IT Governance and Strategy CISA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A multinational corporation operates in several countries, including some with strict data sovereignty laws. The company's IT governance framework currently uses a single global policy for data handling. Local subsidiaries are required to follow this policy, but they have raised concerns about conflicts with local regulations. What is the BEST governance approach?

   • AAllow each subsidiary to develop its own data handling policy without global oversight.
   • BDevelop a global policy framework that sets minimum standards and allows local subsidiaries to implement stricter controls to meet local regulations.
   • CEnforce the global policy strictly and require subsidiaries to comply, regardless of local laws.
   • DCreate a single global policy that is so broad it covers all possible local regulations.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare provider is implementing a new patient portal that will store protected health information (PHI). The organization must comply with HIPAA. Which action is MOST directly required to support HIPAA compliance in the IT governance framework?

   • AConduct a risk assessment and implement safeguards for confidentiality, integrity, and availability of PHI.
   • BOutsource all IT operations to a cloud provider to avoid compliance responsibilities.
   • CEnsure the portal is accessible from any device without additional authentication.
   • DPublish a privacy policy on the portal and consider compliance achieved.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary difference between an IT standard and an IT procedure?

   • AStandards are high-level; procedures are low-level
   • BStandards are mandatory rules; procedures are step-by-step instructions
   • CStandards are optional; procedures are mandatory
   • DStandards are created by management; procedures are created by IT staff
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A financial institution is subject to multiple regulatory frameworks, including SOX, PCI DSS, and GDPR. The IT governance team is developing a unified compliance program. What is the MOST effective approach?

   • APrioritize the most stringent framework and ignore the others.
   • BImplement separate controls for each framework to ensure full compliance.
   • COutsource compliance to a third-party auditor.
   • DMap the requirements of each framework to common controls and implement a single set of controls that satisfies multiple requirements.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government agency is required to align its IT investments with its strategic mission. The agency has multiple legacy systems that are not well integrated. Which enterprise architecture framework would be MOST appropriate to help the agency plan its future state?

   • AInternational Organization for Standardization (ISO) 27001
   • BControl Objectives for Information and Related Technologies (COBIT)
   • CInformation Technology Infrastructure Library (ITIL)
   • DThe Open Group Architecture Framework (TOGAF)
   Reveal Solution Discussion Select an answer first