Question 1

Confidentiality of information is an ethical consideration for which of the following party or parties?
A)Management
B)Employees
C)Consultants
D)All of the above.

Accepted Answer

Confidentiality of information is an ethical consideration for all parties mentioned, including management, employees, and consultants. It is important for all parties to respect and maintain the confidentiality of sensitive information to protect both the organization and individuals involved.

Question 2

Each of the following are methods for implementing a new application system except:
A)Direct cutover
B)Parallel
C)Pilot
D)Test

Accepted Answer

The question asks for methods for implementing a new application system, and testing is not a method of implementation but rather a step within the implementation process to ensure the system functions properly before going live. Therefore, the best choice is D, as it is not a method for implementing a new application system.

Question 3

Which of the following is not one of the approaches used to achieve the management of an IT control framework?
A)Information Systems Audit and Control Association control objectives for IT 
B)The International Organization for Standardization 17799, Code of Practice for Information Security Management
C)The Information Technology Infrastructure Library
D)Sarbanes-Oxley Act section on IT Controls

Accepted Answer

The Sarbanes-Oxley Act section on IT Controls is not an approach used to achieve the management of an IT control framework; it is a law that mandates certain practices in financial record keeping and reporting for corporations in the United States, including aspects related to IT controls, but it is not itself a management approach or framework.

Question 4

The IT governance committee is made up of many different individuals within the organization.Which of the following would not be one of those individuals?
A)Chief Information Officer
B)Chief External Auditor
C)Chief Executive Officer
D)Top Managers from User Departments

Accepted Answer

The chief external auditor is not typically a member of the IT governance committee. The other options - Chief Information Officer, Chief Executive Officer, and Top Managers from User Departments - are all potential members of the committee.

Question 5

A structure of relationships and processes to direct and control the enterprise in order to achieve the enterprise's goals by adding value while balancing risk versus return over IT and its processes is called:
A)IT Governance
B)Strategic Governance
C)Strategic Management
D)IT Management

Accepted Answer

The description fits the definition of IT Governance, which refers to the framework of authority and accountability used to guide the management and use of IT resources in support of organizational objectives. Strategic Governance and Strategic Management have a broader scope and apply to the management of the entire organization, not just IT. IT Management refers specifically to the management of IT operations and resources, but does not encompass the strategic direction and decision-making processes of IT governance.

Question 6

Which of the following is not part of the system design phase of the SDLC?
A)Conceptual design
B)Evaluation and selection
C)Parallel operation
D)Detailed design

Accepted Answer

Parallel operation is not part of the system design phase of the SDLC. It is a post-implementation phase where the new system runs alongside the old system for a period of time to ensure functionality and to minimize disruptions. The other options, conceptual design, evaluation and selection, and detailed design, are all key components of the system design phase.

Question 7

The use of the SDLC for IT system changes is important for several reasons.Which of the following is not part of the purposes of the SDLC processes?
A)As a part of strategic management of the organization
B)As part of the internal control structure of the organization
C)As part of the audit of an IT system
D)As partial fulfillment of management's ethical obligations

Accepted Answer

The SDLC processes are not specifically designed for the audit of an IT system. The main purposes of the SDLC processes are to ensure that IT system changes are made in a structured and controlled manner, to minimize risks associated with system changes, to ensure that the changes meet the needs of the business, and to provide a framework for managing and controlling IT projects. The other options (A, B, and D) are all valid purposes of the SDLC processes.

Question 8

Within the systems analysis phase of the SDLC, which of the following data collection methods does not involve any feedback from users of the IT system?
A)Documentation review
B)Interviews using structured questions
C)Interviews using unstructured questions
D)Questionnaires

Accepted Answer

Documentation review does not involve any feedback from users of the IT system. The other data collection methods involve direct or indirect feedback from users.

Question 9

A retail store chain is developing a new integrated computer system for sales and inventories in its store locations.Which of the following implementation methods would involve the most risk?
A)Direct cutover
B)Phased-in implementation
C)Parallel running
D)Pilot testing

Accepted Answer

Direct cutover involves immediately switching from the old system to the new system, which can be a high-risk approach as any issues with the new system could directly impact sales and inventory management. The other implementation methods (phased-in implementation, parallel running, and pilot testing) involve gradually introducing the new system while still relying on the old system for backup, which can help to mitigate risk.

Question 10

To fulfill the management obligations that are an integral part of IT governance, management need not focus on:
A)Aligning IT strategy with the business strategy
B)Hiring an acceptable IT manager
C)Measuring IT's performance
D)Insisting that an IT control framework be adopted and implemented

Accepted Answer

While hiring an acceptable IT manager is important, it is not the only obligation of management in IT governance. The other options are all essential for proper IT governance.

Question 11

A group of senior managers selected to oversee the strategic management of IT is called:
A)IT Strategic Committee
B)IT Governance Committee
C)Chief Information Officer (CIO)
D)IT Management

Accepted Answer

A group of senior managers selected to oversee the strategic management of IT is usually called the IT Governance Committee. This committee is responsible for ensuring that IT aligns with business goals, manages IT risks, and evaluates the effectiveness of IT investments. The other options are not as specific to the task of overseeing the strategic management of IT.

Question 12

Which of the following feasibility aspects is an evaluation of whether the technology exists to meet the need identified in the proposed change to the IT system?
A)Technical feasibility
B)Operational feasibility
C)Economic feasibility
D)Schedule feasibility

Accepted Answer

Technical feasibility is an evaluation of whether the technology exists to meet the need identified in the proposed change to the IT system. Operational feasibility is an evaluation of whether the proposed change will disrupt current operations, economic feasibility is an evaluation of the cost-effectiveness of the proposed change, and schedule feasibility is an evaluation of whether the proposed change can be implemented within a reasonable timeframe.

Question 13

The purpose of the feasibility study is to assist in
A)Selecting software 
B)Designing internal controls
C)Designing reports for the IT system
D)Prioritizing IT requested changes

Accepted Answer

Feasibility studies are conducted to assess whether a proposed project or solution is practical and viable. In the context of IT, feasibility studies are used to prioritize requested changes or projects based on their potential benefits, costs, and risks. Therefore, the purpose of the feasibility study is to assist in prioritizing IT requested changes (option D). The other options, such as selecting software (option A), designing internal controls (option B), or designing reports (option C), are not the main purpose of a feasibility study.

Question 14

IT governance includes all but which of the following responsibilities?
A)Aligning IT strategy with the business strategy
B)Writing programming code for IT systems
C)Insisting that an IT control framework be adopted and implemented
D)Measuring IT's performance

Accepted Answer

IT governance is not responsible for writing programming code for IT systems. The other responsibilities listed - aligning IT strategy with the business strategy, insisting on adoption of an IT control framework, and measuring IT performance - are all key responsibilities of IT governance.

Question 15

The formal process that many organizations use to select, design, and implement IT systems is the:
A)Systems Development Life Cycle
B)Control Objectives for IT
C)Practice for Security Management
D)Information Technology Development

Accepted Answer

The Systems Development Life Cycle (SDLC) is a formal process used by organizations to select, design, and implement IT systems. It is a structured approach to system design and consists of stages such as planning, analysis, design, implementation, and maintenance. The other options, Control Objectives for IT, Practice for Security Management, and Information Technology Development, are not specifically related to the process of selecting, designing, and implementing IT systems.

Question 16

A request for proposal (RFP) is used during the
A)Phase-in period.
B)Purchase of software 
C)Feasibility study
D)In-house design

Accepted Answer

An RFP is typically used during the purchase of software or other products/services. It is a document that is sent to potential vendors or suppliers, requesting them to submit a detailed proposal outlining their product/service, pricing, and other specifications. The RFP process is often used when a company or organization needs to make a significant purchase and wants to ensure they get the best value and quality for their investment.

Question 17

The process of determining the strategic vision for the organization, developing the long-term objectives, creating the strategies that will achieve the vision and objections, and implementing those strategies is referred to as
A)IT Governance
B)Strategic Governance
C)Strategic Management
D)IT Management

Accepted Answer

The process described in the question is commonly referred to as strategic management. It involves setting a vision and objectives for the organization, developing strategies to achieve them, and implementing those strategies. IT governance and IT management are more specific to the management of technology within an organization. While strategic governance could refer to a similar process, it is not as commonly used as strategic management.

Question 18

Which of the following steps within the systems implementation phase could not occur concurrently with other steps, but would occur at the end?
A)Employee training
B)Data conversion
C)Software programming 
D)Post-implementation review

Accepted Answer

Post-implementation review is conducted after the system has been implemented to evaluate its effectiveness and identify any areas for improvement. This step cannot occur concurrently with other steps and must be done at the end of the implementation phase. Employee training, data conversion, and software programming can all occur concurrently or at different stages of the implementation process.

Question 19

Which phase of the system development life cycle includes determining user needs of the IT system?
A)Systems planning
B)Systems analysis
C)Systems design
D)Systems implementation

Accepted Answer

Systems analysis is the phase of the system development life cycle where user needs are determined through various techniques such as interviews, surveys, and observations. This information is then analyzed by the development team to understand the requirements and constraints of the system to be developed. Systems planning focuses on the identification of the need for a new IT system, while systems design is concerned with creating a blueprint or model of the system. Systems implementation involves the actual development and deployment of the IT system.

Question 20

COBIT is an acronym for which of the following?
A)Control Objectives for Business and Information Technology
B)Control Objectives for Information and related Technology
C)Center for Business and Informative Technology
D)Control Operations for Business and Information Technology

Accepted Answer

COBIT stands for Control Objectives for Information and related Technology.

Quiz 5: IT Governance

Confidentiality of information is an ethical consideration for which of the following party or parties?

Each of the following are methods for implementing a new application system except:

Which of the following is not one of the approaches used to achieve the management of an IT control framework?

The IT governance committee is made up of many different individuals within the organization.Which of the following would not be one of those individuals?

A structure of relationships and processes to direct and control the enterprise in order to achieve the enterprise's goals by adding value while balancing risk versus return over IT and its processes is called:

Which of the following is not part of the system design phase of the SDLC?

The use of the SDLC for IT system changes is important for several reasons.Which of the following is not part of the purposes of the SDLC processes?

Within the systems analysis phase of the SDLC, which of the following data collection methods does not involve any feedback from users of the IT system?

A retail store chain is developing a new integrated computer system for sales and inventories in its store locations.Which of the following implementation methods would involve the most risk?

To fulfill the management obligations that are an integral part of IT governance, management need not focus on:

A group of senior managers selected to oversee the strategic management of IT is called:

Which of the following feasibility aspects is an evaluation of whether the technology exists to meet the need identified in the proposed change to the IT system?

The purpose of the feasibility study is to assist in

IT governance includes all but which of the following responsibilities?

The formal process that many organizations use to select, design, and implement IT systems is the:

A request for proposal (RFP) is used during the

The process of determining the strategic vision for the organization, developing the long-term objectives, creating the strategies that will achieve the vision and objections, and implementing those strategies is referred to as

Which of the following steps within the systems implementation phase could not occur concurrently with other steps, but would occur at the end?

Which phase of the system development life cycle includes determining user needs of the IT system?

COBIT is an acronym for which of the following?