Replace all existing organizational policies<\/span><\/p>\nAnswer: 3) Align IT activities with business objectives and stakeholder needs<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An IT governance framework establishes structures and processes that help ensure technology supports organizational objectives. It clarifies accountability, decision-making authority, performance expectations, risk management, and resource use. Governance should provide appropriate oversight without taking away management’s responsibility for business decisions. Effective IT governance also considers stakeholder requirements, regulatory obligations, and organizational strategy. The objective is not to eliminate risk or replace existing policies but to establish a structured approach for directing and monitoring the use of information technology.<\/span><\/p>\nQuestion 42. Which of the following BEST demonstrates effective IT governance?<\/b><\/h3>\n
1)<\/b> IT investments are evaluated against business objectives and expected benefits<\/span>
\n<\/span>2)<\/b> IT selects projects without business involvement<\/span>
\n<\/span>3)<\/b> All technology spending is approved automatically<\/span>
\n<\/span>4)<\/b> IT performance is measured only by system uptime<\/span><\/p>\nAnswer: 1) IT investments are evaluated against business objectives and expected benefits<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Effective IT governance connects technology decisions with business objectives, expected value, risk, and resource requirements. Evaluating IT investments against business goals helps management determine whether proposed initiatives support organizational strategy and provide appropriate value. System uptime can be an important operational metric, but it does not by itself demonstrate effective governance. Governance also involves accountability, risk oversight, performance measurement, compliance, and alignment between business and IT stakeholders.<\/span><\/p>\nQuestion 43. Which role is generally responsible for ensuring that IT supports the organization’s strategic objectives?<\/b><\/h3>\n
1)<\/b> Help desk technician<\/span>
\n<\/span>2)<\/b> Database administrator<\/span>
\n<\/span>3)<\/b> Application developer<\/span>
\n<\/span>4)<\/b> Senior management and the board through appropriate governance structures<\/span><\/p>\nAnswer: 4) Senior management and the board through appropriate governance structures<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Strategic alignment between IT and the organization is ultimately an executive and governance responsibility. Senior management and the board establish direction, oversight, priorities, and accountability for achieving organizational objectives. IT management contributes expertise and executes approved strategies, but strategic governance should not be delegated entirely to technical personnel. An IS auditor evaluates whether appropriate governance structures, responsibilities, processes, and performance measures exist and whether they effectively support organizational objectives.<\/span><\/p>\nQuestion 44. Which of the following is the BEST reason for establishing an IT steering committee?<\/b><\/h3>\n
1)<\/b> To perform all technical support activities<\/span>
\n<\/span>2)<\/b> To facilitate business and IT alignment and prioritize IT initiatives<\/span>
\n<\/span>3)<\/b> To replace the internal audit department<\/span>
\n<\/span>4)<\/b> To approve individual employee vacation requests<\/span><\/p>\nAnswer: 2) To facilitate business and IT alignment and prioritize IT initiatives<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An IT steering committee can provide a structured forum for business and IT representatives to evaluate priorities, investments, projects, risks, and resource requirements. Its purpose is to help ensure that IT initiatives support business needs and that competing projects are appropriately prioritized. The committee does not replace internal audit or perform routine technical support. Its responsibilities should be clearly defined and supported by appropriate governance processes. The auditor may evaluate whether the committee has sufficient authority, representation, and oversight.<\/span><\/p>\nQuestion 45. Which of the following is MOST important when evaluating an IT performance measurement program?<\/b><\/h3>\n
1)<\/b> Measures are linked to business and IT objectives<\/span>
\n<\/span>2)<\/b> The organization uses the largest possible number of metrics<\/span>
\n<\/span>3)<\/b> All metrics are technical rather than business-oriented<\/span>
\n<\/span>4)<\/b> Metrics are reported without defined targets<\/span><\/p>\nAnswer: 1) Measures are linked to business and IT objectives<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Effective performance measurement requires meaningful metrics that demonstrate whether IT is achieving defined objectives. Metrics should have clear targets, appropriate measurement methods, responsible owners, and sufficient context for interpretation. Linking measures to business and IT objectives allows management to evaluate performance and identify areas requiring improvement. Simply increasing the number of metrics does not improve measurement quality. Auditors should assess whether selected metrics provide reliable and relevant information for decision-making and whether performance results are appropriately reported.<\/span><\/p>\nQuestion 46. Which of the following BEST describes the purpose of an IT risk register?<\/b><\/h3>\n
1)<\/b> Store application source code<\/span>
\n<\/span>2)<\/b> Track employee attendance<\/span>
\n<\/span>3)<\/b> Record identified risks, assessments, owners, and treatment activities<\/span>
\n<\/span>4)<\/b> Replace all security monitoring tools<\/span><\/p>\nAnswer: 3) Record identified risks, assessments, owners, and treatment activities<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An IT risk register provides a structured record of identified risks and relevant information such as risk descriptions, affected assets or processes, likelihood, impact, risk owners, treatment plans, and status. It supports risk monitoring and management decision-making. The register should be periodically reviewed and updated as conditions change. It does not replace technical security monitoring or store application source code. An auditor may review the risk register to determine whether significant risks are identified, assigned, evaluated, and appropriately addressed.<\/span><\/p>\nQuestion 47. Which of the following is the PRIMARY purpose of an information classification scheme?<\/b><\/h3>\n
1)<\/b> Increase the amount of information retained indefinitely<\/span>
\n<\/span>2)<\/b> Ensure all information receives identical protection<\/span>
\n<\/span>3)<\/b> Eliminate the need for access controls<\/span>
\n<\/span>4)<\/b> Apply protection requirements based on the sensitivity and value of information<\/span><\/p>\nAnswer: 4) Apply protection requirements based on the sensitivity and value of information<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Information classification helps an organization categorize information according to characteristics such as sensitivity, confidentiality, criticality, and business value. Appropriate protection requirements can then be applied based on the classification. Highly sensitive information may require stronger access controls, encryption, monitoring, and retention restrictions than publicly available information. Classification also helps support consistent handling and disposal practices. It does not mean all information must receive identical protection because security controls should be proportionate to the associated risk.<\/span><\/p>\nQuestion 48. Which of the following should be performed FIRST when establishing information ownership?<\/b><\/h3>\n
1)<\/b> Identify the information and determine responsible business ownership<\/span>
\n<\/span>2)<\/b> Encrypt every database immediately<\/span>
\n<\/span>3)<\/b> Remove all users from the information system<\/span>
\n<\/span>4)<\/b> Delete information that lacks an assigned owner<\/span><\/p>\nAnswer: 1) Identify the information and determine responsible business ownership<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Information ownership requires identifying information assets and assigning responsibility to appropriate business owners. The owner is generally accountable for determining requirements related to classification, access, retention, and protection, while technical custodians may implement the required controls. An organization should establish ownership before making decisions about access or protection requirements. Simply encrypting everything or deleting unassigned information does not establish appropriate accountability. Clear ownership supports effective information governance and helps ensure that security decisions reflect business requirements.<\/span><\/p>\nQuestion 49. Which of the following is the PRIMARY purpose of data retention policies?<\/b><\/h3>\n
1)<\/b> Keep all data permanently<\/span>
\n<\/span>2)<\/b> Define how long information should be retained and when it should be disposed of<\/span>
\n<\/span>3)<\/b> Prevent employees from creating new information<\/span>
\n<\/span>4)<\/b> Eliminate the need for backups<\/span><\/p>\nAnswer: 2) Define how long information should be retained and when it should be disposed of<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Data retention policies establish requirements for retaining information for appropriate periods and disposing of it when it is no longer required. Retention requirements may be influenced by business needs, legal obligations, regulatory requirements, contractual commitments, and the information’s value. Keeping information indefinitely can increase storage costs, privacy exposure, and legal or security risks. Retention policies should therefore define applicable periods, responsibilities, disposal methods, and exceptions such as legal holds.<\/span><\/p>\nQuestion 50. Which of the following is the MOST important consideration when evaluating data disposal procedures?<\/b><\/h3>\n
1)<\/b> Whether disposal is performed at the end of every month<\/span>
\n<\/span>2)<\/b> Whether users can recover deleted information easily<\/span>
\n<\/span>3)<\/b> Whether disposal prevents unauthorized reconstruction or disclosure of sensitive information<\/span>
\n<\/span>4)<\/b> Whether disposal requires the newest available software<\/span><\/p>\nAnswer: 3) Whether disposal prevents unauthorized reconstruction or disclosure of sensitive information<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Data disposal should ensure that information is securely and appropriately destroyed when retention requirements have expired. Sensitive information should not remain recoverable through discarded media, residual files, or improperly erased storage devices. Appropriate disposal methods depend on the media and sensitivity of the information and may include secure deletion, cryptographic erasure, or physical destruction. Auditors should evaluate whether disposal procedures are documented, authorized, consistently performed, and capable of preventing unauthorized recovery or disclosure.<\/span><\/p>\nQuestion 51. Which of the following is the PRIMARY purpose of identity management?<\/b><\/h3>\n
1)<\/b> Ensure appropriate identities and access rights are established and maintained<\/span>
\n<\/span>2)<\/b> Increase the number of privileged accounts<\/span>
\n<\/span>3)<\/b> Eliminate authentication requirements<\/span>
\n<\/span>4)<\/b> Allow users to retain access indefinitely<\/span><\/p>\nAnswer: 1) Ensure appropriate identities and access rights are established and maintained<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Identity management helps organizations establish, maintain, and govern digital identities and their associated access rights. It supports processes such as user provisioning, role assignment, authentication, access modification, periodic review, and account termination. Effective identity management helps ensure that users receive appropriate access based on their responsibilities and that access is removed or changed when circumstances change. Auditors should examine whether identity lifecycle processes are documented, authorized, monitored, and consistently applied.<\/span><\/p>\nQuestion 52. Which control is MOST important when an employee leaves an organization?<\/b><\/h3>\n
1)<\/b> Increasing the employee’s system privileges<\/span>
\n<\/span>2)<\/b> Delaying account removal until the next annual review<\/span>
\n<\/span>3)<\/b> Allowing the former employee to retain access for convenience<\/span>
\n<\/span>4)<\/b> Promptly disabling or removing the employee’s access rights<\/span><\/p>\nAnswer: 4) Promptly disabling or removing the employee’s access rights<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Timely termination of access is an important control for reducing the risk of unauthorized access after an employee leaves the organization. The termination process should be coordinated between human resources, management, and appropriate IT or security personnel. Relevant accounts, credentials, tokens, physical access, and remote access should be addressed according to organizational procedures. Auditors may test whether termination notifications are timely and whether access is consistently disabled within defined requirements.<\/span><\/p>\nQuestion 53. Which of the following is the BEST method for reducing excessive user access privileges?<\/b><\/h3>\n
1)<\/b> Provide all employees with administrator access<\/span>
\n<\/span>2)<\/b> Perform periodic access reviews based on job responsibilities<\/span>
\n<\/span>3)<\/b> Disable access reviews to reduce administrative work<\/span>
\n<\/span>4)<\/b> Allow managers to share their accounts with staff<\/span><\/p>\nAnswer: 2) Perform periodic access reviews based on job responsibilities<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Periodic access reviews help verify that users have only the privileges required for their current responsibilities. Reviews should consider role changes, transfers, terminated users, privileged accounts, and inappropriate combinations of access. Appropriate business owners or managers should participate in confirming whether access remains necessary. This supports the principle of least privilege and helps reduce excessive or outdated permissions. Providing broad administrative access or sharing accounts weakens accountability and increases security risk.<\/span><\/p>\nQuestion 54. Which authentication factor is an example of “something you have”?<\/b><\/h3>\n
1)<\/b> Password<\/span>
\n<\/span>2)<\/b> Fingerprint<\/span>
\n<\/span>3)<\/b> Hardware security token<\/span>
\n<\/span>4)<\/b> Security question<\/span><\/p>\nAnswer: 3) Hardware security token<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Authentication factors are commonly categorized as something you know, something you have, and something you are. A password or PIN is something you know. A hardware security token or certain registered authentication device represents something you have. A fingerprint is something you are because it is a biometric characteristic. Using multiple independent authentication factors can strengthen authentication because compromising one factor does not necessarily compromise the others.<\/span><\/p>\nQuestion 55. Which of the following is the PRIMARY purpose of multifactor authentication?<\/b><\/h3>\n
1)<\/b> Reduce the need for user identification<\/span>
\n<\/span>2)<\/b> Require multiple independent authentication factors<\/span>
\n<\/span>3)<\/b> Allow password sharing between users<\/span>
\n<\/span>4)<\/b> Eliminate authorization controls<\/span><\/p>\nAnswer: 2) Require multiple independent authentication factors<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Multifactor authentication requires users to provide authentication evidence from multiple independent factor categories. Common categories include something the user knows, something the user possesses, and something inherent to the user. MFA can reduce the risk associated with compromised passwords because possession of a password alone may not be sufficient for access. MFA does not replace authorization, access reviews, or other security controls. Organizations should implement authentication mechanisms appropriate to the sensitivity and risk of the systems being protected.<\/span><\/p>\nQuestion 56. Which of the following is the PRIMARY objective of privileged access management?<\/b><\/h3>\n
1)<\/b> Increase the number of privileged users<\/span>
\n<\/span>2)<\/b> Eliminate monitoring of administrative activity<\/span>
\n<\/span>3)<\/b> Allow permanent administrator access<\/span>
\n<\/span>4)<\/b> Control, monitor, and limit high-risk privileged access<\/span><\/p>\nAnswer: 4) Control, monitor, and limit high-risk privileged access<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Privileged access management focuses on controlling access to accounts and functions that have elevated capabilities. Privileged accounts can make significant changes to systems, security settings, configurations, and data, making them particularly important from a risk perspective. Appropriate controls may include strong authentication, least privilege, approval workflows, credential protection, session monitoring, periodic review, and timely removal of unnecessary privileges. The objective is not to eliminate administrative access but to ensure it is appropriately authorized, controlled, and monitored.<\/span><\/p>\nQuestion 57. Which of the following is MOST important when evaluating remote access to sensitive systems?<\/b><\/h3>\n
1)<\/b> Appropriate authentication, authorization, encryption, and monitoring<\/span>
\n<\/span>2)<\/b> Allowing access from any device without restrictions<\/span>
\n<\/span>3)<\/b> Disabling all logging<\/span>
\n<\/span>4)<\/b> Using shared user accounts<\/span><\/p>\nAnswer: 1) Appropriate authentication, authorization, encryption, and monitoring<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Remote access can increase exposure because systems may be accessed outside controlled organizational environments. Appropriate controls should therefore address authentication, authorization, secure communication, endpoint security, logging, and monitoring. Sensitive systems may require stronger authentication and additional restrictions based on risk. Shared accounts should generally be avoided because they weaken individual accountability. Auditors should evaluate whether remote access is formally authorized, appropriately restricted, monitored, and periodically reviewed according to organizational requirements.<\/span><\/p>\nQuestion 58. Which of the following is the PRIMARY purpose of security awareness training?<\/b><\/h3>\n
1)<\/b> Teach employees advanced programming<\/span>
\n<\/span>2)<\/b> Replace technical security controls<\/span>
\n<\/span>3)<\/b> Help users understand security responsibilities and recognize common risks<\/span>
\n<\/span>4)<\/b> Give all employees administrative privileges<\/span><\/p>\n