ISACA · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
During a portfolio review, it is discovered that a program's benefits are being realized, but the project costs have exceeded the contingency fund by 20%. What is the best immediate action for the benefits owner?
Conduct a re-evaluation of the business case to determine if the expected ROI is still valid.
Cost overrun of 20% breaches the contingency threshold, so the benefits owner must reassess whether forecast benefits still justify revised costs. Re-evaluating the business case tests continued ROI validity against the new baseline, satisfying the stem's demand for immediate action before further funding or scope decisions.
Immediately terminate the project to prevent further cost overruns.
Ignore the cost overrun as long as the project delivery schedule remains on track.
Request an additional budget from the steering committee without analysis.
A project manager is calculating the Return on Investment (ROI) for an IT infrastructure upgrade. Which factor must be included in the 'Investment Cost' component of the ROI calculation?
The depreciation schedule of existing legacy assets.
The training costs for staff to operate the new infrastructure.
Investment cost captures the total cost of ownership, not just hardware and licences. Staff training is a direct, necessary cost of making the upgraded infrastructure operational, so excluding it would understate the denominator and overstate ROI.
The projected increase in annual sales revenue.
The market value of competitor technology.
A company is shifting from a project-based to a value-based management model. Which of the following best describes an 'outcome' versus an 'output'?
An output is a strategic goal; an outcome is a project milestone.
An output is the increased sales revenue; an outcome is the new CRM software.
An output and an outcome are essentially the same and can be used interchangeably.
An output is the automated reporting tool; an outcome is the reduction in manual data entry time.
Outputs are tangible deliverables produced by the initiative, whereas outcomes are the measurable business results those deliverables enable. The automated reporting tool is the output; the reduction in manual data entry time is the outcome, which is the axis value-based management tracks.
When implementing a benefits management plan, what is the primary role of the 'Benefits Owner'?
To manage the technical development life cycle of the software.
To authorize the release of funds from the enterprise budget.
To ensure that the business operational changes required to achieve the benefits are implemented.
The Benefits Owner owns realisation, not just tracking. Operational, process and behavioural changes across the business are what actually convert a delivered capability into measurable benefit, so this role ensures those changes are implemented and sustained.
To audit the project documentation for compliance with PMBOK standards.
Which THREE factors should be considered when assessing the 'Value' of an IT investment in a portfolio?
Financial benefits such as cost reduction or revenue growth.
Quantifiable financial returns, including cost reduction, revenue growth or avoided expenditure, form the tangible economic component of portfolio value. They let decision-makers compare competing investments on a common monetary basis alongside qualitative strategic and risk criteria.
The number of vendors involved in the project.
The total volume of code written.
Strategic alignment with enterprise objectives.
Value extends beyond financial return to whether the investment advances enterprise strategy and objectives. An initiative delivering strong cost savings but misaligned with strategic direction contributes little portfolio value, so alignment must be assessed explicitly.
The risk of business disruption if the project is not implemented.
Risk of business disruption captures the cost of inaction, a core Value dimension in portfolio assessment. Where an investment protects continuity of critical services, its worth derives from avoided outage exposure rather than incremental return. This satisfies the stem's Value factor by quantifying downside protection, complementing financial and strategic benefit measures.
What is the primary purpose of a Post-Implementation Review (PIR) in the context of benefits realization?
To verify if the expected benefits have been achieved and identify lessons learned.
A PIR compares realised outcomes against the business case's projected benefits after delivery, confirming whether value materialised. It also captures lessons learned to improve future investment decisions, which is precisely benefits realisation assurance rather than project closure administration.
To ensure the system meets all security standards.
To finalize the payment for external contractors.
To evaluate the performance of the project manager.
Want more Benefits Realization practice?
Practice this domainWhen reporting IT risk to the board, which of the following provides the most value?
A list of all open vulnerabilities categorized by severity.
A heat map showing the impact of top risks on business value drivers.
A heat map maps each top risk against the business value drivers it threatens, letting the board see likelihood and impact in business terms rather than technical detail. This directly satisfies the stem's demand for the most value when reporting IT risk to the board.
The total number of security incidents reported in the last quarter.
A detailed technical audit report of the firewall configurations.
Which of the following is the primary purpose of a Key Risk Indicator (KRI)?
To serve as an early warning signal of potential risk events.
A Key Risk Indicator provides forward-looking, quantifiable metrics that signal rising risk exposure before incidents occur, satisfying the stem's requirement for a primary purpose. Unlike lagging indicators, which report past events, KRIs enable pre-emptive governance action by tracking risk drivers against defined thresholds, giving management timely warning of potential risk events.
To ensure that all employees have completed security awareness training.
To provide a detailed log of all security threats blocked by the firewall.
To measure the success of past risk mitigation strategies.
An enterprise is evaluating the trade-off between the cost of risk mitigation and the potential business benefit. Which framework or approach should the practitioner use?
Total Cost of Ownership (TCO) analysis.
Key Risk Indicator (KRI) dashboarding.
Business Impact Analysis (BIA).
Return on Security Investment (ROSI).
ROSI quantifies mitigation cost against monetary risk reduction, expressing the benefit as a ratio or net value. This directly satisfies the stem's trade-off between mitigation cost and business benefit, unlike purely qualitative frameworks that rank risk without financial comparison.
What is the most effective way to ensure that IT risk management is integrated with enterprise risk management (ERM)?
Moving the IT risk management function under the responsibility of the Chief Financial Officer.
Requiring IT to report risks directly to the Chief Risk Officer on a weekly basis.
Mandating that IT uses the same risk assessment software as the finance department.
Aligning the IT risk taxonomy and reporting thresholds with the corporate ERM framework.
Aligning the IT risk taxonomy and reporting thresholds with the corporate ERM framework directly satisfies the integration requirement by ensuring IT risks are expressed in the same language, scales and escalation criteria as enterprise risks. This shared taxonomy lets ERM committees aggregate, compare and govern IT exposure alongside other business risks, rather than treating it as a separate silo.
An IT project is identified as having a high inherent risk that exceeds the board-approved appetite. The project is critical for competitive advantage. Which approach is most appropriate?
Present a business case to the board for formal risk acceptance with compensatory controls.
Presenting a business case to the board satisfies the appetite-exceedance constraint: only the board can formally accept risk above its own approved threshold. Compensatory controls reduce residual exposure, and the project's competitive-advantage value justifies escalation rather than cancellation or silent tolerance.
Implement excessive controls regardless of project cost.
Direct the IT team to lower the risk by reducing project scope.
Cancel the project immediately to maintain compliance.
An organization is transitioning to a cloud-based infrastructure. Which governance mechanism is most effective for ensuring that the cloud service provider's risk management practices remain aligned with the enterprise's risk appetite?
Performing an annual penetration test on the provider's infrastructure.
Mandating a SOC 2 Type II report review on an annual basis.
Embedding ongoing risk assessment requirements into the service provider contract.
Contractual clauses obliging the provider to perform recurring risk assessments create enforceable, auditable alignment with the enterprise's risk appetite. This satisfies the governance constraint by making provider risk practices continuously verifiable rather than relying on one-off due diligence.
Establishing clear service level agreements (SLAs) with penalty clauses for downtime.
Want more Risk Optimization practice?
Practice this domainTo optimize IT infrastructure resources, an organization adopts a software-defined infrastructure (SDI) approach. What is a key governance risk that must be addressed?
Inability to scale infrastructure resources rapidly
Complexity in maintaining consistent security and compliance policies across virtualized environments
Virtualised workloads can be provisioned and moved dynamically, so security groups, segmentation and compliance controls may drift between hypervisors and tenants. SDI's abstraction layer removes the physical enforcement points that once guaranteed uniform policy, making inconsistent control coverage the governance risk to address.
Increased dependency on proprietary hardware vendors
Decreased flexibility in managing application workloads
What is the primary objective of infrastructure resource management in a governance context?
Ensuring IT resources support business goals efficiently and effectively
Aligning infrastructure resources with business goals directly satisfies the governance requirement for value delivery, ensuring IT investment supports strategic objectives rather than operating in isolation. This distinguishes governance-focused resource management from purely technical capacity planning, which addresses performance and availability but not strategic alignment or accountability for business outcomes.
Maximizing the utilization of all available hardware
Minimizing the total number of IT personnel required
Upgrading all infrastructure to the latest available versions annually
Which document should provide the framework for how IT resources are prioritized and allocated?
Annual IT Operating Budget
Disaster Recovery Plan
Service Level Agreement (SLA)
IT Strategic Plan
The IT Strategic Plan defines how IT resources are prioritised and allocated by translating enterprise strategy into IT objectives, initiatives and investment sequencing. It provides the framework directing funding and effort toward agreed priorities, whereas operational plans address execution rather than allocation.
An IT manager is conducting workforce planning for an upcoming digital transformation. Which approach is most effective for identifying skill gaps?
Conducting a gap analysis comparing current IT staff competencies against future state requirements
A gap analysis maps existing competencies against the future-state skill profile the transformation demands, exposing precise shortfalls. This directly satisfies the workforce-planning constraint by grounding development and recruitment decisions in evidenced deficiencies rather than assumption.
Surveying staff on their preferred technologies for professional development
Reviewing employee performance appraisals from the previous two years
Increasing the budget for external recruitment to bring in new talent
In the context of workforce planning, what is the impact of shifting to Agile development practices on resource governance?
Necessity to shift from project-based resource allocation to stable, product-based team funding
Agile teams persist across releases, so funding stable product teams replaces allocating resources to temporary projects. This satisfies the resource governance implication of the shift, aligning budgeting, capacity planning and accountability with enduring product ownership rather than finite project lifecycles.
Greater reliance on long-term, detailed resource planning cycles
Increased need for centralized resource pool management
Reduced requirement for developer cross-training
An enterprise is facing significant shadow IT growth. What is the best governance action to optimize resources?
Audit all business units and penalize those using shadow IT
Restrict all unauthorized cloud service access via the firewall
Implement a cloud access security broker (CASB) to provide secure, governed alternatives
A CASB discovers unsanctioned cloud usage and enforces policy across those sessions, directly addressing shadow IT's root cause: uncontrolled adoption. By brokering access, it converts ungoverned tools into monitored, compliant alternatives, satisfying the stem's requirement to optimise resources through governance rather than outright prohibition.
Mandate that all IT needs be submitted via the central IT ticketing system
Want more IT Resources practice?
Practice this domainThe enterprise is reviewing its IT governance structure. Which THREE of the following are primary responsibilities of the Board of Directors regarding IT governance?
Defining the technical configuration of server clusters.
Directing the strategic alignment of IT with business goals.
The Board sets direction rather than managing delivery. Directing strategic alignment of IT with business goals is a governance-level duty, ensuring IT investment supports enterprise objectives and sits within the Board's mandate to steer overall strategy.
Overseeing the enterprise risk management framework.
Overseeing enterprise risk management sits with the Board because IT risk is a subset of overall enterprise risk, and the Board owns risk appetite and tolerance setting. This satisfies the stem's governance constraint: the Board provides direction and oversight, not operational IT management, which delegates to executive committees.
Managing the daily IT helpdesk ticket queue.
Ensuring value delivery from IT investments.
Value delivery is a core governance outcome the Board must ensure. Confirming that IT investments yield expected benefits holds management accountable and satisfies the stem's focus on Board-level responsibility for realising business value from technology spend.
A newly appointed CIO is integrating COBIT 2019 into the existing governance framework. Which action best ensures that the governance system is dynamic?
Focusing solely on the 'Ensure Governance Framework Setting and Maintenance' objective.
Implementing all 40 governance and management objectives immediately.
Adopting the framework exactly as published in the COBIT core publication.
Customizing the governance system based on the enterprise's unique design factors.
COBIT 2019's design factors (enterprise goals, risk profile, threat landscape, size, sourcing model) exist precisely so governance systems can be tailored per enterprise. Customising on these factors makes the system dynamic, satisfying the stem's requirement rather than applying a rigid one-size-fits-all framework.
Which THREE factors should the board of directors consider when establishing IT governance oversight mechanisms?
Regulatory and compliance requirements.
Boards must ensure oversight mechanisms embed regulatory and compliance obligations, since external mandates define minimum governance controls the enterprise cannot tailor away. This factor directly satisfies the stem's requirement to consider what constrains governance design, ensuring the board's oversight framework remains legally defensible and auditable.
Alignment of IT initiatives with business strategy.
Oversight mechanisms must tie IT investment and delivery to strategic objectives, otherwise governance becomes compliance theatre detached from value creation. This factor satisfies the stem by ensuring the board directs and monitors IT in line with business direction, which is the core purpose of governance oversight.
Enterprise risk appetite.
The board's oversight mechanisms must reflect the enterprise's stated risk appetite, since tolerance thresholds determine how much IT risk is acceptable and where escalation is triggered. This factor satisfies the stem by calibrating governance rigour, escalation paths and assurance depth to the risk the organisation is willing to bear.
Daily network uptime statistics.
Detailed software configuration standards.
In the context of IT governance, what is the primary responsibility of the board of directors?
Providing strategic direction and monitoring governance performance.
Providing strategic direction and monitoring governance performance aligns with the board's oversight mandate under IT governance frameworks such as COBIT, where the governing body sets direction and evaluates performance. This satisfies the stem's requirement for the board's primary responsibility, distinct from management's operational duties of planning, building and running.
Managing the procurement of software and hardware.
Developing IT policies and procedures.
Day-to-day management of IT operations.
A multinational corporation is struggling with IT strategic alignment. The board wants to ensure IT investments directly correlate to business value. Which metric should the governance committee prioritize?
Percentage of IT initiatives that directly contribute to documented business strategy goals.
Percentage of IT initiatives directly contributing to documented business strategy goals measures strategic alignment itself, evidencing that investment correlates with business value. Financial or operational metrics alone cannot demonstrate that linkage, which is the board's stated concern.
Total cost of ownership (TCO) of IT assets.
System uptime and availability percentages.
IT project delivery on time and within budget.
The IT steering committee is evaluating a high-cost digital transformation project. What should the committee prioritize to ensure strategic alignment?
The potential for technical debt reduction.
The specific vendor selection process used for the software purchase.
The business value proposition and contribution to organizational goals.
Business value and contribution to organisational goals are the criteria that tie investment decisions to enterprise strategy. For a high-cost transformation, the committee must judge the business case against strategic objectives, not technical elegance or cost alone, ensuring the spend advances the organisation's stated direction.
Detailed technical architectural specifications.
Want more Governance OF Enterprise IT practice?
Practice this domainThe CGEIT exam has 150 questions and must be completed in 240 minutes. The passing score is 450 (scaled 200–800). Always confirm current details on the vendor's official exam page.
Scenario questions on IT governance, strategic alignment, risk optimisation, resource management, and performance measurement.
The exam covers 4 domains: Benefits Realization, Risk Optimization, IT Resources, Governance OF Enterprise IT. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official ISACA CGEIT exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.