CISA Governance & Management of IT Practice Questions
Governance & Management of IT makes up 9 of every 50 questions on a Tigertest CISA practice test. Here are 10 of the 36 questions on it, each with the answer and the reason.
Updated by the Tigertest team. Based on ISACA's CISA job practice areas (effective August 2024). Original questions; 50 per test, weighted like the real exam. Not affiliated with ISACA.
1. Who holds ultimate accountability for the governance of enterprise IT?
- A.The head of internal audit
- B.The board of directors
- C.The chief information officer
- D.The IT steering committee members
Answer: B. Governance is a board responsibility: the board sets direction and oversees performance, while executive management runs IT day to day.
2. What is the main role of an IT strategy committee?
- A.To run daily IT service operations
- B.To review individual firewall rules
- C.To approve each project change request
- D.To advise the board on IT strategy
Answer: D. An IT strategy committee works at board level on strategic IT issues. An IT steering committee, at management level, prioritizes and oversees projects and resources.
3. Which is the best evidence that IT is aligned with the business?
- A.IT plans derive from business plans
- B.IT staff hold many certifications
- C.IT spending rose faster than last year
- D.The help desk closes most tickets quickly
Answer: A. Alignment means IT objectives come from business objectives. Efficient operations or skilled staff do not show that IT is working on what the business needs.
4. What does an IT balanced scorecard add to purely financial measures?
- A.A full list of every software license held
- B.Detailed project cost codes
- C.Customer, process and growth views
- D.A ranking of IT staff salaries
Answer: C. The balanced scorecard measures IT across several perspectives, such as contribution to the business, users, internal processes and future readiness, not only cost.
5. In COBIT 2019, which set of activities belongs to governance rather than management?
- A.Deliver, service and support
- B.Align, plan and organize
- C.Evaluate, direct and monitor
- D.Plan, build and run
Answer: C. COBIT separates governance, the Evaluate, Direct and Monitor domain owned by the board, from the management domains that plan, build, run and monitor IT.
6. Which document is most likely to need updating when a team adopts a new backup tool?
- A.The backup procedure
- B.The IT strategic plan
- C.The audit committee charter
- D.The information security policy
Answer: A. Procedures describe how tasks are done with specific tools, so they change most often. Policies state management's intent and should rarely need to change for a tool.
7. When reviewing IT policies, what should an IS auditor check first?
- A.That policies name specific products
- B.That each policy fits on a single page
- C.That IT staff wrote every policy
- D.That they are approved and communicated
Answer: D. A policy has force only when senior management has approved it and staff know about it. Content and format are reviewed after that.
8. What is the main advantage of developing policies top-down rather than bottom-up?
- A.They cover only day-to-day operational detail
- B.They stay consistent with strategy
- C.They are always quicker to write
- D.They need no management review
Answer: B. Top-down policies start from organizational objectives, so they are consistent across the enterprise. Bottom-up policies can be practical but may conflict or leave gaps.
9. Which situation is the greatest segregation of duties concern?
- A.A tester writing test scripts
- B.A developer promoting own code
- C.A help desk analyst resetting passwords
- D.An operator scheduling batch jobs
Answer: B. If the person who writes code also moves it into production, unauthorized or untested changes can go live with no one else seeing them.
10. In NIST Cybersecurity Framework 2.0, what do the Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe?
- A.How sensitive each data set is
- B.The order of incident response steps
- C.Which controls a vendor must buy
- D.How rigorous risk governance is
Answer: D. CSF 2.0 Tiers characterize the rigor of an organization's cybersecurity risk governance and management practices. Profiles, not Tiers, describe current and target outcomes.
Practice all 36 governance & management of it questions, and the rest of the 200-question bank, in the free CISA training sets. Questions you miss come back until you have mastered them.
Start practicingFree to start. No account needed.