CISA IT Governance and Management Quiz

1. In CISA auditing, what does 'control effectiveness testing' measure?

Whether controls are operating as designed

The cost of implementing controls

User satisfaction with IT systems

System performance metrics

2. In CISA auditing, 'management representation letters' primarily serve to____

Confirm management's responsibility for controls

Reduce audit scope

Replace audit procedures

Eliminate testing requirements

3. What is the primary benefit of implementing compensating controls?

Reducing overall IT costs

Achieving control objectives when primary controls fail

Eliminating the need for audits

Improving system uptime

4. Which principle emphasizes that IT governance should align with organizational strategy?

Risk alignment

Strategic alignment

Operational efficiency

Cost optimization

5. In IT governance, what does 'audit trail' primarily enable?

Tracking user actions and system changes

Improving system speed

Reducing storage costs

Eliminating user errors

6. What is the primary goal of access control in IT security governance?

Ensure only authorized users access resources

Eliminate all passwords

Reduce IT support tickets

Increase system performance

7. Which type of audit evidence is generally considered most reliable?

Oral statements from management

Physical observation and documentation

User feedback surveys

System-generated log files

8. In IT audit planning, what does 'materiality' refer to?

The physical location of servers

The significance of an issue to audit conclusions

The number of systems to audit

The audit fee structure

9. What is the primary purpose of business continuity planning in IT governance?

Reduce IT staff requirements

Ensure critical operations resume after disruptions

Eliminate all system risks

Avoid regulatory compliance

10. Which compliance framework specifically addresses data protection in the European Union?

HIPAA

GDPR

SOX

PCI DSS

11. Which framework provides a comprehensive approach to IT governance and aligns IT strategy with business objectives?

COBIT

ISO/IEC 27001

NIST Cybersecurity Framework

SOC 2 Type II

12. What is a key element of an effective IT change management process?

Allowing immediate changes without approval

Requiring approval, testing, and rollback plans

Limiting changes to weekends only

Documenting changes after implementation

13. Which of the following best defines 'residual risk'?

Risk that exists before any controls are applied

Risk remaining after controls have been implemented

Risk that only affects financial systems

Risk identified during external audits

14. What is the main objective of an internal audit function?

Generate revenue for the organization

Evaluate effectiveness of governance, risk, and controls

Replace external auditors

Approve all IT expenditures

15. In IT governance, what does 'segregation of duties' primarily prevent?

Fraud and unauthorized transactions

System downtime

User password changes

Software updates

16. Which control type is most effective for identifying unauthorized changes to production systems?

Preventive control

Detective control

Corrective control

Compensating control

17. What is the purpose of a risk register in IT governance?

Track all identified risks and their mitigation strategies

Record only critical risks

List all IT assets only

Document user complaints

18. Which risk assessment approach evaluates the likelihood and impact of identified threats?

Qualitative risk assessment

Quantitative risk assessment

Both qualitative and quantitative methods

Subjective risk assessment

19. In CISA terms, what does 'preventive control' primarily aim to do?

Detect unauthorized access after it occurs

Stop a risk or unwanted event before it happens

Document security incidents

Train users on security awareness

20. What is the primary responsibility of an audit committee in an organization?

Execute IT operations daily

Oversee financial reporting and internal controls

Manage all employee performance reviews

Approve marketing budgets