CITP Exam 2026/2027 | Certified Information Technology
Professional | 300+ Practice Questions, Answers & Detailed
Rationales
SECTION 1: INFORMATION SECURITY GOVERNANCE
1. What is the primary purpose of an information security governance
program?
A. To eliminate all technology risks
B. To align security objectives with organizational objectives
C. To replace internal audit activities
D. To maximize IT spending
Answer: B
Rationale: Information security governance establishes direction,
accountability, and oversight so security activities support
organizational objectives and risk appetite.
2. Which document normally establishes management's high-level
expectations for information security?
A. Security policy
B. Incident ticket
C. Network diagram
D. Backup log
Answer: A
,Rationale: A security policy provides management-level direction and
establishes expectations that are subsequently translated into
standards, procedures, and guidelines.
3. Which security principle means users should receive only the access
required to perform their assigned duties?
A. Defense in depth
B. Least privilege
C. Nonrepudiation
D. Availability
Answer: B
Rationale: Least privilege restricts access rights to the minimum
necessary for legitimate business activities.
4. Which activity best demonstrates board-level security oversight?
A. Reviewing individual firewall rules
B. Approving every software patch
C. Reviewing cybersecurity risk metrics and major incidents
D. Configuring endpoint security software
Answer: C
Rationale: Governance bodies focus on strategic risk, performance, and
significant security matters rather than routine technical administration.
5. What is the primary objective of segregation of duties?
,A. Improve network bandwidth
B. Prevent one individual from controlling incompatible activities
C. Increase database capacity
D. Reduce employee training
Answer: B
Rationale: Segregation of duties reduces the opportunity for errors or
fraud by distributing incompatible responsibilities among different
individuals.
6. Which activity is most appropriate for a security steering
committee?
A. Resetting passwords
B. Installing workstation updates
C. Prioritizing security initiatives against business objectives
D. Troubleshooting printer problems
Answer: C
Rationale: A security steering committee provides strategic direction
and prioritizes initiatives based on business needs and risk.
7. Which security objective is primarily concerned with preventing
unauthorized disclosure?
A. Integrity
B. Availability
C. Confidentiality
D. Recoverability
, Answer: C
Rationale: Confidentiality protects information from unauthorized
access or disclosure.
8. Which security objective ensures information remains accurate and
complete?
A. Integrity
B. Confidentiality
C. Availability
D. Redundancy
Answer: A
Rationale: Integrity ensures information is accurate, complete, and
protected against unauthorized alteration.
9. Which security objective focuses on ensuring systems and
information are accessible when required?
A. Confidentiality
B. Availability
C. Authentication
D. Authorization
Answer: B
Rationale: Availability ensures authorized users can access systems and
information when needed.
Professional | 300+ Practice Questions, Answers & Detailed
Rationales
SECTION 1: INFORMATION SECURITY GOVERNANCE
1. What is the primary purpose of an information security governance
program?
A. To eliminate all technology risks
B. To align security objectives with organizational objectives
C. To replace internal audit activities
D. To maximize IT spending
Answer: B
Rationale: Information security governance establishes direction,
accountability, and oversight so security activities support
organizational objectives and risk appetite.
2. Which document normally establishes management's high-level
expectations for information security?
A. Security policy
B. Incident ticket
C. Network diagram
D. Backup log
Answer: A
,Rationale: A security policy provides management-level direction and
establishes expectations that are subsequently translated into
standards, procedures, and guidelines.
3. Which security principle means users should receive only the access
required to perform their assigned duties?
A. Defense in depth
B. Least privilege
C. Nonrepudiation
D. Availability
Answer: B
Rationale: Least privilege restricts access rights to the minimum
necessary for legitimate business activities.
4. Which activity best demonstrates board-level security oversight?
A. Reviewing individual firewall rules
B. Approving every software patch
C. Reviewing cybersecurity risk metrics and major incidents
D. Configuring endpoint security software
Answer: C
Rationale: Governance bodies focus on strategic risk, performance, and
significant security matters rather than routine technical administration.
5. What is the primary objective of segregation of duties?
,A. Improve network bandwidth
B. Prevent one individual from controlling incompatible activities
C. Increase database capacity
D. Reduce employee training
Answer: B
Rationale: Segregation of duties reduces the opportunity for errors or
fraud by distributing incompatible responsibilities among different
individuals.
6. Which activity is most appropriate for a security steering
committee?
A. Resetting passwords
B. Installing workstation updates
C. Prioritizing security initiatives against business objectives
D. Troubleshooting printer problems
Answer: C
Rationale: A security steering committee provides strategic direction
and prioritizes initiatives based on business needs and risk.
7. Which security objective is primarily concerned with preventing
unauthorized disclosure?
A. Integrity
B. Availability
C. Confidentiality
D. Recoverability
, Answer: C
Rationale: Confidentiality protects information from unauthorized
access or disclosure.
8. Which security objective ensures information remains accurate and
complete?
A. Integrity
B. Confidentiality
C. Availability
D. Redundancy
Answer: A
Rationale: Integrity ensures information is accurate, complete, and
protected against unauthorized alteration.
9. Which security objective focuses on ensuring systems and
information are accessible when required?
A. Confidentiality
B. Availability
C. Authentication
D. Authorization
Answer: B
Rationale: Availability ensures authorized users can access systems and
information when needed.
