Enterprise IT Governance Vocabulary
Practise vocabulary for enterprise IT governance: COBIT, IT governance frameworks, IT strategy, portfolio management, and decision rights.
0 / 26 completed
1 / 26
COBIT (Control Objectives for Information and Related Technologies) is an IT ___ framework that aligns IT with business objectives and manages risk.
COBIT is an IT governance and management framework that defines processes, practices, and goals for IT management. It covers IT governance (strategic alignment, value delivery) and IT management (build, run, monitor) across the enterprise.
2 / 26
IT ___ refers to the decision rights and accountability framework that ensures IT investments and activities align with business strategy.
IT governance defines who makes IT decisions, how they're made, and who's accountable for outcomes. It establishes policies, decision rights, and escalation paths — ensuring IT investments create business value and risks are managed.
3 / 26
An IT ___ committee provides executive oversight of major IT investments, risk management decisions, and strategic technology direction.
An IT Steering Committee (or IT Governance Board) brings together senior business and IT leaders to oversee major technology decisions: large investments, strategic initiatives, risk tolerance, and IT-business alignment. It's the governance body, not a management committee.
4 / 26
IT ___ management evaluates and prioritises the organisation's entire portfolio of IT investments against business value and strategic alignment.
IT Portfolio Management views all IT investments (projects, applications, infrastructure) as a portfolio — balancing risk and return, pruning low-value investments, and funding high-value initiatives. It's a strategic, not operational, discipline.
5 / 26
'Decision rights' in IT governance define who is ___ to make specific types of IT decisions — at what level and with what approval authority.
Decision rights clarify who can decide: technology standards (CTO), major investments (steering committee), architecture patterns (architecture board), operational practices (IT management). Unclear decision rights create delays, conflicts, and ungoverned decisions.
6 / 26
PR Description
```diff
--- a/feature/new-api-endpoint
+++ b/feature/new-api-endpoint
@@ -12,4 +12,4 @@
// New API endpoint for user profile data.
@GET
return userData;
+ return userData;
- This change introduces a new API endpoint to retrieve user profile information. It's crucial that this endpoint aligns with our security standards and is properly documented for future maintainability.The question assesses understanding of how IT governance principles should be applied during code development. While all options relate to good software practices, option '3' directly addresses the core concept: defining roles and responsibilities – specifically, who is accountable for ensuring that an API endpoint adheres to governance standards. The other options represent supporting activities, but aren't the primary driver of incorporating governance into a PR description.
7 / 26
Slack Message
Sarah: "Hey team, just reviewed the PR for the new payment gateway integration. The documentation is lacking detail around rate limiting – we've seen spikes in API calls from some users that could lead to throttling. I've added a comment requesting clarification on handling those scenarios."
Which of the following best describes Sarah's action regarding rate limiting and its connection to IT governance?
Sarah's comment highlights a crucial aspect of IT governance: risk management. Rate limiting is not merely a technical bug; it's a potential performance issue with significant business implications – impacting user experience and potentially violating service level agreements (SLAs). The correct answer acknowledges this oversight in risk assessment, demonstrating understanding of how governance frameworks like COBIT emphasize proactively identifying and mitigating potential negative impacts on IT systems. Option A is too simplistic, option C misses the governance angle entirely, and option D suggests a process failure that wasn't present.
8 / 26
PR Description
During a code review for a new microservice deployment, the developer provides this PR description:
"Implemented feature X. This service now exposes an API endpoint to retrieve customer order data. The endpoint uses a rate limit of 100 requests per minute to prevent abuse."This question tests understanding of how rate limiting fits into IT governance. Rate limiting is a direct application of risk management principles – specifically, preventing denial-of-service attacks and resource exhaustion. The developer's action demonstrates an awareness that simply exposing an API doesn't automatically guarantee its safe or efficient operation; it reflects the broader goal of controlling access and managing potential vulnerabilities as defined by IT governance policies. Incorrect options highlight common misconceptions like focusing solely on functionality or assuming rate limiting is always mandated.
9 / 26
Mark is reviewing a PR for a new recommendation engine. The developer has implemented the core logic but hasn't defined any limits on the number of recommendations generated per user session. During his review, Mark flags this as a potential risk, stating: 'Without rate limiting, users could potentially overload the system and negatively impact performance.' Considering this scenario, what aspect of IT governance is Mark primarily addressing?
Mark is addressing Risk Management. Rate limiting falls under risk mitigation by preventing a denial-of-service attack or excessive resource consumption. The other options – compliance, optimization, and SLAs – are related to IT governance but don't directly address the immediate concern of uncontrolled system load. This highlights the importance of proactively considering potential vulnerabilities during development.
10 / 26
PR Description
```diff
--- a/feature/new-api-endpoint
+++ b/feature/new-api-endpoint
@@ -12,4 +12,4 @@
// New API endpoint for user profile data.
@GET
return userData;
+ return userData;
- This change introduces a new API endpoint to retrieve user profile information. It's crucial that this endpoint aligns with our security standards and is properly documented for future maintainability.The question assesses understanding of how IT governance principles should be applied during code development. While all options relate to good software practices, option '3' directly addresses the core concept: defining roles and responsibilities – specifically, who is accountable for ensuring that an API endpoint adheres to governance standards. The other options represent supporting activities, but aren't the primary driver of incorporating governance into a PR description.
11 / 26
Slack Message
Sarah: "Hey team, just reviewed the PR for the new payment gateway integration. The documentation is lacking detail around rate limiting – we've seen spikes in API calls from some users that could lead to throttling. I've added a comment requesting clarification on handling those scenarios."
Which of the following best describes Sarah's action regarding rate limiting and its connection to IT governance?
Sarah's comment highlights a crucial aspect of IT governance: risk management. Rate limiting is not merely a technical bug; it's a potential performance issue with significant business implications – impacting user experience and potentially violating service level agreements (SLAs). The correct answer acknowledges this oversight in risk assessment, demonstrating understanding of how governance frameworks like COBIT emphasize proactively identifying and mitigating potential negative impacts on IT systems. Option A is too simplistic, option C misses the governance angle entirely, and option D suggests a process failure that wasn't present.
12 / 26
PR Description
During a code review for a new microservice deployment, the developer provides this PR description:
"Implemented feature X. This service now exposes an API endpoint to retrieve customer order data. The endpoint uses a rate limit of 100 requests per minute to prevent abuse."This question tests understanding of how rate limiting fits into IT governance. Rate limiting is a direct application of risk management principles – specifically, preventing denial-of-service attacks and resource exhaustion. The developer's action demonstrates an awareness that simply exposing an API doesn't automatically guarantee its safe or efficient operation; it reflects the broader goal of controlling access and managing potential vulnerabilities as defined by IT governance policies. Incorrect options highlight common misconceptions like focusing solely on functionality or assuming rate limiting is always mandated.
13 / 26
Mark is reviewing a PR for a new recommendation engine. The developer has implemented the core logic but hasn't defined any limits on the number of recommendations generated per user session. During his review, Mark flags this as a potential risk, stating: 'Without rate limiting, users could potentially overload the system and negatively impact performance.' Considering this scenario, what aspect of IT governance is Mark primarily addressing?
Mark is addressing Risk Management. Rate limiting falls under risk mitigation by preventing a denial-of-service attack or excessive resource consumption. The other options – compliance, optimization, and SLAs – are related to IT governance but don't directly address the immediate concern of uncontrolled system load. This highlights the importance of proactively considering potential vulnerabilities during development.
14 / 26
PR Description
```diff
--- a/feature/new-api-endpoint
+++ b/feature/new-api-endpoint
@@ -12,4 +12,4 @@
// New API endpoint for user profile data.
@GET
return userData;
+ return userData;
- This change introduces a new API endpoint to retrieve user profile information. It's crucial that this endpoint aligns with our security standards and is properly documented for future maintainability.The question assesses understanding of how IT governance principles should be applied during code development. While all options relate to good software practices, option '3' directly addresses the core concept: defining roles and responsibilities – specifically, who is accountable for ensuring that an API endpoint adheres to governance standards. The other options represent supporting activities, but aren't the primary driver of incorporating governance into a PR description.
15 / 26
Slack Message
Sarah: "Hey team, just reviewed the PR for the new payment gateway integration. The documentation is lacking detail around rate limiting – we've seen spikes in API calls from some users that could lead to throttling. I've added a comment requesting clarification on handling those scenarios."
Which of the following best describes Sarah's action regarding rate limiting and its connection to IT governance?
Sarah's comment highlights a crucial aspect of IT governance: risk management. Rate limiting is not merely a technical bug; it's a potential performance issue with significant business implications – impacting user experience and potentially violating service level agreements (SLAs). The correct answer acknowledges this oversight in risk assessment, demonstrating understanding of how governance frameworks like COBIT emphasize proactively identifying and mitigating potential negative impacts on IT systems. Option A is too simplistic, option C misses the governance angle entirely, and option D suggests a process failure that wasn't present.
16 / 26
PR Description
During a code review for a new microservice deployment, the developer provides this PR description:
"Implemented feature X. This service now exposes an API endpoint to retrieve customer order data. The endpoint uses a rate limit of 100 requests per minute to prevent abuse."This question tests understanding of how rate limiting fits into IT governance. Rate limiting is a direct application of risk management principles – specifically, preventing denial-of-service attacks and resource exhaustion. The developer's action demonstrates an awareness that simply exposing an API doesn't automatically guarantee its safe or efficient operation; it reflects the broader goal of controlling access and managing potential vulnerabilities as defined by IT governance policies. Incorrect options highlight common misconceptions like focusing solely on functionality or assuming rate limiting is always mandated.
17 / 26
Mark is reviewing a PR for a new recommendation engine. The developer has implemented the core logic but hasn't defined any limits on the number of recommendations generated per user session. During his review, Mark flags this as a potential risk, stating: 'Without rate limiting, users could potentially overload the system and negatively impact performance.' Considering this scenario, what aspect of IT governance is Mark primarily addressing?
Mark is addressing Risk Management. Rate limiting falls under risk mitigation by preventing a denial-of-service attack or excessive resource consumption. The other options – compliance, optimization, and SLAs – are related to IT governance but don't directly address the immediate concern of uncontrolled system load. This highlights the importance of proactively considering potential vulnerabilities during development.
18 / 26
PR Description
```diff
--- a/feature/new-api-endpoint
+++ b/feature/new-api-endpoint
@@ -12,4 +12,4 @@
// New API endpoint for user profile data.
@GET
return userData;
+ return userData;
- This change introduces a new API endpoint to retrieve user profile information. It's crucial that this endpoint aligns with our security standards and is properly documented for future maintainability.The question assesses understanding of how IT governance principles should be applied during code development. While all options relate to good software practices, option '3' directly addresses the core concept: defining roles and responsibilities – specifically, who is accountable for ensuring that an API endpoint adheres to governance standards. The other options represent supporting activities, but aren't the primary driver of incorporating governance into a PR description.
19 / 26
Slack Message
Sarah: "Hey team, just reviewed the PR for the new payment gateway integration. The documentation is lacking detail around rate limiting – we've seen spikes in API calls from some users that could lead to throttling. I've added a comment requesting clarification on handling those scenarios."
Which of the following best describes Sarah's action regarding rate limiting and its connection to IT governance?
Sarah's comment highlights a crucial aspect of IT governance: risk management. Rate limiting is not merely a technical bug; it's a potential performance issue with significant business implications – impacting user experience and potentially violating service level agreements (SLAs). The correct answer acknowledges this oversight in risk assessment, demonstrating understanding of how governance frameworks like COBIT emphasize proactively identifying and mitigating potential negative impacts on IT systems. Option A is too simplistic, option C misses the governance angle entirely, and option D suggests a process failure that wasn't present.
20 / 26
PR Description
During a code review for a new microservice deployment, the developer provides this PR description:
"Implemented feature X. This service now exposes an API endpoint to retrieve customer order data. The endpoint uses a rate limit of 100 requests per minute to prevent abuse."This question tests understanding of how rate limiting fits into IT governance. Rate limiting is a direct application of risk management principles – specifically, preventing denial-of-service attacks and resource exhaustion. The developer's action demonstrates an awareness that simply exposing an API doesn't automatically guarantee its safe or efficient operation; it reflects the broader goal of controlling access and managing potential vulnerabilities as defined by IT governance policies. Incorrect options highlight common misconceptions like focusing solely on functionality or assuming rate limiting is always mandated.
21 / 26
Mark is reviewing a PR for a new recommendation engine. The developer has implemented the core logic but hasn't defined any limits on the number of recommendations generated per user session. During his review, Mark flags this as a potential risk, stating: 'Without rate limiting, users could potentially overload the system and negatively impact performance.' Considering this scenario, what aspect of IT governance is Mark primarily addressing?
Mark is addressing Risk Management. Rate limiting falls under risk mitigation by preventing a denial-of-service attack or excessive resource consumption. The other options – compliance, optimization, and SLAs – are related to IT governance but don't directly address the immediate concern of uncontrolled system load. This highlights the importance of proactively considering potential vulnerabilities during development.
22 / 26
During a code review of a new API endpoint for user authentication, Liam comments: 'This endpoint lacks any rate limiting. We've seen reports of brute-force attacks targeting this service in the past.' Which of the following best describes Liam's concern regarding governance?
GET /auth/login
Liam is highlighting a critical governance issue: failing to address potential security risks. Rate limiting is a fundamental control for mitigating denial-of-service attacks and brute-force attempts. The other options represent different technical concerns, but Liam's comment directly relates to the principle of risk management within IT governance – protecting systems from harm.
23 / 26
In a Slack channel discussing changes to the order processing microservice, Elena writes: 'Just added support for handling large orders. This should improve throughput but we need to monitor resource utilization closely.' What aspect of IT governance is Elena primarily addressing?
Elena's message suggests a focus on…
Elena's message centers on operational governance – how a system is actually *used* and monitored. Monitoring resource utilization directly relates to performance management and capacity planning, key components of IT governance. While the other options are relevant considerations, they aren't the primary focus of Elena's statement.
24 / 26
A developer submits a PR with the following description: 'Updated the user preference service to support new UI elements. This change increases the API call volume for retrieving user settings.' Considering IT governance principles, which statement best reflects the key consideration in this PR?
The developer's focus is on…
The developer's description emphasizes the need to consider the *impact* of changes – specifically, the increase in API call volume. This directly relates to IT governance's focus on managing system load and ensuring scalability. While performance optimization is a related concern, the primary governance consideration here is proactively assessing potential resource strain.
25 / 26
During daily stand-up, David reports: 'I've finished implementing the new fraud detection module. It uses machine learning to identify suspicious transactions.' What aspect of IT governance is David implicitly addressing?
David's update highlights…
David's update highlights…
David's statement about using machine learning implicitly raises governance concerns around risk management. AI systems can introduce biases or operate unpredictably if not carefully monitored and controlled. This falls squarely within the scope of IT governance – assessing potential risks associated with new technologies and ensuring responsible implementation.
26 / 26
The API returns the following JSON response for a user profile request:
{
"user": {
"name": "John Doe",
"email": "john.doe@example.com",
"preferences": {
"theme": "dark",
"notifications": true
}
},
"timestamp": 1678886400
}
Considering data governance, what key principle is this API response demonstrating?
The response highlights…The inclusion of a 'timestamp' in the API response is demonstrating data governance best practice: creating an audit trail. This allows tracking who accessed the profile and when, which is crucial for compliance, security investigations, and understanding usage patterns – directly aligning with IT governance principles related to accountability and transparency.
Frequently Asked Questions
What does the "Enterprise IT Governance Vocabulary" exercise cover?
Practise vocabulary for enterprise IT governance: COBIT, IT governance frameworks, IT strategy, portfolio management, and decision rights.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "Enterprise IT Governance Vocabulary"?
This exercise has 26 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Enterprise Architecture Language exercises?
Browse the full Enterprise Architecture Language hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.