CGEIT Practice Test 10 — 10 Questions

Question 1

A global insurer's IT leadership team is reviewing its IT resource governance. Business units routinely hire contractors directly and procure SaaS tools with their own budgets, bypassing IT. The CIO wants to regain control without halting business innovation. Which action is MOST effective for the CIO to take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establish enterprise-wide decision rights and accountability for IT resource acquisition, with business-unit participation in a joint investment review forum.. Shadow IT growth caused by decentralized acquisition is a governance design failure, not a compliance failure. The effective first step is to define decision rights and accountability for IT resources across the enterprise, with business units participating in joint investment review. This restores alignment between resource allocation and strategy without suppressing innovation, which is precisely the governance outcome CGEIT expects from an IT resources domain perspective.

Answer

Mandate that all IT-related spending be frozen until a consolidated enterprise resource plan is approved by the board.

Answer

Consolidate all IT budgets under the CIO and require every business-unit IT purchase to be approved by the IT operations manager.

Answer

Direct the IT security team to scan the network and block any unapproved SaaS applications discovered in use.

Question 2

A global logistics enterprise has approved a risk appetite stating that no single operational disruption may exceed a four-hour recovery time objective for its customs-clearance platform. The CIO proposes migrating that platform to a hyperscale cloud provider under a shared-responsibility model. Which governance action BEST ensures the residual risk remains within the board-approved appetite?

Accepted Answer

Commission an independent assessment of the proposed architecture's recoverability and update the risk register with quantified residual risk against the appetite threshold.. Because the board expressed risk appetite as a measurable recovery-time tolerance, the governing body needs objective evidence that the proposed cloud architecture can satisfy it. An independent recoverability assessment, coupled with quantified residual risk recorded against the appetite threshold, lets the board accept, conditionally approve, or reject the migration. Contractual transfer, provider attestations, and delegated approval all fail to demonstrate that the four-hour objective is actually achievable.

Answer

Obtain the provider's SOC 2 Type II report and confirm it covers availability and processing integrity.

Answer

Delegate approval of the migration to the CIO because cloud resilience is a technical decision within IT's domain.

Answer

Require the cloud provider to accept contractual liability for any customs-clearance outage exceeding four hours.

Question 3

A multinational retailer has approved a three-year program to deploy an AI-driven inventory forecasting platform across 1,200 stores. At the end of year one, the program has delivered the platform to 400 stores, and reported benefits of reduced stockouts and lower carrying costs. The CIO now wants to confirm whether these benefits are genuinely attributable to the program rather than to a concurrent supply chain reorganization and seasonal demand shifts. Which of the following is the MOST appropriate action for the IT governance committee to take?

Accepted Answer

Establish a benefits baseline and use a control group of comparable stores not yet migrated to isolate the program's incremental effect.. The committee must distinguish benefits the program actually caused from improvements produced by other initiatives and normal business variation. With 800 stores still unmigrated, a baseline plus a control-group comparison isolates the incremental effect of the forecasting platform, delivering defensible attribution. Forecast variance tracking, technical reviews and raw reporting each describe or track benefits without proving causation, so they cannot answer whether the program itself generated the results.

Answer

Commission an independent post-implementation review of the platform's technical performance and user adoption rates.

Answer

Compare year-one benefits against the original business case forecast to confirm the program is on track.

Answer

Report the observed stockout and carrying-cost improvements to the board as realized benefits for year one.

Question 4

Which role is generally responsible for implementing the governance policies defined by the board?

Accepted Answer

Executive Management.. Executive Management is responsible for implementing governance policies defined by the board because they translate strategic direction into operational plans, allocate resources, and oversee execution across the organization. In governance frameworks like COBIT, the board sets direction and monitors, while management plans, builds, runs, and monitors activities. This separation ensures accountability and operational feasibility.

Answer

Internal Audit.

Answer

The Board of Directors.

Answer

The IT support team.

Question 5

A global retailer's board has approved a three-year strategy to shift 40% of revenue to an AI-driven subscription model. The CIO reports that business units are independently procuring SaaS analytics tools, creating overlapping data pipelines and inconsistent customer records. The board asks the governance council to ensure technology decisions remain aligned with the strategic intent without halting business agility. Which action should the governance council take FIRST?

Accepted Answer

Define and communicate a technology decision-rights model that assigns accountability for subscription-platform choices to a designated enterprise function while preserving delegated authority for business-unit-specific tools.. The underlying governance gap is the absence of defined decision rights and accountability for technology choices, which allows business units to procure independently. Establishing a decision-rights model that designates accountability for enterprise platforms while delegating unit-specific tools directly aligns technology decisions with strategic intent and preserves agility within boundaries. Controls such as architecture review or centralized approval are implementation mechanisms that work only after accountability is clear.

Answer

Establish an enterprise architecture review board that evaluates all new SaaS procurements against a target-state blueprint before contracts are signed.

Answer

Commission an independent assessment of the current SaaS portfolio to quantify duplicated spend and data-quality defects before any governance changes are made.

Answer

Mandate that the CIO approve every SaaS contract above a nominal threshold until data pipelines and customer records are consolidated.

Question 6

A global insurer is expanding its use of cloud-hosted underwriting platforms. The CIO proposes a single enterprise risk register entry for 'cloud provider outage,' with quarterly review by the IT steering committee. The board risk committee has asked the CGEIT practitioner to strengthen the integration of IT risk with enterprise risk management. Which TWO actions best align the IT risk taxonomy and reporting with the enterprise risk framework? (Choose two.)

Accepted Answer

Define IT risk appetite thresholds in business terms such as maximum tolerable downtime for underwriting services and incorporate them into the enterprise risk appetite statement.. Integrating IT risk with enterprise risk management requires a shared taxonomy and appetite expressed in business terms. Mapping cloud outage scenarios to the enterprise taxonomy lets the board see technology exposure within operational resilience, while defining thresholds such as maximum tolerable downtime embeds IT risk into the enterprise risk appetite statement. Together these actions align reporting, prioritization, and governance oversight across the organization.

Answer

Delegate all cloud risk decisions to the third-party provider's risk team and accept their residual risk assessment as the enterprise view.

Answer

Increase the frequency of vulnerability scans on the underwriting platform and report the raw scan counts directly to the board risk committee.

Answer

Consolidate all cloud contracts under a single procurement owner to reduce the number of vendor relationships managed by IT.

Question 7

A healthcare provider is developing a risk response plan for a critical patient records system. The CGEIT practitioner must ensure that the plan aligns with the enterprise's risk appetite. Which of the following actions is most appropriate?

Accepted Answer

Select risk responses that keep residual risk within the board-approved risk appetite.. Risk responses should be chosen to align with the enterprise's risk appetite, ensuring residual risk stays within acceptable limits. Eliminating all risks, accepting all risks, or transferring all risks without assessment are not aligned with governance principles. The correct approach balances risk and cost.

Answer

Transfer all risks to a third-party insurer without assessing residual risk.

Answer

Implement all possible controls to eliminate all identified risks regardless of cost.

Answer

Accept all risks because the system is critical and cannot be taken offline.

Question 8

An organization is adopting a hybrid cloud model. The IT governance committee is concerned that IT resources may be procured and used by different business units without central oversight, leading to duplication and inefficiency. Which action should the committee take to optimize IT resource utilization?

Accepted Answer

Implement a cloud management platform (CMP) that provides visibility, cost tracking, and automated policy enforcement across all cloud environments.. Implementing a cloud management platform (CMP) is the correct action. A CMP provides the centralized visibility, cost management, and automated policy enforcement necessary to optimize resource utilization across hybrid cloud environments. It enables governance without hindering business agility, allowing the committee to detect and prevent duplication and inefficiency.

Answer

Require all business units to use a single cloud service provider to simplify management and reduce costs.

Answer

Mandate that all cloud procurement requests be approved by the central IT procurement office.

Answer

Develop a chargeback model where business units are billed for their cloud consumption based on central IT's estimates.

Question 9

A hospital's IT governance committee is reviewing its IT resource management practices. The committee wants to ensure that IT resources are effectively governed to support clinical and administrative needs. Which TWO of the following are key components of an effective IT resource governance framework? (Choose two.)

Accepted Answer

Clearly defined roles and responsibilities for IT resource management, including ownership and stewardship.. The two key components are clearly defined roles and responsibilities and continuous monitoring and reporting. These provide the accountability and data-driven oversight necessary for effective IT resource governance. They ensure that resources are managed with clear ownership and that performance and utilization are regularly assessed to support informed decision-making and alignment with organizational objectives.

Answer

An annual external audit of all IT resource expenditures to ensure cost minimization.

Answer

A decentralized approach where each department independently manages its own IT resources without central coordination.

Answer

A policy that mandates the use of a single vendor for all IT hardware and software to simplify management.

Question 10

A multinational manufacturer maintains data centers in three regions. The board has mandated a 20% reduction in IT infrastructure spend without reducing service levels. The CIO proposes consolidating to a single hyperscale cloud provider. The governance committee is concerned about concentration risk and regulatory data residency. Which approach BEST balances the board mandate with governance concerns?

Accepted Answer

Adopt a multi-cloud architecture with workload placement policies that enforce data residency and provide provider redundancy. The governance committee needs an approach that satisfies the cost mandate while maintaining control over regulatory and concentration risks. A multi-cloud architecture with enforceable workload placement policies achieves both by making residency and redundancy requirements explicit design constraints. The other options either accept unmitigated risk, fail to meet the cost target, or improperly delegate accountability that cannot be outsourced.

Answer

Retain all three existing data centers and pursue cost reduction through server virtualization and storage tiering initiatives

Answer

Outsource all infrastructure operations to a managed service provider that assumes responsibility for cost and compliance outcomes

Answer

Consolidate to the single hyperscale provider but negotiate a contractual service level agreement with financial penalties for outages