1. What is the primary purpose of IT governance in an organization?
A) To enforce IT policies
B) To align IT with business strategy
C) To reduce IT expenditures
D) To centralize IT operations
Answer: B
Explanation: IT governance ensures IT initiatives support organizational objectives and align
with business strategy.
2. Which framework is primarily used for IT governance best practices?
A) ITIL
B) COBIT
C) PRINCE2
D) Six Sigma
Answer: B
Explanation: COBIT provides guidelines for managing IT governance and ensuring regulatory
compliance.
3. What does risk management primarily focus on?
A) Maximizing profits
B) Identifying, assessing, and mitigating risks
C) Increasing IT budgets
D) Centralizing IT operations
Answer: B
Explanation: Risk management involves identifying potential risks, assessing their impact, and
developing strategies to mitigate them.
4. Which regulation focuses on data protection and privacy in the European Union?
A) HIPAA
B) GDPR
C) SOX
D) PCI DSS
Answer: B
Explanation: GDPR is the EU regulation for data protection and privacy.
5. What is a key benefit of effective IT governance?
A) Increased operational chaos
B) Alignment of IT projects with business goals
C) Reduced communication with stakeholders
D) Increased IT spending without oversight
Answer: B
,Explanation: Effective IT governance aligns IT projects with overall business strategy and
objectives.
6. Which of the following is an example of a cybersecurity risk?
A) Software licensing
B) Phishing attacks
C) Market competition
D) Employee turnover
Answer: B
Explanation: Phishing attacks are a common cybersecurity threat that exploits human
vulnerabilities.
7. What is one of the core principles of risk management?
A) Ignoring potential threats
B) Assessing the probability and impact of risks
C) Focusing solely on cost reduction
D) Implementing solutions without evaluation
Answer: B
Explanation: Assessing both the likelihood and potential impact of risks is essential for effective
risk management.
8. Which IT governance framework integrates business objectives with IT strategies?
A) Agile
B) COBIT
C) DevOps
D) Kanban
Answer: B
Explanation: COBIT provides a framework that aligns IT processes with business objectives.
9. What does ITIL primarily focus on?
A) Project management methodologies
B) IT service management and support
C) Software development lifecycle
D) Data analytics strategies
Answer: B
Explanation: ITIL is a framework for IT service management, focusing on best practices for IT
service delivery and support.
10. In risk management, what is the first step typically taken?
A) Risk transfer
B) Risk identification
C) Risk avoidance
D) Risk acceptance
Answer: B
Explanation: The first step in risk management is identifying the risks that might impact the
organization.
,11. Which of the following best describes the term "vulnerability" in cybersecurity?
A) A potential weakness that could be exploited
B) An identified risk that has already caused harm
C) A legal compliance issue
D) A benefit of system updates
Answer: A
Explanation: A vulnerability is a weakness in a system that can be exploited by threats.
12. What is the purpose of implementing compliance measures such as SOX in IT
governance?
A) To increase IT complexity
B) To ensure adherence to regulatory requirements and protect stakeholders
C) To slow down project timelines
D) To eliminate cybersecurity risks completely
Answer: B
Explanation: Compliance measures like SOX help ensure organizations adhere to legal and
regulatory standards to protect stakeholders.
13. Which risk mitigation strategy involves transferring the risk to another party?
A) Risk avoidance
B) Risk acceptance
C) Risk transference
D) Risk elimination
Answer: C
Explanation: Risk transference involves shifting the risk responsibility to a third party, such as
through insurance.
14. In IT governance, what is the role of a steering committee?
A) To design the technical architecture
B) To align IT initiatives with business goals and oversee performance
C) To manage day-to-day IT operations
D) To develop marketing strategies
Answer: B
Explanation: A steering committee ensures that IT initiatives are aligned with business strategies
and monitors performance.
15. What does the acronym COBIT stand for?
A) Control Objectives for Information and Related Technologies
B) Certified Operations and Business Information Techniques
C) Computerized Objectives and Business IT
D) Corporate Operations and Business IT
Answer: A
Explanation: COBIT stands for Control Objectives for Information and Related Technologies.
16. Which of the following is a key aspect of IT risk assessment?
A) Ignoring small-scale risks
, B) Evaluating both likelihood and impact
C) Focusing only on external risks
D) Relying solely on past experiences
Answer: B
Explanation: Effective risk assessment evaluates both the probability of occurrence and the
potential impact of the risk.
17. What is the main objective of cybersecurity measures?
A) To allow easy access to all systems
B) To protect information systems from unauthorized access and threats
C) To increase system complexity
D) To comply with marketing strategies
Answer: B
Explanation: Cybersecurity measures are designed to safeguard information systems against
unauthorized access and threats.
18. Which framework is often used together with ITIL to enhance IT service management?
A) Agile
B) COBIT
C) Waterfall
D) DevOps
Answer: B
Explanation: COBIT complements ITIL by providing a governance framework to enhance IT
service management.
19. What is a key factor when assessing IT-related risks?
A) Only considering internal threats
B) Considering both internal and external factors
C) Ignoring potential external threats
D) Overlooking human factors
Answer: B
Explanation: Effective risk assessment includes analysis of both internal and external threats.
20. How does effective IT governance contribute to regulatory compliance?
A) By ignoring legal requirements
B) By aligning IT policies with regulatory frameworks
C) By decentralizing IT decision-making
D) By reducing IT staff involvement
Answer: B
Explanation: IT governance aligns IT policies and processes with regulatory standards to ensure
compliance.
21. Which of the following is a common countermeasure for mitigating cybersecurity risks?
A) Disabling all network connections
B) Implementing firewalls and intrusion detection systems
C) Ignoring software updates