CISA Governance and Management of IT Practice Question
A medium-sized e-commerce company recently suffered a ransomware attack that encrypted critical databases. The IT team restored systems from backups, but the incident exposed a lack of clear roles and responsibilities for incident response. The board has asked the IT governance committee to review and improve the incident response governance. The committee notes that while there is an incident response policy, it is not regularly tested, and staff are unsure of their roles. The company also lacks a formal communication protocol for notifying stakeholders. What should the committee prioritize to strengthen governance over incident response?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define and communicate clear roles and responsibilities for incident response, and establish accountability.
The root cause is a lack of clear roles, responsibilities, and accountability, which must be addressed first to strengthen governance. Option A is wrong because investing in technology alone does not fix governance gaps. Option B is wrong because outsourcing does not address internal governance deficiencies. Option D is wrong, while testing is valuable, it should follow role definition and communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Invest in advanced endpoint detection and response tools.
Why it's wrong here
Technology is only part of the solution; governance needs precede tools.
- ✗
Outsource incident response to a managed security service provider.
Why it's wrong here
Outsourcing does not substitute for internal governance.
- ✓
Define and communicate clear roles and responsibilities for incident response, and establish accountability.
Why this is correct
Clear governance structure is foundational.
- ✗
Conduct a tabletop exercise to test the current plan.
Why it's wrong here
Testing is important but should be done after roles are defined.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.