You’re on a roll
Create a free account to save your ACCA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › ACCA › Strategic Business Leader
Free ACCA Strategic Business Leader Practice Questions & Answers
300 exam-style Strategic Business Leader questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 151
What is 'ransomware'?
Select an option first.
Correct answer: B — Malicious software that encrypts the victim's files or systems and demands payment for the decryption key
Explanation: B is correct. Ransomware has caused significant operational and financial damage to organisations across all sectors. Prevention involves regular backups, patch management, and employee training. A, C and D are unrelated.
Question 152
What is a 'firewall' in IT security?
Select an option first.
Correct answer: B — A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules
Explanation: B is correct. A firewall acts as a gatekeeper between trusted internal networks and untrusted external networks (e.g., the internet), allowing or blocking traffic based on rules. A, C and D are unrelated.
Question 153
What is 'data governance'?
Select an option first.
Correct answer: B — The framework of policies, roles, standards, and processes ensuring data is accurate, secure, available, and used appropriately across the organisation
Explanation: B is correct. Data governance ensures data quality, assigns data ownership, manages access, and aligns data use with business objectives and regulatory requirements. It is broader than IT management (A) or compliance alone (C).
Question 154
What is the 'Internet of Things' (IoT)?
Select an option first.
Correct answer: B — The interconnection of physical devices embedded with sensors, software, and connectivity, enabling them to collect and exchange data
Explanation: B is correct. IoT connects physical objects — smart meters, vehicles, manufacturing equipment, wearables — to the internet, generating data that enables new business insights and operational efficiencies. A, C and D describe different internet technologies.
Question 155
What is 'blockchain' technology?
Select an option first.
Correct answer: B — A distributed, immutable ledger that records transactions across a network of computers, making records transparent, secure, and tamper-resistant without needing a central intermediary
Explanation: B is correct. Blockchain's distributed and immutable nature makes it valuable for supply chain traceability, smart contracts, and financial transactions. It removes the need for trust in a central authority. A describes a traditional centralised database. C and D are different technologies.
Get the full ACCA question bank — free
Drop your email and we'll send you fresh ACCA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 156
What is a 'digital twin'?
Select an option first.
Correct answer: B — A virtual replica of a physical product, process, or system that enables real-time simulation, monitoring, and analysis to improve performance and predict failures
Explanation: B is correct. Digital twins are used in manufacturing, infrastructure, and urban planning to test scenarios virtually before implementing them physically — reducing cost and risk. A is backup infrastructure. C and D are IT administration concepts.
Question 157
What is 'data ethics' in business?
Select an option first.
Correct answer: B — The principles governing the responsible collection, use, and management of data — including fairness, transparency, privacy, consent, and avoiding harm
Explanation: B is correct. Data ethics extends beyond legal compliance to ask whether data practices are fair and respectful of individuals' rights. Issues include algorithmic bias, surveillance, data monetisation, and use of personal data in ways individuals would not anticipate. A, C and D are narrower aspects.
Question 158
What is 'information asymmetry' and why does it matter?
Select an option first.
Correct answer: B — A situation where one party in a transaction has more or better information than another, potentially leading to market failures, moral hazard, or adverse selection
Explanation: B is correct. Information asymmetry (Akerlof, Stiglitz) causes problems in markets — e.g., sellers know more than buyers, or managers know more than shareholders. Corporate governance disclosure requirements partly address information asymmetry between management and shareholders.
Question 159
What is 'IT governance'?
Select an option first.
Correct answer: B — The framework ensuring IT strategy is aligned with business strategy, IT investments deliver value, IT risks are managed, and IT resources are used responsibly
Explanation: B is correct. IT governance (COBIT is a widely used framework) ensures IT enables and supports business objectives, rather than operating as a separate silo. It covers alignment, value delivery, risk management, resource management, and performance measurement. A, C and D are narrower activities.
Question 160
What is the 'digital divide' and why is it strategically relevant?
Select an option first.
Correct answer: B — The unequal access to digital technology between different groups — geographies, socioeconomic classes, or age groups — which affects market reach, workforce capability, and social equity
Explanation: B is correct. The digital divide affects strategy in multiple ways — it limits market access in underserved regions, creates workforce skills gaps, raises social responsibility questions, and affects the regulatory environment. A, C and D are narrower technical or financial comparisons.
Question 161
What is a 'value chain disruption' caused by digital technology?
Select an option first.
Correct answer: B — When digital innovation fundamentally changes how value is created or delivered within an industry, often making existing players or intermediaries redundant
Explanation: B is correct. Digital disruption can disintermediate existing value chains — e.g., digital streaming disrupted physical media retail; online platforms disrupted travel agencies. Incumbents face the challenge of adapting their value chain model or being bypassed. A, C and D are operational rather than strategic disruptions.
Question 162
What is 'platform business model'?
Select an option first.
Correct answer: B — A business model that creates value by facilitating interactions between two or more user groups on a shared digital infrastructure, generating network effects
Explanation: B is correct. Platform businesses (Uber, Airbnb, Amazon marketplace) facilitate exchanges between producers and consumers, creating value through network effects — the platform becomes more valuable as more users join. They differ from traditional pipeline businesses that produce and sell products. A, C and D are unrelated.
Question 163
What is 'disruptive technology'?
Select an option first.
Correct answer: B — Technology that initially serves niche or underserved markets but gradually improves until it displaces established market leaders and their technologies
Explanation: B is correct. Christensen's disruption theory: disruptive technologies start at the low end or in new market niches where incumbents ignore them, but eventually improve sufficiently to capture mainstream markets. Classic examples include digital cameras, streaming, and smartphones. A, C and D are unrelated.
Question 164
What is 'model risk'?
Select an option first.
Correct answer: B — The risk that a financial or analytical model produces inaccurate outputs due to flawed assumptions, data errors, or misapplication — leading to poor decisions
Explanation: B is correct. Model risk is significant in financial institutions (credit scoring, VaR, pricing models) and increasingly in AI-driven decisions. Poor models can misestimate risk, misprice products, or lead to regulatory breaches. The 2008 financial crisis partly reflected model risk in mortgage-backed security pricing.
Question 165
What is 'key risk indicator' (KRI)?
Select an option first.
Correct answer: B — A metric providing early warning that a risk is increasing to unacceptable levels, enabling management to act before a loss occurs
Explanation: B is correct. KRIs are forward-looking — they signal rising risk before it materialises. They differ from KPIs (which measure outcomes) and risk registers (which list identified risks). Effective KRIs are timely, quantifiable, and linked to specific risk drivers.
Question 166
What is 'liquidity risk'?
Select an option first.
Correct answer: B — The risk that an organisation cannot meet its financial obligations as they fall due because it cannot convert assets to cash quickly enough or access funding at acceptable cost
Explanation: B is correct. Liquidity risk is distinct from solvency risk (having insufficient assets to cover liabilities long-term). A company can be solvent but illiquid if its assets are tied up in illiquid investments. The 2008 crisis showed how liquidity risk can rapidly escalate to systemic risk. A, C and D describe different situations.
Question 167
What is 'concentration risk'?
Select an option first.
Correct answer: B — The risk arising from an over-reliance on a single customer, supplier, geographic market, or product line — so that adverse events in one area have a disproportionately large impact
Explanation: B is correct. Concentration risk arises from lack of diversification. A company relying on one major customer for 60% of revenue faces existential concentration risk. Supply chain concentration (a single-source supplier) is another example highlighted by COVID-19 disruptions. A, C and D are too narrow or unrelated.
Question 168
What is 'governance risk'?
Select an option first.
Correct answer: B — The risk that weaknesses in the organisation's governance structures — board oversight, accountability, transparency, or ethical leadership — lead to poor decisions or misconduct that damages stakeholder interests
Explanation: B is correct. Governance risk reflects structural and behavioural weaknesses at leadership level — conflicts of interest, inadequate oversight, weak internal controls, poor risk culture. The corporate scandals (Enron, Wirecard) demonstrate what happens when governance risk is not managed. A, C and D are external or narrower risks.
Question 169
What is 'technology obsolescence risk'?
Select an option first.
Correct answer: B — The risk that an organisation's current technology platforms become outdated relative to competitors or customer expectations, impairing competitiveness and requiring costly replacement
Explanation: B is correct. Technology obsolescence risk is strategic — organisations that fail to invest in technology upgrades can find themselves unable to compete, serve customers effectively, or comply with regulations. A, C and D are narrower operational or financial risks.
Question 170
What is 'third-party risk management'?
Select an option first.
Correct answer: B — Identifying, assessing, and managing risks that arise from an organisation's relationships with external parties — suppliers, outsourcing partners, cloud providers — who may affect the organisation's ability to meet its objectives
Explanation: B is correct. Third-party risks have grown significantly with outsourcing and digital interconnectedness. A supplier cyber breach, a cloud outage, or a subcontractor's ethical failure can all directly harm the organisation. Effective third-party risk management extends governance beyond the organisation's boundary.
Question 171
What is 'regulatory compliance risk'?
Select an option first.
Correct answer: B — The risk of legal or regulatory sanctions, financial penalties, or reputational damage arising from failure to comply with applicable laws, regulations, and standards
Explanation: B is correct. Regulatory compliance risk is significant across all industries — financial penalties for GDPR breaches, health and safety violations, or financial services mis-selling can be material. Compliance risk management involves monitoring regulatory requirements and embedding controls to ensure adherence.
Question 172
What is 'enterprise architecture' in an IT context?
Select an option first.
Correct answer: B — A structured framework describing the organisation's IT systems, data flows, technology standards, and how these align with and support business processes and strategic objectives
Explanation: B is correct. Enterprise architecture (e.g., TOGAF framework) ensures IT infrastructure and systems are designed coherently to support current and future business needs. Without it, organisations accumulate incompatible systems, data silos, and technical debt. A, C and D are unrelated.
Question 173
What is 'data quality' and why is it important?
Select an option first.
Correct answer: B — The accuracy, completeness, consistency, and timeliness of data — which determines whether analytics, decisions, and reporting can be trusted
Explanation: B is correct. Poor data quality leads to flawed analysis, bad decisions, compliance failures, and loss of stakeholder trust. The principle 'garbage in, garbage out' is fundamental — even the most sophisticated analytics are undermined by low-quality data. A, C and D describe other data attributes.
Question 174
What is 'predictive analytics'?
Select an option first.
Correct answer: B — The use of statistical models and machine learning techniques applied to historical data to forecast future events or behaviours
Explanation: B is correct. Predictive analytics (regression, time-series analysis, machine learning models) forecasts outcomes such as customer churn, equipment failure, credit default, or demand. It goes beyond descriptive analytics (what happened) to answer 'what is likely to happen.' A, C and D are more specific or narrower.
Question 175
What is 'penetration testing' in cybersecurity?
Select an option first.
Correct answer: B — A simulated cyberattack on an organisation's systems and infrastructure conducted by authorised security professionals to identify vulnerabilities before malicious actors can exploit them
Explanation: B is correct. Penetration testing (ethical hacking) proactively identifies weaknesses in IT systems, applications, and networks by simulating the techniques of real attackers. It is a crucial cybersecurity control, often required by regulations and standards such as PCI-DSS and ISO 27001. A, C and D are unrelated.
Question 176
What is an 'information security management system' (ISMS)?
Select an option first.
Correct answer: B — A systematic framework of policies, processes, procedures, and controls for managing information security risks and protecting the confidentiality, integrity, and availability of information
Explanation: B is correct. An ISMS (ISO 27001 is the international standard) provides a structured approach to managing information security risks — from risk identification through control implementation to continuous monitoring. It covers people, processes, and technology. A, C and D are specific IT tools.
Question 177
What is 'cyber resilience' and how does it differ from cybersecurity?
Select an option first.
Correct answer: B — The ability of an organisation to continue operating and recover quickly from cyberattacks and data breaches — acknowledging that some attacks will succeed despite preventive measures
Explanation: B is correct. Cybersecurity focuses on preventing attacks. Cyber resilience accepts that breaches will occur and focuses on detecting them quickly, containing damage, and restoring operations rapidly. A resilient organisation can withstand attacks that bypass preventive controls. A, C and D are too narrow.
Question 178
What is 'social engineering' in the context of cybersecurity?
Select an option first.
Correct answer: B — Psychological manipulation of people to trick them into revealing confidential information, granting access, or performing actions that compromise security — exploiting human trust rather than technical vulnerabilities
Explanation: B is correct. Social engineering (phishing, pretexting, baiting, vishing) exploits people rather than systems. It is often more effective than technical attacks because humans are the weakest link in security. Awareness training and verification procedures are the key controls. A, C and D are unrelated.
Question 179
What is 'zero trust security' architecture?
Select an option first.
Correct answer: B — A security model that assumes no user, device, or network should be automatically trusted — requiring continuous verification of identity and access rights for every user and device, even inside the network perimeter
Explanation: B is correct. Zero trust replaces the traditional castle-and-moat model (trust everything inside the network) with 'never trust, always verify.' It is increasingly important as remote working and cloud adoption eliminate clear network perimeters. A, C and D misuse 'zero trust'.
Question 180
What is 'general data protection regulation' (GDPR) and why does it matter to organisations?
Select an option first.
Correct answer: B — A European Union regulation establishing rights for individuals over their personal data and obligations for organisations processing it — with significant fines for non-compliance
Explanation: B is correct. GDPR (2018) gives individuals rights over their data (access, erasure, portability) and requires organisations to have a lawful basis for processing, appoint Data Protection Officers in some cases, and report breaches within 72 hours. Fines can reach 4% of global annual turnover. A, C and D are too narrow or incorrect.
More free ACCA topics
Management Accounting401
Financial Accounting400
Corporate and Business Law400
Performance Management400
Financial Reporting400
Financial Management400
Strategic Business Reporting400
Advanced Financial Management400
Advanced Performance Management400
Advanced Taxation400
Business and Technology300
Taxation300
Audit and Assurance300
Advanced Audit and Assurance296
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.