CCNA It Governance Mgmt Questions

The policy does not specify data disposal methods after the retention period, which is a critical omission for data lifecycle management. Option A is incorrect because authorized users are likely defined elsewhere in the policy. Option B is incorrect because backup frequency is mentioned.

Option D is incorrect because encryption may not be required for all log data based on the policy context.

Options A and D are correct because COBIT 5 defines primary IT governance objectives as stakeholder value delivery and resource optimization. Option B (cost reduction) is a management objective, not governance. Option C (incident response) is an operational activity.

Option E (data encryption) is a security control.

Options A and C are correct. An IT governance framework includes structures like an IT strategy committee (A) and processes like IT risk management (C). B (IT asset inventory) is an operational practice, D (IT project portfolio management) is a management practice, and E (IT help desk ticketing system) is operational.

None of these are core governance components.

A business impact analysis (BIA) is the foundation of a valid disaster recovery plan (DRP). Without a current BIA, the DRP may not reflect the organization's current critical processes, recovery time objectives (RTOs), or recovery point objectives (RPOs). Even if no major changes are perceived, subtle shifts in dependencies, resource availability, or regulatory requirements can render the DRP ineffective.

Therefore, the auditor should recommend conducting a new BIA to validate and update the DRP.

Options C and E are correct. The IT steering committee is responsible for approving IT project budgets and priorities (C) and ensuring IT investments deliver value (E). Performing daily IT operations (A) is an operational management task.

Defining IT security policies (B) is typically the responsibility of the security function. Conducting technical vulnerability assessments (D) is a technical operational activity.

Establishing a project management office (PMO) provides standardized project management practices, oversight, and controls to prevent scope creep and improve delivery. Option A is tactical and focuses on security, not project delivery. Option B changes meeting frequency but does not establish a dedicated project governance function.

Option D mandates a tool but does not address underlying governance processes.

Without a BIA, recovery time objectives (RTOs) are uncertain, leading to potential unacceptable downtime. Option A is a consequence but not the primary risk. Option B is incorrect because BIA is for recovery, not cost.

Option C is less direct.

The customer perspective focuses on user satisfaction and service responsiveness. Option A is incorrect as training hours relate to learning and growth perspective. Option B is incorrect as system uptime is an internal process metric.

Option D is incorrect as project completion rate is an internal efficiency metric.

The SLA guarantees 99.9% uptime per month. For a 30-day month (43,200 minutes), 99.9% uptime allows only 0.1% downtime, which is 43.2 minutes. The actual outage of 45 minutes exceeds this threshold, so the SLA was not met.

Option D correctly identifies the allowed downtime as approximately 43 minutes.

The IT steering committee is responsible for approving and prioritizing IT investments; without meetings, decisions on investments are delayed. Option A is less direct, as turnover is influenced by many factors. Option B is incorrect because security incidents are typically addressed by operational security teams.

Option C is incorrect because IT policies are usually set by separate governance processes, not solely by the steering committee.

Options B and C are correct because an IT steering committee provides strategic alignment and prioritization of IT initiatives, ensuring they align with business goals. Option A is not a benefit; operational efficiency is a management responsibility, not a committee function. Option D is incorrect; establishing a steering committee may add governance overhead rather than reduce management overhead.

Option E is not a primary benefit; technical decisions are typically delegated to IT management.

Establishing a service level agreement (SLA) with key performance indicators (KPIs) provides measurable performance targets and accountability, ensuring proper oversight of outsourced data center operations. Option A (annual financial audits) addresses financial compliance but not operational oversight. Option B (ISO 27001 certification) is a certification, not an ongoing governance practice.

Option D (allowing the outsourcer to manage all security controls independently) abdicates the organization's responsibility for oversight.

Clearly defined roles and responsibilities ensure accountability in the change process. Option A is incorrect because project management methodology is separate from governance policy. Option B is incorrect as detailed technical procedures are part of implementation, not governance.

Option C is incorrect because a list of all applications is operational, not a governance element.

The IS auditor's primary responsibility is to report findings to the appropriate stakeholders—the data owner and IT management—so they can take corrective action. Option A is incorrect because implementing controls is management's responsibility, not the auditor's. Option C is premature; compensating controls should be recommended after reporting and discussing the risk.

Option D is unnecessary since the data classification policy already defines 'Confidential' data requiring encryption, and the auditor has identified a violation of that policy.

Without a formally documented IT strategy, IT investments may not be aligned with business goals, leading to misalignment and wasted resources. This is the most significant risk as it directly impacts the organization's ability to achieve its objectives. Option A is possible but less direct.

Option B is a consequence but not the most significant. Option D is a potential outcome but not as critical as misalignment with business goals.

Options B, D, and E are correct. Mature IT governance is indicated by formal risk assessment and management (B), alignment of IT decisions with business strategy (D), and regular board reporting on IT performance (E). Option A (high staff retention) is an HR metric, not a governance indicator.

Option C (on-time and within-budget projects) is a project management measure, not a governance maturity indicator.

A clear link to the organization's five-year strategic plan demonstrates that the proposal aligns with strategic goals. Option B is about the project manager's experience, which does not indicate strategic alignment. Option C describes a feature that may be beneficial but is not inherently tied to strategic goals.

Option D is a cost-saving tactic, not evidence of strategic alignment.