WGU C954 Information Technology Management OA Exam
Set 5 Parts 1-3 Questions & Answers Verified Actual Exam
2026/2027 – Complete Exam-Style Q&As | 100% Certified
Verified – Pass Guaranteed – A+ Graded
PART 1: IT STRATEGY & GOVERNANCE (Questions 1–25)
Q1: A mid-sized manufacturing firm is struggling to align its IT investments with its long-term business
goals. The CIO wants to implement a framework that translates strategic objectives into measurable
performance indicators across four perspectives: financial, customer, internal processes, and
learning/growth. Which framework best meets this need?
A. Porter's Five Forces — it helps analyze competitive rivalry and market positioning, which indirectly
guides IT investment priorities.
B. The Balanced Scorecard — it maps strategic objectives to KPIs across financial, customer, internal
process, and learning/growth perspectives, making it ideal for aligning IT with business strategy.
[CORRECT]
C. SWOT Analysis — it identifies strengths, weaknesses, opportunities, and threats, providing a broad
situational overview for IT planning.
D. COBIT 2019 — it governs IT processes and controls but does not inherently translate business strategy
into multi-perspective performance metrics.
Correct Answer: B
Rationale: The best answer is B. The Balanced Scorecard was specifically designed by Kaplan and Norton
to translate organizational strategy into actionable performance measures across those four
perspectives. For IT leaders, this means every technology investment can be traced back to a strategic
objective — whether it's reducing operational costs (financial), improving customer self-service portals
(customer), streamlining supply chain systems (internal process), or upskilling staff on new platforms
(learning/growth). This framework directly bridges the gap between "what the business wants" and
"what IT delivers."
,Q2: During a strategic planning session, the executive team at a regional hospital system asks the IT
director to evaluate how external competitive pressures might affect the organization's technology
roadmap. Which analytical tool would be most appropriate for this assessment?
A. A RACI matrix — it clarifies roles and responsibilities for IT projects but does not analyze external
competitive forces.
B. The ITIL service value chain — it optimizes IT service delivery but focuses internally on value creation,
not competitive positioning.
C. Porter's Five Forces — it systematically evaluates competitive rivalry, threat of new entrants,
bargaining power of suppliers and buyers, and threat of substitutes. [CORRECT]
D. The Capability Maturity Model (CMM) — it assesses process maturity levels but does not address
market or competitive dynamics.
Correct Answer: C
Rationale: The best answer is C. Porter's Five Forces is the classic framework for understanding the
competitive landscape an organization operates within. In this hospital scenario, the IT director would
use it to assess, for example, whether new telehealth startups (threat of new entrants) or powerful EHR
vendors (supplier bargaining power) might disrupt their technology strategy. This analysis then informs
decisions like whether to build proprietary systems, partner with established vendors, or invest in
defensive cybersecurity measures.
Q3: A university's IT department is conducting a comprehensive assessment to identify internal
technology strengths, weaknesses in their legacy systems, opportunities for cloud migration, and threats
from increasing cyberattacks on educational institutions. This type of analysis is best described as:
A. A gap analysis — it compares current state to desired future state but does not systematically
categorize internal and external factors.
B. A SWOT analysis — it evaluates internal Strengths and Weaknesses alongside external Opportunities
and Threats. [CORRECT]
C. A PESTLE analysis — it examines Political, Economic, Social, Technological, Legal, and Environmental
factors but does not distinguish internal from external.
D. A balanced scorecard assessment — it measures performance against strategic objectives but is not a
situational diagnostic tool.
Correct Answer: B
Rationale: The best answer is B. SWOT is the go-to framework when you need to look inward at what
your organization does well (strengths like a skilled IT team) and poorly (weaknesses like aging servers),
,while simultaneously scanning the external environment for chances to advance (opportunities like
affordable cloud services) and dangers to avoid (threats like ransomware targeting schools). For this
university, the SWOT output would directly feed into their IT strategic plan — perhaps prioritizing cloud
migration to address both a weakness (legacy infrastructure) and a threat (security vulnerabilities).
Q4: In the context of IT strategic alignment, which of the following best describes the concept of
"strategic fit"?
A. Ensuring all IT projects are completed on time and within budget, regardless of their connection to
business objectives.
B. The degree to which IT capabilities, resources, and initiatives support and enable the organization's
overall business strategy and competitive positioning. [CORRECT]
C. Matching the technical specifications of hardware and software components to ensure
interoperability.
D. Aligning the IT department's organizational chart with the reporting structure of the finance
department.
Correct Answer: B
Rationale: The best answer is B. Strategic fit is about coherence — making sure the technology side of
the house is pulling in the same direction as the business side. It's not just about doing IT well; it's about
doing the right IT. For example, if a retail company's business strategy is to differentiate through
exceptional customer experience, then IT strategic fit means prioritizing investments in CRM systems,
mobile apps, and real-time inventory visibility rather than, say, back-office automation that doesn't
touch the customer.
Q5: A global logistics company wants to ensure its IT governance framework addresses the full lifecycle
of information and technology — from creation and use to retention and disposal — while aligning with
business goals and managing risk. Which framework is specifically designed for this comprehensive IT
governance approach?
A. ITIL 4 — it focuses on IT service management and value co-creation but is not primarily an IT
governance framework.
B. ISO/IEC 27001 — it specifies requirements for information security management systems but does
not cover the full IT governance lifecycle.
C. COBIT 2019 — it provides a comprehensive framework for governing and managing enterprise IT,
covering the full information lifecycle and aligning IT with business goals. [CORRECT]
, D. Scrum — it is an Agile project management framework for software development, not an IT
governance standard.
Correct Answer: C
Rationale: The best answer is C. COBIT (Control Objectives for Information and Related Technologies) is
the gold standard for enterprise IT governance. The 2019 version is particularly strong because it was
redesigned to be more flexible and customizable — it covers everything from how you set strategic goals
for IT, to how you manage risk, to how you ensure value delivery, to how you handle information from
cradle to grave. For this logistics company, COBIT would give them a structured way to ask: "Are we
governing our IT in a way that supports moving freight efficiently while keeping customer data secure
and compliant?"
Q6: A healthcare organization's IT steering committee is reviewing compliance requirements. They need
a framework that specifically addresses the protection of patient health information (PHI), including
administrative, physical, and technical safeguards. Which regulatory requirement applies?
A. GDPR — it governs personal data protection for EU residents but does not specifically address PHI or
healthcare safeguards.
B. HIPAA (Health Insurance Portability and Accountability Act) — it establishes national standards for
protecting PHI with required administrative, physical, and technical safeguards. [CORRECT]
C. SOX (Sarbanes-Oxley Act) — it focuses on corporate financial reporting and internal controls, not
healthcare data.
D. PCI DSS — it secures credit card payment data, not patient health information.
Correct Answer: B
Rationale: The best answer is B. HIPAA's Security Rule is the specific piece that mandates those three
categories of safeguards. Administrative safeguards include policies and procedures, workforce training,
and assigning a security officer. Physical safeguards cover facility access controls and workstation
security. Technical safeguards address access controls, audit controls, integrity controls, and
transmission security. For any healthcare IT leader, HIPAA isn't just a checkbox — it's the foundational
law that shapes how every system touching patient data is designed, accessed, and monitored.
Q7: A European-based e-commerce company that processes personal data of EU citizens must comply
with strict data protection requirements, including obtaining explicit consent, enabling data portability,
and notifying authorities of breaches within 72 hours. Which regulation governs these requirements?
Set 5 Parts 1-3 Questions & Answers Verified Actual Exam
2026/2027 – Complete Exam-Style Q&As | 100% Certified
Verified – Pass Guaranteed – A+ Graded
PART 1: IT STRATEGY & GOVERNANCE (Questions 1–25)
Q1: A mid-sized manufacturing firm is struggling to align its IT investments with its long-term business
goals. The CIO wants to implement a framework that translates strategic objectives into measurable
performance indicators across four perspectives: financial, customer, internal processes, and
learning/growth. Which framework best meets this need?
A. Porter's Five Forces — it helps analyze competitive rivalry and market positioning, which indirectly
guides IT investment priorities.
B. The Balanced Scorecard — it maps strategic objectives to KPIs across financial, customer, internal
process, and learning/growth perspectives, making it ideal for aligning IT with business strategy.
[CORRECT]
C. SWOT Analysis — it identifies strengths, weaknesses, opportunities, and threats, providing a broad
situational overview for IT planning.
D. COBIT 2019 — it governs IT processes and controls but does not inherently translate business strategy
into multi-perspective performance metrics.
Correct Answer: B
Rationale: The best answer is B. The Balanced Scorecard was specifically designed by Kaplan and Norton
to translate organizational strategy into actionable performance measures across those four
perspectives. For IT leaders, this means every technology investment can be traced back to a strategic
objective — whether it's reducing operational costs (financial), improving customer self-service portals
(customer), streamlining supply chain systems (internal process), or upskilling staff on new platforms
(learning/growth). This framework directly bridges the gap between "what the business wants" and
"what IT delivers."
,Q2: During a strategic planning session, the executive team at a regional hospital system asks the IT
director to evaluate how external competitive pressures might affect the organization's technology
roadmap. Which analytical tool would be most appropriate for this assessment?
A. A RACI matrix — it clarifies roles and responsibilities for IT projects but does not analyze external
competitive forces.
B. The ITIL service value chain — it optimizes IT service delivery but focuses internally on value creation,
not competitive positioning.
C. Porter's Five Forces — it systematically evaluates competitive rivalry, threat of new entrants,
bargaining power of suppliers and buyers, and threat of substitutes. [CORRECT]
D. The Capability Maturity Model (CMM) — it assesses process maturity levels but does not address
market or competitive dynamics.
Correct Answer: C
Rationale: The best answer is C. Porter's Five Forces is the classic framework for understanding the
competitive landscape an organization operates within. In this hospital scenario, the IT director would
use it to assess, for example, whether new telehealth startups (threat of new entrants) or powerful EHR
vendors (supplier bargaining power) might disrupt their technology strategy. This analysis then informs
decisions like whether to build proprietary systems, partner with established vendors, or invest in
defensive cybersecurity measures.
Q3: A university's IT department is conducting a comprehensive assessment to identify internal
technology strengths, weaknesses in their legacy systems, opportunities for cloud migration, and threats
from increasing cyberattacks on educational institutions. This type of analysis is best described as:
A. A gap analysis — it compares current state to desired future state but does not systematically
categorize internal and external factors.
B. A SWOT analysis — it evaluates internal Strengths and Weaknesses alongside external Opportunities
and Threats. [CORRECT]
C. A PESTLE analysis — it examines Political, Economic, Social, Technological, Legal, and Environmental
factors but does not distinguish internal from external.
D. A balanced scorecard assessment — it measures performance against strategic objectives but is not a
situational diagnostic tool.
Correct Answer: B
Rationale: The best answer is B. SWOT is the go-to framework when you need to look inward at what
your organization does well (strengths like a skilled IT team) and poorly (weaknesses like aging servers),
,while simultaneously scanning the external environment for chances to advance (opportunities like
affordable cloud services) and dangers to avoid (threats like ransomware targeting schools). For this
university, the SWOT output would directly feed into their IT strategic plan — perhaps prioritizing cloud
migration to address both a weakness (legacy infrastructure) and a threat (security vulnerabilities).
Q4: In the context of IT strategic alignment, which of the following best describes the concept of
"strategic fit"?
A. Ensuring all IT projects are completed on time and within budget, regardless of their connection to
business objectives.
B. The degree to which IT capabilities, resources, and initiatives support and enable the organization's
overall business strategy and competitive positioning. [CORRECT]
C. Matching the technical specifications of hardware and software components to ensure
interoperability.
D. Aligning the IT department's organizational chart with the reporting structure of the finance
department.
Correct Answer: B
Rationale: The best answer is B. Strategic fit is about coherence — making sure the technology side of
the house is pulling in the same direction as the business side. It's not just about doing IT well; it's about
doing the right IT. For example, if a retail company's business strategy is to differentiate through
exceptional customer experience, then IT strategic fit means prioritizing investments in CRM systems,
mobile apps, and real-time inventory visibility rather than, say, back-office automation that doesn't
touch the customer.
Q5: A global logistics company wants to ensure its IT governance framework addresses the full lifecycle
of information and technology — from creation and use to retention and disposal — while aligning with
business goals and managing risk. Which framework is specifically designed for this comprehensive IT
governance approach?
A. ITIL 4 — it focuses on IT service management and value co-creation but is not primarily an IT
governance framework.
B. ISO/IEC 27001 — it specifies requirements for information security management systems but does
not cover the full IT governance lifecycle.
C. COBIT 2019 — it provides a comprehensive framework for governing and managing enterprise IT,
covering the full information lifecycle and aligning IT with business goals. [CORRECT]
, D. Scrum — it is an Agile project management framework for software development, not an IT
governance standard.
Correct Answer: C
Rationale: The best answer is C. COBIT (Control Objectives for Information and Related Technologies) is
the gold standard for enterprise IT governance. The 2019 version is particularly strong because it was
redesigned to be more flexible and customizable — it covers everything from how you set strategic goals
for IT, to how you manage risk, to how you ensure value delivery, to how you handle information from
cradle to grave. For this logistics company, COBIT would give them a structured way to ask: "Are we
governing our IT in a way that supports moving freight efficiently while keeping customer data secure
and compliant?"
Q6: A healthcare organization's IT steering committee is reviewing compliance requirements. They need
a framework that specifically addresses the protection of patient health information (PHI), including
administrative, physical, and technical safeguards. Which regulatory requirement applies?
A. GDPR — it governs personal data protection for EU residents but does not specifically address PHI or
healthcare safeguards.
B. HIPAA (Health Insurance Portability and Accountability Act) — it establishes national standards for
protecting PHI with required administrative, physical, and technical safeguards. [CORRECT]
C. SOX (Sarbanes-Oxley Act) — it focuses on corporate financial reporting and internal controls, not
healthcare data.
D. PCI DSS — it secures credit card payment data, not patient health information.
Correct Answer: B
Rationale: The best answer is B. HIPAA's Security Rule is the specific piece that mandates those three
categories of safeguards. Administrative safeguards include policies and procedures, workforce training,
and assigning a security officer. Physical safeguards cover facility access controls and workstation
security. Technical safeguards address access controls, audit controls, integrity controls, and
transmission security. For any healthcare IT leader, HIPAA isn't just a checkbox — it's the foundational
law that shapes how every system touching patient data is designed, accessed, and monitored.
Q7: A European-based e-commerce company that processes personal data of EU citizens must comply
with strict data protection requirements, including obtaining explicit consent, enabling data portability,
and notifying authorities of breaches within 72 hours. Which regulation governs these requirements?
