ISACA Governance and Management of IT 3

Question 1

Which ISO standard provides the code of practice for information security controls and is frequently referenced alongside ISO/IEC 27001?

Accepted Answer

ISO/IEC 27002

Answer

ISO/IEC 27002 is the code of practice providing guidance on implementing information security controls referenced in ISO/IEC 27001.

Question 2

An organization uses a Responsibility Assignment Matrix (RACI) for IT governance decisions. The 'A' in RACI stands for:

Accepted Answer

Accountable

Answer

In a RACI matrix, 'A' stands for Accountable — the one person ultimately answerable for the correct completion of a task.

Question 3

An IS auditor finds that IT management reports to the CFO rather than directly to the CEO or board. What governance concern should be raised?

Accepted Answer

IT strategy may be overly focused on financial efficiency over innovation

Answer

Reporting to the CFO can bias IT decisions toward cost reduction rather than strategic business enablement.

Question 4

Under Val IT, the concept of 'investment portfolio management' means:

Accepted Answer

Selecting and balancing IT investments across risk and return profiles

Answer

Val IT's investment portfolio management ensures an organization selects, balances, and monitors IT investments to maximize business value.

Question 5

Which COBIT 2019 design factor relates to the organization's current level of capability in its IT processes?

Accepted Answer

Current IT capability level

Answer

Current IT capability level is one of COBIT 2019's design factors that shapes how governance and management objectives are prioritized.

(ISACA) Information Systems Audit and Control Association Certification Practice Test