CGEIT practice questions 311–320

1. Question 311 · 363 in bank

   Which of the following is the BEST way to address an IT audit finding that many enterprise application updates lack appropriate documentation?

   • AAdd change control to the risk register.
   • BConduct software quality audits.
   • CEnforce change control procedures.
   • DReview the application development life cycle.

   Show answer

   Answer: C

   Explanation

   C. Enforce change control procedures. Enforcing change control procedures is the most effective approach to address the IT audit finding. Change control procedures ensure that all changes made to enterprise applications, including updates, are properly documented and tracked. By enforcing these procedures, the organization can establish a structured process that requires documentation at each stage of the application update, ensuring that changes are recorded, reviewed, and approved in a controlled manner.

   Source: Adapted from community discussion — yihwen

   Next question

2. Question 312 · 363 in bank

   An enterprise has identified a number of plausible risk scenarios that could result in economic loss associated with major IT investments. Which of the following is the BEST method to assess the risk?

   • AQuantitative analysis
   • BCost-benefit analysis
   • CQualitative analysis
   • DBusiness impact analysis (BIA)

   Show answer

   Answer: A

   Explanation

   he best method to assess the risk of economic loss associated with major IT investments is A. Quantitative analysis. Quantitative analysis is a method of risk assessment that uses numerical data to measure the likelihood and impact of a risk. This type of analysis is often used to assess the risk of financial losses, such as the risk of a data breach or the risk of a system outage. In this case, the enterprise has identified a number of plausible risk scenarios that could result in economic loss. Quantitative analysis can be used to measure the likelihood and impact of each risk scenario. This information can then be used to prioritize the risks and to develop mitigation strategies.

   Source: Adapted from community discussion — yihwen

   Next question

3. Question 313 · 363 in bank

   Which of the following BEST facilitates the standardization of IT vendor selection?

   • AContract management office
   • BService level agreements (SLAs)
   • CProcurement framework
   • DCost-benefit analysis

   Show answer

   Answer: C

   Next question

4. Question 314 · 363 in bank

   When selecting a vendor to provide services associated with a critical application, which of the following is the MOST important consideration with respect to business continuity planning (BCP)?

   • ATesting the vendor's BCP and analyzing the results
   • BObtaining independent audit reports of the vendor's BCP
   • CEvaluating whether the vendor's BCP aligns with the enterprise's BCP
   • DProcuring a copy of the vendor's BCP during the contracting process

   Show answer

   Answer: C

   Next question

5. Question 315 · 363 in bank

   Which of the following BEST facilitates governance oversight of data protection measures?

   • AInformation ownership
   • BInformation classification
   • CInformation custodianship
   • DInformation life cycle management

   Show answer

   Answer: A

   Explanation

   The answer is A. Information ownership is the concept that defines the ultimate responsibility and accountability for information within an organization. Information owners are responsible for making decisions regarding the classification, protection, and governance of information assets. They play a crucial role in overseeing data protection measures and ensuring compliance with relevant policies and regulations. While information custodians have a role in implementing and enforcing these measures, it is the information owners who have the primary responsibility for governance oversight.

   Source: Adapted from community discussion — yihwen

   Next question

6. Question 316 · 363 in bank

   Which of the following would be the BEST way to facilitate the adoption of storing IT governance practices throughout a multi-divisional enterprise?

   • AEnsuring each divisional policy is consistent with corporate policy
   • BEnsuring divisional governance fosters continuous improvement processes
   • CDocumenting and communicating key management practices across divisions
   • DMandating data standardization across the distributed enterprise

   Show answer

   Answer: C

   Explanation

   The best way to facilitate the adoption of storing IT governance practices throughout a multi-divisional enterprise is C. Documenting and communicating key management practices across divisions. This is because documentation and communication will help to ensure that all divisions are aware of the same practices and that they are all working towards the same goals. This will also help to identify any gaps in the practices and to ensure that they are continuously improved.

   Source: Adapted from community discussion — yihwen

   Next question

7. Question 317 · 363 in bank

   Which of the following is the BEST way for a CIO to secure support for a strategy to achieve long-term IT objectives?

   • ADevelop tactics to implement the strategy and share with stakeholders.
   • BMake the necessary strategic decisions and notify staff accordingly.
   • CMeet with stakeholders to explain the strategy and incorporate feedback.
   • DDevelop a communication plan for distribution of information to staff.

   Show answer

   Answer: C

   Next question

8. Question 318 · 363 in bank

   An enterprise has decided to implement an IT risk management program. After establishing stakeholder desired outcomes, the MAIN goal of the IT strategy committee should be to:

   • Aperform a risk analysis on key IT processes.
   • Bensure IT risk alignment with enterprise risk.
   • Cidentify business data that requires protection.
   • Dimplement controls to address high risk areas.

   Show answer

   Answer: B

   Next question

9. Question 319 · 363 in bank

   Which of the following is MOST critical to have in place before management can establish an IT risk assessment and response approach?

   • AA portfolio of IT investments
   • BDefined roles and responsibilities
   • CHistoric data on risk events
   • DA balanced scorecard

   Show answer

   Answer: B

   Next question

10. Question 320 · 363 in bank

    An enterprise is determining the objectives for an IT training improvement initiative. From a governance perspective, it would be MOST important to ensure that:

    • AIT employees are surveyed and interviewed to identify development needs.
    • Bcourses of instruction that will maximize employee productivity are identified.
    • Cseveral different training strategies are created for final approval by the CIO.
    • Dpolicies and processes address both enterprise requirements and professional growth.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CGEIT practice, question 311. 363 questions available.