CTO IT Governance & Risk Management 2

Question 1

Which COBIT 5 principle states that governance and management of enterprise IT should cover the enterprise end-to-end, addressing all functions and processes?

Accepted Answer

Covering the enterprise end-to-end

Answer

The 'Covering the Enterprise End-to-End' principle ensures IT governance addresses all technology and information processing wherever it occurs across the enterprise.

Question 2

A CTO discovers that a critical vendor handles sensitive customer PII but has not undergone a SOC 2 Type II audit. What is the MOST appropriate immediate action?

Accepted Answer

Conduct a third-party risk assessment and require the vendor to obtain SOC 2 Type II certification within a defined timeline

Answer

Conducting a risk assessment establishes the current risk posture while requiring SOC 2 Type II sets a contractual path to compliance without disrupting critical services.

Question 3

In the context of IT risk management, what does 'residual risk' refer to?

Accepted Answer

The risk that remains after controls have been applied

Answer

Residual risk is the level of risk remaining after mitigating controls have been implemented, which must be compared against the organization's risk appetite.

Question 4

Which IT governance framework is specifically designed around aligning IT strategy with business strategy using a Balanced Scorecard approach?

Accepted Answer

Val IT

Answer

Val IT focuses on IT-enabled business change and value creation, using investment portfolio management and Balanced Scorecard perspectives to align IT with business strategy.

Question 5

An organization's risk appetite statement says 'We will not accept risks with a residual likelihood above Medium and impact above High.' A new SaaS deployment presents a Medium likelihood and High impact risk. What should the CTO do?

Accepted Answer

Implement additional controls to reduce likelihood or impact before proceeding

Answer

The risk exactly meets the boundary of the unacceptable zone, so additional controls should be applied to bring residual risk within appetite before proceeding.

(CTO) Certified Chief Technology Officer Practice Test

(CTO) Certified Chief Technology Officer Practice Test

CTO IT Governance & Risk Management 2