I85PREP
⌘ K
CITP study materials
CITP study resources

CITP practice questions

One question at a time. Build your CITP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Technology Governance

Which IT governance outcome is primarily produced by an IT steering committee rather than by day-to-day IT operations?

  1. Configuration of network switch VLAN assignments
  2. Prioritized and funded IT investment decisions aligned to business strategy Correct answer.
  3. Resolution of individual end-user password reset tickets
  4. Scheduling of nightly batch backup jobs

Explanation

A steering committee exists to make cross-functional prioritization and investment decisions that connect IT work to business strategy. Operational tasks such as ticket resolution, switch configuration and backup scheduling belong to IT service delivery, not to the governance body.

Question 2Information Technology Governance

In an IT governance framework, what distinguishes a policy from a standard?

  1. A policy is written by auditors, while a standard is written by vendors
  2. A policy states mandatory high-level direction, while a standard specifies the mandatory detailed requirements that satisfy it Correct answer.
  3. A policy is optional guidance, while a standard is legally binding
  4. A policy applies only to executives, while a standard applies only to technical staff

Explanation

Policies express management's mandatory intent at a high level, and standards translate that intent into specific, measurable mandatory requirements. Both are mandatory; the difference is the level of detail and abstraction, not who must comply.

Question 3Information Technology Governance

An organization wants a single accountable executive for IT-related risk and value delivery. Which governance structure best satisfies this requirement?

  1. A chief information officer role with defined accountability for IT governance outcomes Correct answer.
  2. A vendor account manager assigned by the primary hardware supplier
  3. A rotating committee of external auditors
  4. An informal working group of volunteer developers

Explanation

Accountability requires a named role with authority and responsibility, typically the CIO or equivalent executive. External auditors, suppliers and volunteer groups can advise or assure but cannot hold organizational accountability for IT value and risk.

Question 4Information Technology Governance

What is the primary purpose of segregating duties between the team that develops a change and the team that approves and deploys it?

  1. To prevent one person from both introducing and concealing an unauthorized change Correct answer.
  2. To increase the number of staff involved in every release
  3. To reduce licensing costs for development tools
  4. To speed up deployment by removing approval steps

Explanation

Segregation of duties is a preventive control that stops a single individual from controlling all phases of a transaction, which reduces the risk of error or fraud going undetected. Its purpose is risk reduction, not headcount, cost or speed.

Question 5Information Technology Governance

Which document typically records the approved authority of an IT governance committee, including its membership, quorum and decision rights?

  1. A service level agreement
  2. A disaster recovery runbook
  3. A software bill of materials
  4. A committee charter or terms of reference Correct answer.

Explanation

A charter or terms of reference formally establishes a committee's mandate, composition, quorum and decision authority. Runbooks, SBOMs and SLAs describe operational procedures, component inventories and service commitments respectively.

Question 6Information Technology Governance

A board asks how IT spending compares with the approved budget across business units. Which governance mechanism most directly answers this?

  1. An IT portfolio dashboard reporting budget, actuals and variance by business unit Correct answer.
  2. A network latency heat map for the data center
  3. A staff satisfaction survey conducted by human resources
  4. A penetration test report for the customer portal

Explanation

Portfolio-level financial reporting with budget-versus-actual variance gives the board the comparison it requested. The other artifacts address security testing, employee sentiment and infrastructure performance, none of which report investment against budget.

Question 7Information Technology Governance

What does the COBIT governance objective 'Ensure Benefits Delivery' primarily concern?

  1. Outsourcing every IT function to a third party
  2. Guaranteeing that every IT project finishes on schedule
  3. Optimizing the value contribution of IT investments throughout their lifecycle Correct answer.
  4. Eliminating all residual IT risk

Explanation

Benefits delivery focuses on realizing and optimizing value from IT investments across the full lifecycle, including retirement decisions. It does not promise schedule certainty, risk elimination or any particular sourcing model.

Question 8Information Technology Governance

Which statement best describes the relationship between corporate governance and IT governance?

  1. IT governance is a subset of corporate governance focused on IT-related value and risk Correct answer.
  2. Corporate governance applies only to financial reporting and excludes IT
  3. The two are unrelated because IT governance is purely technical
  4. IT governance replaces corporate governance for technology companies

Explanation

IT governance sits within the broader corporate governance system and addresses how IT supports enterprise objectives and manages IT risk. Corporate governance remains the overarching framework and is not displaced or limited to finance.

Question 9Information Technology Governance

An organization must decide whether to renew a legacy ERP platform or migrate to a cloud alternative. Which governance body decision right is being exercised?

  1. Database index tuning
  2. Investment approval and strategic portfolio prioritization Correct answer.
  3. Incident severity classification
  4. Firewall rule recertification

Explanation

Choosing between renewing and replacing a major platform is a strategic investment and portfolio prioritization decision reserved to governance bodies. The other activities are operational or technical tasks delegated to delivery teams.

Question 10Information Technology Governance

A company adopts a three-lines model. Which group constitutes the first line in relation to IT risk?

  1. An independent external assessor engaged annually
  2. Operational IT teams that own and manage risk in their daily processes Correct answer.
  3. The internal audit function reporting to the audit committee
  4. The board's risk committee

Explanation

In the three-lines model the first line is operational management, which owns and controls risk directly. Internal audit is the third line, and the board or its committees provide oversight above the lines rather than operating as one.

Question 11Information Technology Governance

A governance review finds that project managers routinely approve their own scope changes above the delegated threshold. Which control weakness is most directly indicated?

  1. Decision rights are not enforced, allowing approvals beyond delegated authority Correct answer.
  2. Capacity planning for storage is inadequate
  3. The organization lacks a software asset inventory
  4. Backup restoration testing is performed too infrequently

Explanation

Approving changes beyond a delegated threshold violates the defined decision rights and authority limits, a core governance control. Backup testing, asset inventory and capacity planning are unrelated to who may authorize scope changes.

Question 12Information Technology Governance

Which metric best indicates whether IT governance is delivering value to the business?

  1. Average length of IT staff tenure
  2. Percentage of IT investments with documented, realized business benefits against the approved case Correct answer.
  3. Number of servers physically installed in the data center
  4. Count of open source libraries in the codebase

Explanation

Value delivery is evidenced by comparing realized business benefits with the approved business case, which ties investment to outcomes. Infrastructure counts, tenure and library counts measure activity or inventory, not delivered value.

Question 13Information Technology Governance

What is the main governance purpose of an IT risk appetite statement?

  1. To specify the encryption algorithms required for data at rest
  2. To list every technical vulnerability found in the environment
  3. To assign individual blame for past security incidents
  4. To define the amount and type of IT risk the organization is willing to accept in pursuit of objectives Correct answer.

Explanation

Risk appetite expresses the level of risk the enterprise is prepared to accept, guiding decisions and tolerances. Vulnerability lists, blame assignment and algorithm specifications are operational artifacts, not appetite statements.

Question 14Information Technology Governance

A key supplier of a payment platform fails to provide current SOC 2 evidence. What is the most appropriate governance response?

  1. Immediately terminate all internal IT staff responsible for the contract
  2. Ignore the gap because the supplier is commercially important
  3. Remove the supplier from the asset register to close the finding
  4. Escalate through supplier risk management and require remediation or compensating controls before renewal Correct answer.

Explanation

Third-party risk governance requires that assurance gaps be escalated, remediated or offset with compensating controls, with renewal conditioned on resolution. Ignoring the gap, punishing internal staff or hiding the asset does not manage the risk.

Question 15Information Technology Governance

Which characteristic most clearly distinguishes governance from management in an IT context?

  1. Governance is performed only by external regulators, while management is internal
  2. Governance focuses on technology selection, while management focuses on budgeting
  3. Governance evaluates, directs and monitors, while management plans, builds and runs Correct answer.
  4. Governance is temporary, while management is permanent

Explanation

Governance sets direction and monitors performance through evaluate-direct-monitor activities, whereas management executes through plan-build-run activities. The split is about function and accountability, not internal versus external parties or permanence.

Question 16Information Technology Governance

An enterprise wants IT governance aligned with an internationally recognized standard for the governance of IT. Which standard is specifically dedicated to governance of IT for the organization?

  1. ISO 31000
  2. ISO/IEC 38500 Correct answer.
  3. ISO/IEC 27001
  4. ISO 9001

Explanation

ISO/IEC 38500 provides principles for the governance of IT within the organization. ISO 9001 addresses quality management, ISO/IEC 27001 information security management and ISO 31000 risk management more broadly.

Question 17Information Technology Governance

A governance committee wants assurance that IT change activity is controlled without reviewing every change personally. What is the most effective mechanism?

  1. Requiring the committee to sign off on all changes regardless of size
  2. Removing change records to reduce administrative effort
  3. Delegated change approval with exception reporting and periodic control testing Correct answer.
  4. Allowing developers to self-approve all production changes

Explanation

Effective governance delegates routine approvals to defined roles and relies on exception reporting and independent testing to confirm the control works. Reviewing every change does not scale, and removing records or self-approval eliminates the control.

Question 18Information Technology Governance

Which practice best supports board-level oversight of IT when directors lack technical expertise?

  1. Delegating all IT oversight permanently to a single vendor
  2. Restricting IT reporting to the CIO's verbal updates
  3. Providing directors with raw firewall logs each month
  4. Regular reporting using business-oriented risk and performance indicators with clear escalation thresholds Correct answer.

Explanation

Boards need translated, outcome-focused information with defined escalation triggers to exercise oversight effectively. Raw logs, undocumented verbal updates and vendor delegation do not give directors the basis for informed direction and monitoring.

Question 19Information Technology Governance

An organization defines a governance principle that IT decisions must be transparent and documented. Which practice best operationalizes this principle?

  1. Keeping decision records confidential to the deciding individual
  2. Announcing decisions only through informal hallway conversations
  3. Documenting decisions only after an audit requests them
  4. Recording decision rationale, attendees and approvals in a decision log accessible to stakeholders Correct answer.

Explanation

Transparency is operationalized by contemporaneous records of rationale, participants and approvals that stakeholders can review. Informal conversation, individual-only records and retroactive documentation defeat the principle.

Question 20Information Technology Governance

Which situation best demonstrates effective IT governance rather than merely good IT management?

  1. The infrastructure team patches servers within its normal maintenance window
  2. The service desk closes tickets within its target response time
  3. The board sets risk tolerance for a cloud migration and monitors milestone risk reporting against it Correct answer.
  4. A developer refactors a module to improve readability

Explanation

Setting risk tolerance and monitoring performance against it are evaluate-direct-monitor activities characteristic of governance. Patching, refactoring and ticket closure are management execution activities performed within delegated authority.

Question 21Information Technology Governance

A multinational adopts a federated IT governance model. Which arrangement is most consistent with that model?

  1. A single central team approving every local IT purchase worldwide
  2. Fully autonomous business units with no shared standards
  3. Central direction on enterprise-wide standards with delegated execution and local decision rights within limits Correct answer.
  4. Governance outsourced entirely to each region's largest supplier

Explanation

Federated governance combines central direction on common standards with delegated authority for local execution within defined limits. Central approval of every purchase is centralized, full autonomy is decentralized, and supplier-run governance abdicates accountability.

Question 22Information Technology Governance

An audit finds that IT risk registers are maintained by each business unit but never consolidated, so enterprise-level aggregation is impossible. Which governance failure does this most directly represent?

  1. Excessive centralization of risk ownership
  2. Inconsistent risk taxonomy and reporting prevents aggregation and enterprise-level oversight Correct answer.
  3. Over-reliance on automated risk scoring tools
  4. Insufficient penetration testing frequency

Explanation

Without a common taxonomy and reporting structure, unit-level registers cannot be rolled up, which undermines enterprise risk oversight. The problem is fragmentation rather than centralization, tooling or testing frequency.

Question 23Information Technology Governance

A board delegates IT investment approval to a committee but retains no reporting line. Which governance principle is most at risk?

  1. Confidentiality, because investment data are inherently sensitive
  2. Interoperability, because systems may use different protocols
  3. Availability, because committee meetings may be disrupted
  4. Accountability, because delegated authority must remain traceable to the governing body through reporting Correct answer.

Explanation

Delegation is acceptable only when authority remains traceable through reporting back to the delegating body, preserving accountability. Confidentiality, availability and interoperability are unrelated to the missing reporting line.

Question 24Information Technology Governance

An organization measures governance effectiveness using the number of governance meetings held per quarter. Why is this a weak indicator?

  1. It conflicts with the definition of a steering committee
  2. It measures activity volume rather than whether decisions improved outcomes or controls Correct answer.
  3. It always overstates the number of attendees
  4. It is too difficult to count accurately across a quarter

Explanation

Meeting counts are activity metrics that say nothing about decision quality, timeliness or control effectiveness. A meaningful measure would link governance outputs to outcomes such as decision cycle time or realized benefits.

Question 25Information Technology Governance

Two business units claim ownership of the same customer master data and issue conflicting change approvals. Which governance mechanism most directly resolves this?

  1. An increase in the service desk's ticket quota
  2. A new firewall rule between the two units' networks
  3. A larger storage allocation for both units
  4. A data governance council with defined data ownership and escalation decision rights Correct answer.

Explanation

Conflicting ownership claims over shared data are resolved through data governance with explicit ownership and escalation rights. Storage, network and service desk changes do not address who is authorized to decide about the data.

Question 26Information Technology Governance

Which statement describes the primary purpose of an IT governance framework within an enterprise?

  1. To schedule the daily work of infrastructure operations staff
  2. To specify the technical configuration baselines for production servers
  3. To define how IT decisions are authorized, directed, and monitored across the organization Correct answer.
  4. To document the coding standards used by development teams

Explanation

An IT governance framework establishes decision rights, accountability, and oversight mechanisms so that IT activity is directed toward enterprise objectives and monitored for performance. Technical baselines, operational scheduling, and coding standards are management-level artifacts rather than governance instruments.

Question 27Information Technology Governance

A newly appointed CIO wants a single agreed statement of how IT will make decisions, who is accountable, and how performance will be reported. Which artifact best fits this need?

  1. A vendor contract with service level commitments
  2. An IT governance charter defining decision rights and reporting lines Correct answer.
  3. A disaster recovery runbook describing failover steps
  4. A capacity plan forecasting storage growth

Explanation

A governance charter captures decision rights, accountability, and reporting arrangements, which is exactly the scope the CIO described. Runbooks, capacity plans, and contracts support delivery but do not define enterprise decision authority.

Question 28Information Technology Governance

In the three-lines model applied to IT, which group provides independent assurance to the governing body?

  1. The first-line business process owners
  2. The enterprise risk function embedded in operations
  3. Internal audit Correct answer.
  4. The IT operations team

Explanation

Internal audit forms the third line because it reports independently of management and gives the board objective assurance on risk and control. Operations teams and embedded risk functions sit in the first and second lines and therefore cannot provide independent assurance.

Question 29Information Technology Governance

Which statement correctly distinguishes accountability from responsibility in IT governance?

  1. Accountability and responsibility are interchangeable terms in governance documentation
  2. Accountability rests with a single named owner who answers for the outcome, while responsibility may be shared among performers Correct answer.
  3. Accountability can be delegated to a committee, while responsibility stays with the board
  4. Responsibility always sits with the board, while accountability is distributed across delivery teams

Explanation

Accountability is the obligation to answer for an outcome and should rest with one identifiable owner, whereas responsibility for performing the work can be shared. Delegating accountability away entirely defeats the purpose of assigning it.

Question 30Information Technology Governance

An enterprise wants to express how much risk it is willing to accept in pursuit of IT-enabled benefits. Which governance instrument is designed for this?

  1. An incident response plan
  2. A risk register listing open technical vulnerabilities
  3. A risk appetite statement approved by the board Correct answer.
  4. A business continuity exercise schedule

Explanation

A risk appetite statement, approved at the top, states the amount and type of risk the organization will accept while pursuing objectives. A risk register records individual risks, while incident and continuity artifacts are response mechanisms.

Question 31Information Technology Governance

A board committee is told that IT projects are delivered on time but business cases rarely state expected benefits. Which governance gap does this most directly indicate?

  1. Excessive concentration of vendor risk
  2. Weak configuration management discipline
  3. Insufficient benefit realization tracking in the investment process Correct answer.
  4. Inadequate network capacity planning

Explanation

When delivery performance is measured but expected benefits are never articulated or tracked, the governance gap lies in benefit realization within the investment lifecycle. Vendor concentration, configuration management, and capacity planning concern different control areas.

Question 32Information Technology Governance

Which arrangement best reflects a federated IT governance model?

  1. A single central authority approves all IT decisions regardless of size
  2. Governance is outsourced entirely to a third-party service provider
  3. A central group sets enterprise-wide standards while business units make decisions within those boundaries Correct answer.
  4. Every business unit sets its own standards with no central coordination

Explanation

Federated governance balances central direction with local autonomy by defining enterprise guardrails within which business units decide. Full decentralization, total centralization, and wholesale outsourcing describe different models.

Question 33Information Technology Governance

A regulator requires the organization to demonstrate that IT controls are designed and operating effectively. Which governance response is most appropriate?

  1. Commission independent testing of controls and report results to the audit committee Correct answer.
  2. Rely on verbal confirmation from IT managers during the annual review
  3. Increase the frequency of team status meetings
  4. Extend the useful life of legacy hardware

Explanation

Demonstrating control effectiveness requires objective evidence, typically from independent testing reported to those charged with governance. Verbal assurances and meeting frequency do not constitute evidence of operating effectiveness.

Question 34Information Technology Governance

An organization's governance bodies meet quarterly, but decisions are frequently revisited because attendees lack the authority to commit their functions. Which root cause should be addressed?

  1. The meeting cadence is too infrequent
  2. The agenda is not circulated in advance
  3. Meeting minutes are distributed too slowly
  4. Delegates are not empowered with clear decision rights Correct answer.

Explanation

Repeated reversal of decisions signals that attendees cannot bind their functions, which is a decision-rights design problem. Cadence, agenda distribution, and minute circulation affect efficiency but not the authority to commit.

Question 35Information Technology Governance

Which practice best enables a board with limited technical expertise to oversee IT effectively?

  1. Attending technical architecture workshops
  2. Delegating all IT oversight permanently to the CIO
  3. Reviewing raw system logs each month
  4. Receiving a concise dashboard of IT risk, performance, and investment outcomes with clear thresholds Correct answer.

Explanation

Directors can govern effectively when information is translated into business-relevant risk, performance, and value indicators with agreed thresholds. Raw logs and architecture detail overwhelm rather than inform, and permanent delegation removes oversight.

Question 36Information Technology Governance

An enterprise maps its IT governance to an internationally recognized standard specifically addressing the governance of IT for the organization. Which standard is that?

  1. ISO/IEC 27001
  2. ISO/IEC 20000-1
  3. ISO/IEC 38500 Correct answer.
  4. ISO 9001

Explanation

ISO/IEC 38500 provides principles and a model for the corporate governance of IT, covering evaluate, direct, and monitor. The other standards address information security, quality management, and IT service management respectively.

Question 37Information Technology Governance

A governance principle states that IT decisions must be transparent and documented. Which practice most directly operationalizes that principle?

  1. Recording decision rationale, approvers, and date in a maintained decision log Correct answer.
  2. Holding weekly team stand-up meetings
  3. Publishing the IT organizational chart on the intranet
  4. Requiring all staff to complete security awareness training

Explanation

Transparency and documentation are realized when each significant decision has a traceable record of rationale, approver, and timing. Org charts, stand-ups, and training support other objectives but do not document decisions.

Question 38Information Technology Governance

Which situation is the clearest example of governance rather than management?

  1. The board approves an IT risk appetite and receives quarterly assurance that tolerances are respected Correct answer.
  2. A developer resolves a defect found in user acceptance testing
  3. A service desk agent escalates a priority-one incident
  4. The infrastructure team patches servers within the agreed maintenance window

Explanation

Setting risk appetite and receiving assurance are direction-and-monitoring activities that belong to governance. Patching, defect resolution, and incident escalation are operational execution activities performed under management.

Question 39Information Technology Governance

An audit finds that each business unit maintains its own IT risk register but no consolidated enterprise view exists. Which governance action addresses this most directly?

  1. Assign each unit a larger risk management budget
  2. Mandate a common risk taxonomy and aggregate registers into an enterprise IT risk profile Correct answer.
  3. Shorten the risk review cycle within each unit
  4. Increase the number of risks recorded in each unit's register

Explanation

Aggregation requires a shared taxonomy so risks can be compared and rolled up into an enterprise profile that leadership can act on. More entries, larger budgets, or faster local cycles do not create an enterprise view.

Question 40Information Technology Governance

Which control most directly limits the risk that a single manager can approve changes beyond their delegated authority?

  1. A documented change management policy
  2. Annual security awareness refresher training
  3. Monthly reporting of change volumes to the CIO
  4. Segregation of duties with approval thresholds enforced in the workflow tool Correct answer.

Explanation

Enforcing thresholds through segregation of duties in the workflow system prevents self-approval above delegated limits. Policy documents, training, and volume reporting support awareness but do not technically constrain approval authority.

Question 41Information Technology Governance

A multinational wants IT investment decisions to reflect local market needs while remaining within group risk limits. Which governance design fits best?

  1. Outsourcing investment decisions to an external adviser
  2. Central approval of every investment regardless of size
  3. Local investment autonomy bounded by group-defined risk and architecture guardrails Correct answer.
  4. Full local autonomy with post-hoc reporting only

Explanation

Bounded autonomy lets local units respond to market needs while group guardrails preserve enterprise risk and architecture consistency. Central approval of everything, unconstrained autonomy, and external delegation each fail one side of the balance.

Question 42Information Technology Governance

Which of the following is a governance-level responsibility of the board regarding IT?

  1. Configuring the corporate firewall rule set
  2. Evaluating, directing, and monitoring the use of IT to meet enterprise objectives Correct answer.
  3. Writing the automated deployment pipeline scripts
  4. Resolving tier-two service desk tickets

Explanation

Under the evaluate-direct-monitor model, the governing body assesses IT proposals, sets direction, and monitors performance and conformance. Firewall rules, pipeline scripts, and ticket resolution are operational tasks delegated to management.

Question 43Information Technology Governance

An organization measures governance effectiveness solely by the number of governance meetings held each quarter. Why is this measure inadequate?

  1. It requires board approval before use
  2. It duplicates financial reporting metrics
  3. It is too difficult to collect reliably
  4. It counts activity rather than outcomes such as decision quality and risk reduction Correct answer.

Explanation

Meeting counts are input or activity indicators that say nothing about whether decisions improved, risks fell, or value was delivered. Effective governance metrics focus on outcomes and conformance rather than the volume of gatherings.

Question 44Information Technology Governance

Two business units claim ownership of the same customer master data and issue conflicting change approvals. Which governance mechanism resolves this most sustainably?

  1. Escalate every conflict to the CIO for a one-off ruling
  2. Let the unit with the larger budget decide each case
  3. Assign data ownership and decision rights through an agreed data governance model Correct answer.
  4. Freeze all changes to the data indefinitely

Explanation

Persistent conflicts over shared data are resolved by defining ownership, stewardship, and decision rights in a data governance model. Budget-based precedence, repeated escalation, and blanket freezes treat symptoms rather than the underlying authority gap.

Question 45Information Technology Governance

Which document typically records the agreed roles, responsibilities, and reporting obligations of an IT steering committee?

  1. The enterprise architecture roadmap
  2. The change advisory board calendar
  3. The service level agreement
  4. The committee's terms of reference Correct answer.

Explanation

Terms of reference define a committee's mandate, membership, responsibilities, and reporting obligations. Architecture roadmaps, service level agreements, and meeting calendars serve different purposes.

Question 46Information Technology Governance

A key supplier fails to provide current independent assurance reports for a payment platform. What is the most appropriate governance response?

  1. Accept the gap if delivery deadlines are tight
  2. Require remedial assurance evidence and escalate residual risk to the risk committee Correct answer.
  3. Rely on the supplier's marketing materials as evidence
  4. Terminate the contract immediately without further assessment

Explanation

Missing assurance evidence is a supplier risk that must be remediated and, where it persists, escalated to those who own the risk decision. Waiving the requirement or accepting marketing claims undermines oversight, while immediate termination ignores proportionality.

Question 47Information Technology Governance

Which principle is most directly violated when a board delegates IT investment approval to a committee but establishes no reporting line back to the board?

  1. Portability
  2. Transparency and accountability Correct answer.
  3. Scalability
  4. Interoperability

Explanation

Delegation is legitimate only when the delegate remains answerable to the delegating body through reporting. Without that line, transparency and accountability break down; scalability, interoperability, and portability are technical qualities unrelated to oversight.

Question 48Information Technology Governance

An enterprise wants assurance that IT change activity is controlled without the governance committee reviewing each change. Which mechanism is most appropriate?

  1. Committee review of every change request
  2. Annual review of a random sample of changes only
  3. A ban on changes during business hours
  4. A defined change standard with risk-based approval tiers and periodic sampling by assurance Correct answer.

Explanation

Governance sets the standard and delegates routine approval to risk-tiered processes, then uses sampling and assurance to confirm the process works. Reviewing every change does not scale, blanket bans obstruct the business, and annual-only sampling is too infrequent for effective oversight.

Question 49Information Technology Governance

Which outcome best demonstrates that IT governance is delivering value to the business?

  1. IT investments are traceable to strategic objectives and realized benefits are reported to the board Correct answer.
  2. The number of servers operated has increased year over year
  3. All IT staff hold at least one technical certification
  4. The IT department has the lowest cost per employee in the sector

Explanation

Governance delivers value when investment is linked to strategy and benefits are measured and reported, closing the loop between spending and outcomes. Cost benchmarks, infrastructure volume, and certifications are inputs or activity indicators that do not show value realization.

Question 50Information Technology Governance

A company plans to adopt COBIT for its IT governance program. Which description best matches what COBIT provides?

  1. A contractual template for cloud service agreements
  2. A programming language standard for enterprise applications
  3. A mandatory certification scheme for individual security professionals
  4. A framework of governance and management objectives with related processes and capability assessment Correct answer.

Explanation

COBIT supplies a structured set of governance and management objectives, associated processes, and a capability assessment method that organizations tailor to their context. It is not a personal certification scheme, a language standard, or a contract template.