Isaca CISA Certification CGEIT Questions & Answers

• Question 31:

  The IT function received only 50% of the requested funding to support the IT strategy for new business initiatives. Which of the following is the CIO's MOST important course of action before considering alternative resource options?

  A. Prioritize the portfolio.

  B. Terminate less visible maintenance projects.

  C. Develop a new balanced scorecard.

  D. Conduct a cost-benefit analysis.

  Correct Answer: A

  Reference: https://hbr.org/1980/07/strategic-management-for-competitive-advantage

• Question 32:

  Which of the following are the MOST critical enablers for implementing IT governance in an enterprise?

  A. Involvement of IT strategy and steering committees

  B. Assigning roles and responsibilities for IT governance

  C. Commitment and promotion by senior management

  D. Prioritizing IT projects and funding for IT governance

  Correct Answer: C

  Reference: https://www3.pinkelephant.com/articles/The7EnablersandConstraintsofITSMv1.PDF

• Question 33:

  An enterprise's IT department has been operating independently without regard to business concerns, leading to misalignment between business and IT. The BEST way to establish alignment would be to require:

  A. business to help define IT goals.

  B. IT to define business objectives.

  C. business to fund IT services.

  D. IT and business to define risks.

  Correct Answer: A

• Question 34:

  How does an enterprise benefit from implementing a set of key risk indicators (KRIs)?

  A. The set of KRIs remains relevant over time.

  B. Risk exposures are monitored to ensure they remain within risk appetite.

  C. The need for a formal risk and control assessment program is eliminated.

  D. The frequency of risk data gathering and reporting is minimized.

  Correct Answer: B

  Reference: https://www.metricstream.com/insights/Key-Risk-indicators-ERM.htm

• Question 35:

  Which of the following would be the BEST way for an enterprise to address new legal and regulatory requirements applicable to IT?

  A. Benchmark how other IT organizations are treating the new requirements.

  B. Adopt a zero-tolerance approach for noncompliance with regulatory matters.

  C. Treat as a risk to be assessed before developing a response.

  D. Use a cost-benefit analysis to determine if compliance is warranted.

  Correct Answer: D

• Question 36:

  An enterprise has discovered that there is significant duplication of IT investments. Which of the following would be MOST helpful in addressing this issue?

  A. Establishing an IT steering committee

  B. Delegating IT investment decisions to centralized IT

  C. Maintaining an inventory of IT investments

  D. Increasing the frequency of IT investment audits

  Correct Answer: A

• Question 37:

  Which of the following is the GREATEST expected strategic organizational benefit from the standardization of technical platforms?

  A. Reduces IT operational training costs

  B. Reduces response time

  C. Meets regulatory compliance requirements

  D. Optimizes infrastructure investments

  Correct Answer: D

  Reference: https://books.google.com.pk/books?id=odC_AQAAQBAJandpg=PA167andlpg=PA167anddq=enterprise+IT+expected+strategic+organizational+benefit+from+the+standardization+of+technical +platformsandsource=blandots=KnpTgkPPsbandsig=ACfU3U3fIFhOpMt81n2_xEoKhLtDFBmv8gandhl=enandsa=Xandved=2ahUKEwjegNiP6PfpAhWOh1wKHQB4AX8Q6AEwCXoECAcQAQ#v=onepageandq=enterprise%20IT%20expected%20strategic% 20organizational%20benefit%20from%20the%20standardization%20of%20technical%20platformsandf=false

• Question 38:

  An internal auditor conducts an assessment of a two-year-old IT risk management program. Which of the following findings should be of MOST concern to the CIO?

  A. Organizational responsibility for IT risk management is not clearly defined.

  B. IT risk training records are not properly retained in accordance with established schedules.

  C. None of the members of the IT risk management team have risk management-related certifications.

  D. Only a few key risk indicators identified by the IT risk management team are being monitored and the rest will be on a phased schedule.

  Correct Answer: D

• Question 39:

  Which of the following should be the PRIMARY consideration when implementing IT governance in a small, newly established organization?

  A. Approving enterprise architecture and standards

  B. Defining IT project management methodology

  C. Assigning a budget for IT governance applications

  D. Assigning IT roles and responsibilities

  Correct Answer: D

  Reference: https://www.isaca.org/resources/news-and-trends/newsletters/cobit-focus/2017/using-cobit-in-government-departments

• Question 40:

  Which of the following BEST defines the IT investment activities an enterprise will undertake when aligning to business goals?

  A. Portfolio management

  B. Procurement management

  C. Project management

  D. Risk management

  Correct Answer: D