ISACA study guides,
simply explained.

Correct answer: C

Agile project management involves iterative delivery cycles, frequent sprint reviews, continuous backlog refinement, and adaptive planning, all of which require active and informed steering committee engagement at each iteration. If committee members lack agile experience, they may apply waterfall-oriented oversight expectations that conflict with agile principles, undermining project governance. Agile methodology experience is therefore the most critical criterion for the committee's composition when agile is the chosen approach.

• ASenior management representation is important for decision-making authority but does not ensure that members understand the governance demands of an agile delivery model.
• BAvailability to meet the time commitment is a prerequisite for any committee member but is a general requirement rather than a distinguishing criterion specific to the agile context of this project.
• DERP implementation experience is valuable but secondary; members who understand ERP but not agile may impose inappropriate oversight structures that undermine the project's chosen methodology.

The CISA guide explains every answer.

Correct answer: D

The core problem is that declining participation is leaving employees without the knowledge needed to avoid phishing and malware threats, which is directly contributing to the increase in incidents. Making the training mandatory ensures organization-wide coverage and removes voluntary participation as a variable, addressing the root cause of both problems simultaneously. Reporting to management, adding phishing simulations, or deploying a reporting tool are useful supporting actions but do not solve the fundamental coverage gap.

• AEscalating to senior management for guidance defers the decision rather than resolving it; the information security manager has a clear path of action and should act, not wait for direction.
• BA phishing reporting tool improves detection and response but does not address the root cause, which is that employees who skip training lack the awareness to recognize threats in the first place.
• CSimulated phishing campaigns are an effective reinforcement mechanism but are most effective when employees have first received foundational awareness training; they do not substitute for that training.

The CISM guide explains every answer.

Correct answer: A

Compensating controls may degrade over time, be changed without coordination, or become less effective as the threat environment evolves. Scheduling periodic reviews ensures the controls continue to operate as intended and that the residual risk level remains within acceptable limits. This is the core of residual risk management: sustained monitoring of the controls on which the organization is relying.

• BReporting to senior management is appropriate communication but is not a mechanism for actively managing residual risk over time; it does not ensure the controls remain effective.
• CAdding more IT controls may not be warranted if the existing compensating controls are adequate; recommending additional controls without evidence of a gap creates unnecessary complexity and cost.
• DReassigning ownership to IT may disrupt the business process controls and create confusion about accountability; ownership should follow the control, not the risk practitioner's preference for organizational placement.

The CRISC guide explains every answer.

Correct answer: D

Governance frameworks must accommodate legitimate exceptions where the benefit of deviation outweighs the cost of non-conformance. An architecture exception process allows the enterprise to evaluate the specific situation, attach conditions (such as a time-bound approval, risk mitigation requirements, or a path to eventual alignment), and make a documented, accountable decision. Automatically rejecting a high-value initiative or immediately rewriting the strategy are both governance overreactions; an operational change request is for routine changes, not strategic exceptions.

• AUpdating the strategy to follow a single project inverts the governance relationship between strategy and execution.
• BAn operational change request manages changes within the approved architecture; it is not the mechanism for strategic deviations.
• CAutomatic rejection without evaluation ignores the business benefit and undermines IT's role as a business enabler.

The CGEIT guide explains every answer.

Correct answer: B

A data dictionary defines and documents each data element's name, meaning, format, allowable values, source, ownership, and permissible uses, establishing a common organizational language and governance framework for how personal data is understood and handled. By standardizing these definitions, the data dictionary ensures that all business units apply consistent rules to personal data usage, supporting transparency, accuracy, and accountability across the big data initiative. The other options address specific risks but do not provide the organization-wide definitional standardization that a data dictionary delivers.

• ADe-identifying data reduces re-identification risk but does not standardize how personal data is defined, classified, or used across business units before de-identification occurs; it also limits the analytical value of the data.
• CEncrypting sensitive data protects confidentiality but does not establish standard definitions or permitted uses; encryption is a security control, not a data governance mechanism.
• DData discovery identifies where personal data resides, which is a prerequisite for governance, but does not itself define or standardize how that data should be used across the organization.

The CDPSE guide explains every answer.

Correct answer: A

Excessive agency occurs when an AI system is granted more capabilities or permissions than are needed for its defined purpose, creating opportunities for unintended, unauthorized, or harmful autonomous actions. Restricting functionality to the minimum required, following a least-privilege principle applied to AI capabilities, directly limits the scope of actions the system can take and is the recognized mitigation for this risk category.

• BRemoving user access eliminates the tool entirely and is a disproportionate response; it does not provide a risk mitigation model applicable to legitimate use cases.
• CExpanding functionality increases the model's autonomous action space, which is the definition of greater agency, directly worsening the risk rather than mitigating it.
• DOpen-source extensions allow code review but do not limit what the AI system can do at runtime; auditability does not constrain the scope of autonomous actions.

The AAIA guide explains every answer.

Correct answer: B

Mapping identified threats to the existing enterprise control catalog ensures that control selection is consistent with the organization's established risk management framework and avoids duplicating or contradicting existing controls. Supplementing this with AI-specific safeguards that address the unique characteristics of prompt manipulation and data leakage provides comprehensive, risk-aligned coverage that neither a vendor-only approach nor a generic control baseline alone can deliver.

• AVendor security features and third-party certifications address the vendor's compliance posture and not necessarily the specific threats the organization has identified in its own risk assessment context.
• CSourcing controls only from external frameworks may miss controls already available in the enterprise catalog and risks creating an inconsistent, siloed security program.
• DDeferring control selection until after deployment leaves the platform unprotected during its initial operation and violates the principle of addressing identified risks before exposing the system to production use.

The AAISM guide explains every answer.