CTO IT Governance & Risk Management 5

Question 1

What is the primary objective of IT general controls (ITGCs) in the context of SOX compliance?

Accepted Answer

To provide a foundation of reliability for application controls by governing the IT environment

Answer

ITGCs (covering change management, access controls, and operations) establish the control environment that application controls depend upon, making them foundational to SOX IT audit.

Question 2

A healthcare IT organization experiences a ransomware attack. Under HIPAA, what is the FIRST governance action the CTO should initiate?

Accepted Answer

Activate the incident response plan and conduct a breach risk assessment to determine notification obligations

Answer

HIPAA requires a risk assessment to determine if PHI was compromised and whether the incident qualifies as a reportable breach before notification obligations are triggered.

Question 3

Which approach to IT risk assessment involves assigning numerical values to threat likelihood and impact to calculate risk scores?

Accepted Answer

Quantitative risk assessment

Answer

Quantitative risk assessment assigns numerical probabilities and financial values to risks, enabling calculation of metrics like ALE and ROI on security controls.

Question 4

A CTO is implementing a governance structure for a multinational organization where IT decisions need local flexibility but global consistency. Which model BEST supports this?

Accepted Answer

Federated IT governance

Answer

Federated IT governance balances central standards and policies with local autonomy, allowing regional units to adapt within globally set boundaries.

Question 5

In the context of IT control frameworks, what is the difference between preventive and detective controls?

Accepted Answer

Preventive controls stop unwanted events from occurring; detective controls identify events that have already occurred

Answer

Preventive controls (e.g., access restrictions) block incidents before they occur, while detective controls (e.g., audit logs, IDS) identify incidents after they have taken place.

(CTO) Certified Chief Technology Officer Practice Test

(CTO) Certified Chief Technology Officer Practice Test

CTO IT Governance & Risk Management 5