practical and visible, directly satisfying both 'Focus on value' and 'Keep it simple and practical' while reducing accumulated regulatory exposure.

Why this answer

The correct answer is B because it applies 'Focus on value' by prioritizing findings based on business risk and value stream impact, and 'Keep it simple and practical' by tackling remediation in manageable batches. This approach ensures that limited resources are used effectively to address the most critical issues first, reducing regulatory exposure without overwhelming IT.

Exam trap

DPI often tests the application of multiple principles together, and candidates may focus on one principle and ignore the other; the trap is thinking that 'Focus on value' means only doing high-value items, but it must be combined with 'Keep it simple and practical' to make progress.

How to eliminate wrong answers

Option A is wrong because ignoring audit reports and operating without controls increases risk and violates governance. Option C is wrong because hiring more auditors to write more findings does not address the remediation backlog and wastes resources. Option D is wrong because outsourcing to an unvetted contractor introduces additional risks and does not ensure value or simplicity.

Practice this question →
37
MCQmedium

A multinational enterprise is updating its GRC framework in ServiceNow GRC to incorporate ITIL 4 guiding principles. The risk manager notices that compliance policies often delay agile software deployments. Which approach best applies the 'Keep it simple and practical' principle to this bottleneck?

A.Delegate all risk management decisions entirely to the software development leads.
B.Conduct a 3-month comprehensive audit of all historical agile deployments before releasing new code.
C.Design lightweight, automated compliance checks embedded directly within the CI/CD pipeline.
D.Remove all compliance gates for agile teams to maximize deployment speed.
AnswerC

Embedding lightweight automated checks in the CI/CD pipeline removes manual compliance gates that stall agile releases, directly applying 'keep it simple and practical' to the bottleneck. Compliance is enforced continuously without heavyweight process, preserving deployment speed while satisfying GRC requirements.

Why this answer

Option C is correct because it applies 'Keep it simple and practical' by replacing heavyweight, manual compliance gates with lightweight, automated checks embedded directly in the CI/CD pipeline. This reduces friction and delay while still enforcing compliance, making the process practical and proportionate to the risk. Automation ensures consistency and speed, allowing agile deployments to proceed without being blocked by bureaucratic reviews.

Exam trap

The trap is thinking that 'Keep it simple and practical' means removing all controls or delegating them entirely, when it actually means designing controls that are proportionate, automated, and integrated into existing workflows.

How to eliminate wrong answers

Option A is wrong because delegating all risk management decisions entirely to development leads removes necessary oversight and can lead to unmanaged risk, which violates the principle of keeping it simple without sacrificing control. Option B is wrong because a 3-month comprehensive audit of historical deployments is the opposite of simple and practical; it adds delay and bureaucracy rather than removing it. Option D is wrong because removing all compliance gates eliminates necessary controls, which is not 'keeping it simple' but rather abandoning governance, and it exposes the organization to unacceptable risk.

Practice this question →
38
MCQmedium

A financial services firm is deploying robotic process automation (RPA) bots to handle customer loan applications. Compliance requires that every bot decision be fully auditable. The development team wants to deploy bots immediately without logging logic. Which governance conflict does this represent regarding ITIL principles?

A.A conflict between 'Optimize and automate' and governance requirements for transparency and auditability.
B.A conflict between 'Think and work holistically' and HR hiring policies.
C.A conflict between 'Keep it simple and practical' and physical security.
D.A conflict between 'Focus on value' and 'Start where you are'.
AnswerA

Deploying bots immediately without logging logic trades speed and efficiency against the compliance obligation for transparent, auditable decisions. That is a direct tension between the 'Optimize and automate' guiding principle and governance requirements, since auditability cannot be retrofitted after deployment.

Why this answer

The ITIL guiding principle 'Optimize and automate' encourages using technology like RPA to streamline processes, but it must be balanced with governance requirements for transparency and auditability. In a financial services context, compliance mandates that automated decisions be traceable, so deploying bots without logging logic directly conflicts with these governance obligations. Thus, the conflict is between the drive to automate quickly and the need for auditable controls.

Exam trap

The trap here is confusing ITIL guiding principles with unrelated concepts like HR or physical security, or misapplying principles such as 'Focus on value' when the core conflict is between automation and auditability.

How to eliminate wrong answers

Option B is wrong because 'Think and work holistically' relates to understanding the whole system, not HR hiring policies, and the scenario does not involve hiring. Option C is wrong because 'Keep it simple and practical' is about minimizing complexity, not physical security, and the scenario is about auditability, not physical security. Option D is wrong because 'Focus on value' and 'Start where you are' are not in conflict here; the issue is automation versus auditability, not value definition or leveraging existing assets.

Practice this question →
39
Multi-Selectmedium

An IT organization is migrating its GRC platform from an on-premises tool to ServiceNow GRC. Which THREE ITIL 4 guiding principle considerations are critical for a successful migration? (Choose three.)

Select 3 answers
A.Migrating all 10,000 custom scripts and legacy workflows in a single high-risk weekend deployment.
B.Taking the opportunity to clean up and simplify outdated, bureaucratic control procedures during the migration ('Keep it simple and practical').
C.Phasing the migration module by module (e.g., Policy compliance first, then Risk, then Vendor Risk) ('Progress iteratively with feedback').
D.Assessing existing controls and data structures in the legacy tool before planning the migration ('Start where you are').
E.Ensuring that only the lead architect knows the migration plan to prevent unnecessary discussion.
AnswersB, C, D

Legacy GRC tools accumulate redundant, bureaucratic controls that would otherwise be replicated wholesale into ServiceNow. Applying 'keep it simple and practical' during migration lets the organisation retire obsolete procedures rather than porting them, reducing configuration effort and future maintenance overhead while satisfying the stem's demand for critical guiding principle considerations.

Why this answer

Option B is correct because ITIL 4's 'Keep it simple and practical' principle directs the organization to use the migration as an opportunity to eliminate outdated, bureaucratic control procedures rather than blindly porting them, reducing complexity in the new ServiceNow GRC platform. Option C is correct because 'Progress iteratively with feedback' supports phasing the migration module by module (Policy compliance, then Risk, then Vendor Risk), allowing lessons learned and user feedback from each increment to improve subsequent deployments. Option D is correct because 'Start where you are' requires assessing the existing legacy tool's controls and data structures before planning, so that valid existing content is reused and only what adds value is migrated.

Option A is not correct because a single high-risk weekend 'big bang' deployment of all 10,000 custom scripts contradicts iterative, feedback-driven, and simplicity-focused principles. Option E is not correct because restricting migration knowledge to the lead architect violates ITIL 4's 'Collaborate and promote visibility' principle, which calls for transparency and stakeholder involvement.

Exam trap

DPI often tests whether candidates can distinguish genuine ITIL 4 guiding principle applications from anti-patterns disguised as efficiency — the trap is selecting 'big bang' or 'need-to-know' options that sound decisive but actually violate 'progress iteratively' and 'collaborate and promote visibility'.

Practice this question →
40
MCQmedium

A healthcare provider is configuring access controls in Epic EHR to comply with HIPAA regulations. Clinicians complain that multi-factor authentication (MFA) prompts every 15 minutes disrupt patient care. How should the governance board apply ITIL 4 principles to balance security compliance with clinical value?

A.Remove MFA entirely for all clinical staff to maximize speed of care.
B.Transfer patient care tasks to administrative staff to handle logins.
C.Apply 'Keep it simple and practical' and 'Focus on value' to adjust session timeout rules and implement context-aware authentication (e.g., badge-tap proximity access).
D.Increase MFA frequency to every 5 minutes to ensure maximum compliance rigor.
AnswerC

These two ITIL 4 principles directly resolve the conflict: context-aware authentication via badge-tap proximity preserves HIPAA-compliant MFA while removing disruptive 15-minute prompts, focusing on clinical value and keeping the control simple and practical for clinicians.

Why this answer

Option C is correct because it applies two ITIL 4 principles simultaneously: 'keep it simple and practical' (don't over-engineer security controls in ways that create workarounds and clinical risk) and 'focus on value' (the value here is safe, timely patient care, not maximal authentication friction). Context-aware authentication like badge-tap proximity access maintains security while removing the repetitive MFA burden that disrupts care.

Exam trap

The trap is framing security and clinical value as a zero-sum trade-off — candidates who think 'more MFA equals more compliance' or 'remove MFA to go faster' miss the ITIL 4 principle that value and simplicity must be balanced through context-aware design.

How to eliminate wrong answers

Option A is wrong because removing MFA entirely for clinical staff eliminates a critical HIPAA-required access control and creates unacceptable risk of unauthorized PHI access — speed of care cannot come at the cost of patient data security. Option B is wrong because transferring patient care tasks to administrative staff to handle logins is clinically unsafe, creates accountability gaps, and violates the principle that access should be tied to the person performing the task. Option D is wrong because increasing MFA frequency to every 5 minutes doubles down on the friction that caused the complaint, worsening clinician experience and increasing the likelihood of workarounds that undermine security.

Practice this question →
41
Multi-Selectmedium

When applying 'Keep it simple and practical' to enterprise compliance and risk frameworks, which THREE practices should an organization adopt? (Choose three.)

Select 3 answers
A.Eliminating redundant approval steps that do not add measurable risk mitigation or business value.
B.Requiring manual spreadsheet logging for every single low-risk server ping.
C.Focusing on the absolute vital few controls that manage the greatest threats rather than trying to control everything equally.
D.Designing clear, straightforward policies that frontline staff can easily understand and execute.
E.Drafting 1,000-page governance manuals for every minor IT service desk procedure.
AnswersA, C, D

Redundant approval steps consume effort without reducing risk or adding value, so removing them directly embodies Keep it simple and practical. This satisfies the compliance scenario because the framework retains genuine risk mitigation while eliminating bureaucratic layers that slow delivery and dilute focus.

Why this answer

Option A is correct because 'keep it simple and practical' means removing redundant approval steps that add no measurable risk mitigation or business value, thereby reducing bureaucracy while preserving effective controls. Option C is correct because focusing on the vital few controls that address the greatest threats reflects a risk-based, prioritized approach rather than trying to control everything equally, which is impractical and dilutes effort. Option D is correct because clear, straightforward policies that frontline staff can easily understand and execute make compliance practical and more likely to be followed consistently.

Option B does not belong because requiring manual spreadsheet logging for every low-risk server ping is excessive, labor-intensive, and disproportionate to the minimal risk involved. Option E does not belong because drafting 1,000-page governance manuals for every minor IT service desk procedure is overly complex and contradicts the principle of simplicity and practicality.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Guiding Principles And GRC questions.

Start 20-question session