Question 1

Which of the following should be the FIRST action taken by a newly formed IT governance committee to ensure reports are compliant with regulations and identify key IT risks?

Options :

A : Direct the development of a reporting communication plan.

B : Develop and monitor IT key risk indicator (KRI) triggers.

C : Train end users on regulation requirements.

D : Implement a mechanism to ensure reporting escalation.

Answer: B

Question 2

A CEO is concerned that IT costs have significantly exceeded budget without resulting benefits. The root causes are an overlap of IT projects and a lack of alignment with business demands. Which of the following would BEST enable remediation of this situation?

Options :

A : Require IT business cases be approved by the board of directors.

B : Assign a set of key risk indicators (KRIs) to each new IT project.

C : Conduct a performance assessment of IT projects.

D : Implement an IT portfolio management policy.

Answer: D

Question 3

An enterprise is considering outsourcing non-core IT processes. Which of the following should be the FIRST step?

Options :

A : Update resource allocation policies.

B : Issue a formal request for proposal (RFP) to outsourcing vendors.

C : Establish service-level metrics for outsourced activities.

D : Conduct a cost-benefit analysis for outsourcing.

Answer: D

Question 4

Which of the following is MOST likely to have a negative impact on accountability for information risk ownership?

Options :

A : The risk owner is a department manager, and the control owner is a member of the risk owner-s staff.

B : Information risk is assigned to a department, and an individual owner has not been assigned.

C : The risk owner and the control owner of the information do not work in the same department.

D : The same person is listed as both the control owner and the risk owner for the information.

Answer: B

Question 5

When developing IT risk management policies and standards, it is MOST important to align them with:

Options :

A : Best practices for IT risk management.

B : The corporate risk culture.

C : Enterprise goals and objectives.

D : The enterprise risk management (ERM) framework.

Answer: C

Confidently Practice Online with Free CGEIT Exam Cram

Buying Options: