AICPA Certified Information Technology Professional (CITP)
Exam 2026/2027 | Complete Practice Test & Detailed
Explanations
SECTION 1 — INFORMATION SECURITY GOVERNANCE
1.
What is the primary purpose of an organization's information security
governance program?
A. To eliminate every possible cybersecurity threat
B. To align information security with organizational objectives and risk
tolerance
C. To replace all existing IT controls
D. To reduce the number of IT employees
Answer: B
Explanation: Information security governance establishes direction,
accountability, and oversight so security activities support business
objectives and the organization's risk appetite.
2.
Which activity should normally occur first when developing an
information security strategy?
A. Purchase security software
B. Identify organizational objectives and risks
C. Configure firewalls
D. Conduct penetration testing
,Answer: B
Explanation: Security strategy should begin with understanding
business objectives, critical assets, threats, vulnerabilities, and
acceptable risk.
3.
Which document normally establishes management's high-level
expectations regarding information security?
A. Security policy
B. Incident ticket
C. Backup log
D. Network diagram
Answer: A
Explanation: A security policy communicates management's
expectations and establishes the overall direction for protecting
information assets.
4.
Which principle requires security responsibilities to be assigned clearly
to individuals or roles?
A. Accountability
B. Redundancy
C. Scalability
D. Portability
Answer: A
Explanation: Accountability ensures that individuals or organizational
roles are responsible for security decisions and actions.
,5.
What is the main purpose of a security awareness program?
A. Replace technical controls
B. Teach employees how to recognize and respond to security risks
C. Eliminate the need for authentication
D. Reduce server capacity
Answer: B
Explanation: Employees are an important security control. Awareness
programs reduce risks such as phishing, social engineering, and
improper handling of information.
6.
Which of the following represents the strongest governance approach?
A. IT makes all security decisions independently
B. Security decisions are aligned with business risk and overseen by
appropriate leadership
C. Employees determine their own security requirements
D. Security is considered only after an incident occurs
Answer: B
Explanation: Effective governance integrates security with business
objectives, enterprise risk management, and executive oversight.
7.
What is the purpose of a data classification policy?
A. To increase storage capacity
B. To determine how information should be handled according to its
sensitivity
, C. To eliminate data backups
D. To replace database software
Answer: B
Explanation: Classification allows organizations to apply appropriate
security, retention, access, and handling requirements based on data
sensitivity.
8.
Which classification would generally receive the strongest protection?
A. Public
B. Internal
C. Confidential
D. Restricted
Answer: D
Explanation: Restricted information normally represents highly
sensitive information requiring stronger access and handling controls.
9.
What is the primary role of senior management in information security
governance?
A. Configure every security device
B. Establish direction, approve resources, and oversee risk
C. Write every firewall rule
D. Perform all vulnerability scans
Answer: B
Explanation: Management establishes priorities, risk tolerance,
Exam 2026/2027 | Complete Practice Test & Detailed
Explanations
SECTION 1 — INFORMATION SECURITY GOVERNANCE
1.
What is the primary purpose of an organization's information security
governance program?
A. To eliminate every possible cybersecurity threat
B. To align information security with organizational objectives and risk
tolerance
C. To replace all existing IT controls
D. To reduce the number of IT employees
Answer: B
Explanation: Information security governance establishes direction,
accountability, and oversight so security activities support business
objectives and the organization's risk appetite.
2.
Which activity should normally occur first when developing an
information security strategy?
A. Purchase security software
B. Identify organizational objectives and risks
C. Configure firewalls
D. Conduct penetration testing
,Answer: B
Explanation: Security strategy should begin with understanding
business objectives, critical assets, threats, vulnerabilities, and
acceptable risk.
3.
Which document normally establishes management's high-level
expectations regarding information security?
A. Security policy
B. Incident ticket
C. Backup log
D. Network diagram
Answer: A
Explanation: A security policy communicates management's
expectations and establishes the overall direction for protecting
information assets.
4.
Which principle requires security responsibilities to be assigned clearly
to individuals or roles?
A. Accountability
B. Redundancy
C. Scalability
D. Portability
Answer: A
Explanation: Accountability ensures that individuals or organizational
roles are responsible for security decisions and actions.
,5.
What is the main purpose of a security awareness program?
A. Replace technical controls
B. Teach employees how to recognize and respond to security risks
C. Eliminate the need for authentication
D. Reduce server capacity
Answer: B
Explanation: Employees are an important security control. Awareness
programs reduce risks such as phishing, social engineering, and
improper handling of information.
6.
Which of the following represents the strongest governance approach?
A. IT makes all security decisions independently
B. Security decisions are aligned with business risk and overseen by
appropriate leadership
C. Employees determine their own security requirements
D. Security is considered only after an incident occurs
Answer: B
Explanation: Effective governance integrates security with business
objectives, enterprise risk management, and executive oversight.
7.
What is the purpose of a data classification policy?
A. To increase storage capacity
B. To determine how information should be handled according to its
sensitivity
, C. To eliminate data backups
D. To replace database software
Answer: B
Explanation: Classification allows organizations to apply appropriate
security, retention, access, and handling requirements based on data
sensitivity.
8.
Which classification would generally receive the strongest protection?
A. Public
B. Internal
C. Confidential
D. Restricted
Answer: D
Explanation: Restricted information normally represents highly
sensitive information requiring stronger access and handling controls.
9.
What is the primary role of senior management in information security
governance?
A. Configure every security device
B. Establish direction, approve resources, and oversee risk
C. Write every firewall rule
D. Perform all vulnerability scans
Answer: B
Explanation: Management establishes priorities, risk tolerance,
