ISC Review

Q1. Which of the following best describes the primary difference between IT governance and IT management?

• IT governance focuses on operational execution while IT management establishes strategic direction
• IT governance establishes strategic direction and decision-making authority while IT management focuses on day-to-day operations
• IT governance is performed by technical staff while IT management is performed by business executives
• IT governance manages technology infrastructure while IT management handles business processes

Q4. According to the COBIT 2019 framework, which domain focuses on measuring IT performance and assessing whether governance and management processes operate effectively?

• Align, Plan, and Organise
• Build, Acquire, and Implement
• Deliver, Service, and Support
• Monitor, Evaluate, and Assess

Q7. In the COSO Enterprise Risk Management Framework, which component establishes the foundation through board oversight, operating structures, and organizational culture?

• Strategy and Objective-Setting
• Governance and Culture
• Performance
• Review and Revision

Q13. In the NIST Cybersecurity Framework, which function focuses on implementing capabilities to identify cybersecurity events promptly?

• Identify
• Protect
• Detect
• Respond

Q16. According to COBIT's design factors methodology, which of the following is NOT one of the factors used to customize governance systems?

• Enterprise size
• Employee satisfaction scores
• Threat landscape
• Compliance requirements

Q19. What is the primary benefit of implementing zero trust architecture compared to traditional security models?

• Zero trust eliminates all security threats
• Zero trust requires continuous verification regardless of location rather than assuming network-based trust
• Zero trust is less expensive to implement
• Zero trust removes the need for authentication

Q21. What type of risk assessment uses descriptive scales such as low, medium, and high to rate likelihood and impact based on expert judgment?

• Quantitative risk assessment
• Qualitative risk assessment
• Scenario-based assessment
• Probabilistic assessment

Q24. What is the primary characteristic that distinguishes microservices architecture from traditional service-oriented architecture?

• Microservices are larger and more comprehensive
• Microservices are very small, highly focused services that can be independently deployed and scaled
• Microservices eliminate the need for APIs
• Microservices can only run on mainframe systems

Q25. In the context of IT strategic planning, what is the typical time horizon for IT strategic plans?

• 1-2 months
• 6-12 months
• 3-5 years
• 10-15 years

Q27. What is the primary purpose of business impact analysis (BIA) in risk management?

• To calculate annual profit margins
• To evaluate potential consequences of disruptions to business processes and systems
• To determine employee satisfaction levels
• To assess marketing effectiveness