IT governance — CPA ISC practice questions

Within the NIST CSF, the 'Identify' function primarily involves:

1. Actively blocking an ongoing attack in real time
2. Understanding organizational context, assets, risks, and governance to manage cybersecurity risk (e.g., asset inventories, risk assessments)
3. Restoring systems after an incident has been fully resolved
4. Detecting anomalous activity on the network

Answer: B — Understanding organizational context, assets, risks, and governance to manage cybersecurity risk (e.g., asset inventories, risk assessments)

A) Actively blocking an attack describes activities within PROTECT or RESPOND, not Identify. B) Correct — Identify focuses on developing organizational understanding of context, assets, data, and risks (asset inventories, risk assessments, governance structures) that inform the rest of the cybersecurity risk management program. C) Post-incident restoration describes the RECOVER function, not Identify. D) Detecting anomalous activity describes the DETECT function, not Identify.

The Three Lines of Defense model assigns risk responsibilities to:

1. Legal, marketing, and sales departments across all business function reporting lines
2. IT operations, security operations, and network engineering teams working together
3. Operational management, risk and compliance functions, and internal audit oversight
4. Board of directors, audit committee, and external independent auditor firm services

Answer: C — Operational management, risk and compliance functions, and internal audit oversight

A) Those are business functions, not the three lines. B) Those are all first-line operational teams. C) Correct — 1st: operations, 2nd: risk/compliance, 3rd: internal audit. D) The board and external auditor sit outside the three lines model.

A comprehensive ISC synthesis scenario asks a candidate to evaluate an organization's overall technology risk posture using ISMS certification status, identity governance maturity, AI/ML model governance, OT security segmentation, and BCP/DR metrics together. The BEST approach is to:

1. Evaluate each area in isolation with no attempt to connect findings into an overall risk posture assessment
2. Focus exclusively on whichever single area has the most impressive-sounding certification and ignore the rest
3. Synthesize findings across areas — for example, linking weak identity governance (SoD gaps) to elevated risk in a poorly segmented OT environment with immature BCP/DR targets, informing an overall technology risk conclusion
4. Conclude the five areas are entirely unrelated and cannot inform one overall assessment

Answer: C — Synthesize findings across areas — for example, linking weak identity governance (SoD gaps) to elevated risk in a poorly segmented OT environment with immature BCP/DR targets, informing an overall technology risk conclusion

A) Isolated single-area review misses the exam's clear intent to test integrated judgment across governance, security, and resilience domains simultaneously. C) Correct — the ISC exam (and real-world technology risk assessment) rewards synthesizing multiple data points into a coherent overall risk posture, connecting how weaknesses in one area (e.g., identity governance) can compound risk in another (e.g., an under-segmented OT environment with weak recovery capability). B) Fixating on a single certification while ignoring other risk indicators would produce an incomplete and potentially misleading overall risk conclusion. D) These areas are interconnected in a real technology environment (access controls, segmentation, model governance, and resilience all interact), and a well-reasoned synthesis is both possible and expected.

A company evaluating whether to build a formal AI/ML model risk governance program alongside its existing COBIT-based IT governance structure should recognize that:

1. COBIT's governance/management structure (evaluate, direct, monitor / plan, build, run, monitor) can be extended to explicitly cover AI/ML-specific risks like model drift, bias, and explainability, rather than requiring an entirely separate, disconnected governance structure
2. AI/ML models require no governance since they are purely a technical/engineering concern
3. COBIT is incompatible with any technology developed after COBIT's initial publication date
4. Model risk governance and IT governance must always be handled by entirely separate committees with no communication between them

Answer: A — COBIT's governance/management structure (evaluate, direct, monitor / plan, build, run, monitor) can be extended to explicitly cover AI/ML-specific risks like model drift, bias, and explainability, rather than requiring an entirely separate, disconnected governance structure

A) Correct — COBIT's governance/management structure is designed to be extensible to emerging technology risks; an organization can incorporate AI/ML-specific risk considerations (drift, bias, explainability) into its existing governance objectives rather than building an entirely siloed, disconnected framework. B) AI/ML models used in impactful business decisions clearly warrant governance, given the model risk, bias, and explainability concerns discussed throughout this topic area. C) COBIT is a flexible, technology-agnostic governance framework intended to remain applicable as new technologies emerge, not tied to specific technologies existing at its publication. D) Effective governance benefits from integration and communication between IT governance and specialized risk domains like AI/ML, rather than complete organizational silos.

COBIT's governance and management objectives are organized around the distinction that:

1. Governance ensures stakeholder needs are evaluated and direction is set, while management plans, builds, runs, and monitors activities to achieve enterprise objectives
2. Governance and management are identical concepts with no meaningful distinction in COBIT
3. Management is performed solely by the board of directors, with no operational role
4. Governance applies only to IT departments, while management applies to all other departments

Answer: A — Governance ensures stakeholder needs are evaluated and direction is set, while management plans, builds, runs, and monitors activities to achieve enterprise objectives

A) Correct — COBIT explicitly separates governance (evaluate, direct, monitor at the board/executive level) from management (plan, build, run, monitor at the operational level). B) Wrong — COBIT deliberately distinguishes the two as separate but related activities. C) Wrong — management activities are typically performed by operational management, not the board. D) Wrong — COBIT's governance/management distinction applies broadly to enterprise IT, not as a departmental split.

Considering ISC's full content arc through Part 25 — spanning governance frameworks, technical security architecture, privacy law, emerging technology risk, assurance/audit skills, and now deeper SOC reporting mechanics, cryptographic lifecycle management, and business continuity testing rigor — a well-prepared candidate's mental model should treat these domains as:

1. Entirely separate silos with no overlap or interaction in realistic exam scenarios
2. An integrated whole, where a realistic engagement or business scenario often requires drawing on multiple domains simultaneously (e.g., a cloud migration scenario touching shared responsibility, encryption, access control, and SOC report scoping all at once)
3. A list to memorize in isolation, since the exam never combines topics across these domains
4. Irrelevant to each other, since governance, technical security, privacy, and assurance are tested in completely separate exam sections with no crossover

Answer: B — An integrated whole, where a realistic engagement or business scenario often requires drawing on multiple domains simultaneously (e.g., a cloud migration scenario touching shared responsibility, encryption, access control, and SOC report scoping all at once)

A) Incorrect — the numerous synthesis/capstone questions throughout Parts 18-25 specifically demonstrate that these domains interact and combine in realistic scenarios, not stay siloed. B) Correct — ISC content is best understood as an integrated whole: realistic business and engagement scenarios (like the cloud migration example) routinely require simultaneously drawing on cloud shared-responsibility concepts, cryptography scope decisions, access control model selection, and assurance/reporting considerations together, reflecting how these domains genuinely interact in practice. C) Incorrect — the exam's design (and this content's extensive synthesis questions) specifically reward the ability to combine topics, not memorize them in isolation. D) Incorrect — this understates how interconnected governance, technical security, privacy, and assurance actually are in real engagements and in how the ISC Discipline blueprint is structured and tested.

COBIT's 'Evaluate, Direct, Monitor' (EDM) activities are performed at which organizational level?

1. Front-line help desk technicians exclusively
2. The governing body (e.g., board or executive governance committee), setting direction and monitoring outcomes rather than performing day-to-day operations
3. Only third-party vendors under contract
4. Entry-level IT support staff handling password resets

Answer: B — The governing body (e.g., board or executive governance committee), setting direction and monitoring outcomes rather than performing day-to-day operations

A) Front-line help desk staff perform operational management tasks, not the board-level EDM governance activities. B) Correct — EDM activities are performed by the enterprise's governing body, which evaluates stakeholder needs, directs strategy/priorities, and monitors performance and compliance, distinct from operational management. C) Third-party vendors execute contracted services; they don't perform the enterprise's own governance evaluation and direction-setting function. D) Entry-level support tasks like password resets are operational management activities, far removed from board-level governance.

Effective board oversight of cybersecurity typically requires that the board:

1. Directly manage the day-to-day incident response operations of the security team
2. Delegate the entire cyber program to the CISO without any further ongoing oversight
3. Perform vulnerability scans on production systems on a weekly rotating schedule directly
4. Understand cyber risk, review key metrics, and oversee management's response plans

Answer: D — Understand cyber risk, review key metrics, and oversee management's response plans

A) Boards oversee; they don't manage day-to-day operations. B) Full delegation without oversight fails governance obligations. C) Boards don't perform technical scanning. D) Correct — the standard board oversight model for cyber risk.

Primary purpose of an ERP system:

1. Integrate core business processes on one platform with shared data
2. Track only customer interactions and sales pipeline activity
3. Manage only supplier orders and inbound logistics workflows
4. Automate end-user desktop tasks with software robots and bots

Answer: A — Integrate core business processes on one platform with shared data

A) Correct — ERP unifies finance, HR, supply chain, sales on one platform. B) That describes CRM, not ERP. C) That describes SCM, not ERP. D) That describes RPA, not ERP.

A 'containerized' approach to BYOD device management (separating a secure corporate 'container' app/workspace from personal apps/data on the same device) is primarily intended to:

1. Physically split the phone into two separate hardware devices
2. Apply only to company-owned devices, never to true BYOD scenarios
3. Eliminate the need for any encryption on the device
4. Logically isolate and protect corporate data and applications from the device's personal side, allowing the organization to manage/wipe only the corporate container without affecting personal data

Answer: D — Logically isolate and protect corporate data and applications from the device's personal side, allowing the organization to manage/wipe only the corporate container without affecting personal data

A) Containerization is a logical/software-based separation, not a physical hardware split of the device. D) Correct — containerization creates a logically isolated, managed workspace for corporate data/apps, allowing the organization to enforce policies and perform actions like a selective wipe of just the corporate container, without touching the employee's personal data and apps. C) Containerized workspaces typically still rely on underlying encryption for the protected data; it doesn't replace that need. B) Containerization is specifically valuable in TRUE BYOD scenarios, precisely because it lets personal and corporate data coexist on the same personally owned device with appropriate separation.

COBIT design factors?

Used to tailor a governance system to an enterprise's specific context — strategy, risk profile, threat landscape, compliance needs, etc.

Classification without a tailored retention period — what risk does this create?

Data may be destroyed too early (non-compliance) or kept too long (increased exposure) — classification and retention must work together.

'Shifting left' on security?

Moving security testing/controls earlier in the development lifecycle (coding, build) rather than only at the end.

Why do automated controls need less extensive samples than manual controls?

A properly functioning automated control applies identical logic to every transaction (absent a change), reducing the variability manual controls introduce.