Isaca Certification CGEIT Syllabus Exam Questions Answers

The main reason for an enterprise to implement an IT risk management framework is the need to enable IT risk-aware decisions by executives, as it helps to ensure that the IT risks are aligned with the enterprise strategy, objectives, and risk appetite. IT risk management also provides a consistent and structured approach to identify, analyze, treat, and monitor IT-related business risks, and to communicate and report them to the relevant stakeholders12. References := CGEIT Exam Content Outline, Domain 4, Subtopic B: IT Risk Management, Task 1: Ensure that an IT risk management framework exists to identify, analyze, mitigate, manage, monitor, and communicate IT-related business risk, and that the framework for IT risk management is in alignment with the enterprise risk management (ERM) framework.

 An enterprise acceptable use policy is the most important document to update if a decision is made to ban end user-owned devices in the workplace, as it defines and communicates the rules and guidelines for the appropriate and secure use of IT resources and services by the employees and other authorized users. An enterprise acceptable use policy also helps to protect the enterprise’s data, assets, and reputation from unauthorized or malicious access, disclosure, or damage12. Updating the enterprise acceptable use policy to reflect the ban on end user-owned devices can help to ensure compliance, awareness, and enforcement of the decision. References := CGEIT Exam Content Outline, Domain 1, Subtopic C: Information Governance, Task 2: Ensure that information governance processes are aligned with the enterprise risk management (ERM) processes.

 Continuous monitoring provides the best assurance on the effectiveness of IT service management processes because it involves collecting, analyzing, and reporting data on the performance, quality, and outcomes of the IT services on an ongoing basis. Continuous monitoring helps to identify and address any issues, gaps, or deviations from the expected standards and goals of the IT service management processes. It also helps to measure and demonstrate the value and impact of the IT services to the customers and stakeholders. Continuous monitoring can also support continuous improvement and innovation of the IT service management processes by providing feedback and insights for decision-making and planning

 This is because before decommissioning an IT system, it is most important to ensure that the data stored on the system is handled according to the retention policy of the organization. A retention policy is a document that specifies how long and where different types of data should be kept, archived, or deleted, based on the business, legal, and regulatory requirements. Assessing compliance with the retention policy can help to avoid data loss, leakage, or breach, as well as comply with the applicable laws and regulations.

Assessing compliance with environmental regulations is not the most important action, as it is a secondary consideration for decommissioning an IT system. Environmental regulations are rules that govern the disposal or recycling of IT equipment and materials, such as batteries, cables, or monitors, in order to protect the environment and human health. Assessing compliance with environmental regulations can help to reduce the environmental impact and waste of IT resources, as well as avoid fines or penalties. However, assessing compliance with environmental regulations does not address the primary concern of data management and security.

Reviewing the media disposal records is not the most important action, as it is a subsequent step after assessing compliance with the retention policy. Media disposal records are documents that provide evidence and verification of the proper disposal or destruction of IT media, such as hard drives, tapes, or disks, that contain sensitive or confidential data. Reviewing the media disposal records can help to ensure that the data on the IT system is erased or overwritten in a secure and irreversible manner, as well as comply with the audit and accountability requirements. However, reviewing the media disposal records does not provide a comprehensive assessment or guidance for data retention and compliance.

Reviewing the data sanitation records is not the most important action, as it is a similar step to reviewing the media disposal records. Data sanitation records are documents that provide evidence and verification of the proper sanitation or cleansing of data on an IT system, such as deleting, encrypting, or masking data that is no longer needed or relevant. Reviewing the data sanitation records can help to ensure that the data on the IT system is protected from unauthorized access, disclosure, modification, or destruction, as well as comply with the privacy and confidentiality requirements. However, reviewing the data sanitation records does not provide a thorough assessment or guidance for data retention and compliance.

References := Best Practices in Designing a Data Decommissioning Policy, Introduction section. Server Decommissioning: a Brief Guide and Checklist, Notify all relevant parties about server decommissioning section. Deconstructing Decommissioning: Best Practices for Managing the Final Mile of Critical Assets, Here are seven best practices that when implemented can go a long way to ensure a successful decommissioning section. How to decommission a system: 3 keys to success - Enable Sysadmin, How to decommission a system: 3 keys to success section.