AICPA CITP Exam 2026/2027 | Certified Information Technology
Professional | Complete Practice Questions, Correct Answers &
Detailed Rationales
SECTION 1: INFORMATION SECURITY GOVERNANCE
1.
What is the primary purpose of an information security governance
program?
A. Increase employee productivity
B. Align security activities with organizational objectives and risk
appetite
C. Eliminate all cybersecurity risks
D. Replace internal audit
Answer: B
Rationale: Security governance establishes direction, accountability,
policies, and oversight so security supports business objectives and
manages risk appropriately.
2.
Which document normally establishes management's high-level
commitment to information security?
A. Incident ticket
B. Security policy
C. Firewall log
D. Backup schedule
,Answer: B
Rationale: A security policy communicates management's expectations
and establishes the organization's overall security direction.
3.
Who ultimately has responsibility for accepting significant business risk?
A. Help-desk technician
B. External auditor
C. Appropriate business management
D. Database administrator
Answer: C
Rationale: Risk acceptance is a management decision because
management owns business objectives and associated risks.
4.
What is the best example of segregation of duties?
A. One employee prepares and approves payments
B. One administrator develops and independently approves production
changes
C. Different employees authorize and execute transactions
D. All employees share administrator credentials
Answer: C
Rationale: Separating authorization and execution reduces the
opportunity for unauthorized activity.
5.
A security framework is most useful for:
,A. Eliminating the need for policies
B. Structuring security governance and controls
C. Replacing management judgment
D. Guaranteeing compliance
Answer: B
Rationale: Frameworks provide organized practices and control
concepts that organizations can adapt to their objectives and risks.
6.
What is the purpose of a security steering committee?
A. Perform all penetration tests
B. Provide cross-functional oversight of security priorities
C. Maintain employee passwords
D. Replace the CIO
Answer: B
Rationale: Steering committees coordinate business, technology,
security, and risk priorities.
7.
Which factor should most influence security investment?
A. Vendor popularity
B. Risk to organizational objectives
C. Number of security products available
D. Employee preference
Answer: B
Rationale: Security spending should be driven by business risk,
regulatory requirements, threat exposure, and expected risk reduction.
, 8.
What is risk appetite?
A. The number of incidents experienced last year
B. The amount and type of risk an organization is willing to pursue or
retain
C. The cost of cybersecurity insurance
D. The number of security employees
Answer: B
Rationale: Risk appetite expresses the level and types of risk
management is willing to accept in pursuit of objectives.
9.
Which activity is most closely associated with security governance?
A. Aligning security strategy with business strategy
B. Installing every available security tool
C. Eliminating all passwords
D. Writing application code
Answer: A
Rationale: Governance focuses on direction, accountability, alignment,
and oversight.
10.
A security policy exception should generally be:
A. Permanently undocumented
B. Approved, documented, risk-assessed, and periodically reviewed
C. Granted verbally by any employee
D. Automatically approved
Professional | Complete Practice Questions, Correct Answers &
Detailed Rationales
SECTION 1: INFORMATION SECURITY GOVERNANCE
1.
What is the primary purpose of an information security governance
program?
A. Increase employee productivity
B. Align security activities with organizational objectives and risk
appetite
C. Eliminate all cybersecurity risks
D. Replace internal audit
Answer: B
Rationale: Security governance establishes direction, accountability,
policies, and oversight so security supports business objectives and
manages risk appropriately.
2.
Which document normally establishes management's high-level
commitment to information security?
A. Incident ticket
B. Security policy
C. Firewall log
D. Backup schedule
,Answer: B
Rationale: A security policy communicates management's expectations
and establishes the organization's overall security direction.
3.
Who ultimately has responsibility for accepting significant business risk?
A. Help-desk technician
B. External auditor
C. Appropriate business management
D. Database administrator
Answer: C
Rationale: Risk acceptance is a management decision because
management owns business objectives and associated risks.
4.
What is the best example of segregation of duties?
A. One employee prepares and approves payments
B. One administrator develops and independently approves production
changes
C. Different employees authorize and execute transactions
D. All employees share administrator credentials
Answer: C
Rationale: Separating authorization and execution reduces the
opportunity for unauthorized activity.
5.
A security framework is most useful for:
,A. Eliminating the need for policies
B. Structuring security governance and controls
C. Replacing management judgment
D. Guaranteeing compliance
Answer: B
Rationale: Frameworks provide organized practices and control
concepts that organizations can adapt to their objectives and risks.
6.
What is the purpose of a security steering committee?
A. Perform all penetration tests
B. Provide cross-functional oversight of security priorities
C. Maintain employee passwords
D. Replace the CIO
Answer: B
Rationale: Steering committees coordinate business, technology,
security, and risk priorities.
7.
Which factor should most influence security investment?
A. Vendor popularity
B. Risk to organizational objectives
C. Number of security products available
D. Employee preference
Answer: B
Rationale: Security spending should be driven by business risk,
regulatory requirements, threat exposure, and expected risk reduction.
, 8.
What is risk appetite?
A. The number of incidents experienced last year
B. The amount and type of risk an organization is willing to pursue or
retain
C. The cost of cybersecurity insurance
D. The number of security employees
Answer: B
Rationale: Risk appetite expresses the level and types of risk
management is willing to accept in pursuit of objectives.
9.
Which activity is most closely associated with security governance?
A. Aligning security strategy with business strategy
B. Installing every available security tool
C. Eliminating all passwords
D. Writing application code
Answer: A
Rationale: Governance focuses on direction, accountability, alignment,
and oversight.
10.
A security policy exception should generally be:
A. Permanently undocumented
B. Approved, documented, risk-assessed, and periodically reviewed
C. Granted verbally by any employee
D. Automatically approved
