To ensure that information can be traced to the originating event and accountable parties, an enterprise should FIRST:

A. improve business process controls.
B. capture source information and supporting evidence.
C. review information event logs for potential incidents.
D. review retention requirements for source information.

Which of the following is MOST important to consider when planning to implement a cloud-based application for sharing documents with internal and external parties?

A. Information ownership
B. Cloud implementation model
C. User experience
D. Third-party access rights

Which of the following would be MOST important to update if a decision is made to ban end user-owned devices in the workplace?

A. Orientation training materials
B. Enterprise risk appetite statement
C. Employee nondisclosure agreement
D. Enterprise acceptable use policy

An enterprise has made the strategic decision to begin a global expansion program which will require opening sales offices in countries across the world. Which of the following should be the FIRST consideration with regard to the IT service desk which will remain centralized?

A. The effect of regional differences on service delivery
B. Identification of IT service desk functions that can be outsourced
C. Availability of adequate resources to provide support for new users
D. Enforcement of a standardized policy across all regions

Which of the following provides the BEST assurance on the effectiveness of IT service management processes?

A. Compliance with internal controls
B. Key risk indicators (KRIs)
C. Continuous monitoring
D. Performance of incident response

Which of the following is the MOST valuable input when quantifying the loss associated with a major risk event?

A. Key risk indicators (KRIs)
B. Recovery time objectives (RTOs)
C. IT environment threat modeling
D. Business impact analysis (BIA) report

The BEST way to manage continuous improvement of governance-related processes is to:

A. assess existing process resource capacities.
B. apply effective quality management practices.
C. require third-party independent reviews.
D. define accountability based on roles and responsibilities.

A new chief information officer (CIO) of an enterprise recommends implementing portfolio management after realizing there is no process in place for evaluating investments prior to selection. What should be the PRIMARY strategic goal driving this decision?

A. Standardize processes for investment evaluation.
B. Align investments to the enterprise architecture (EA).
C. Maximize value from the combined investments.
D. Enable transparency within the investment process.

Which of the following is the BEST method to confirm whether a pilot project was successful?

A. Evaluate whether the pilot project achieved planned schedule and cost.
B. Review the metrics recorded in the IT balanced scorecard.
C. Assess the results of the pilot project against the expected performance outcomes.
D. Determine whether the pilot aligns with the as-is enterprise architecture (EA).

Communicating which of the following to staff BEST demonstrates senior management's commitment to IT governance?

A. Objectives and responsibilities
B. Need for enterprise architecture (EA)
C. Approved IT investment opportunities
D. Legal and regulatory requirements