CGEIT Practice Test 12 — 15 Questions

Question 1

An e-commerce company's risk register shows that a third-party payment gateway poses a high risk of data breach. The CGEIT practitioner is asked to recommend a risk response that aligns with the enterprise's risk appetite. The board has stated that it will not accept any risk that could lead to a material data breach. Which risk response should the practitioner recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Avoid the risk by discontinuing use of the third-party gateway and developing an in-house payment solution.. The board's risk appetite explicitly rejects any risk that could lead to a material data breach. Among risk responses, avoidance is the only option that eliminates the risk entirely. Discontinuing the third-party gateway removes the exposure, while mitigation, transfer, and acceptance leave residual risk that could still result in a breach. Although developing an in-house solution may be costly, it aligns with the board's directive and ensures the enterprise does not violate its stated tolerance. This recommendation demonstrates governance alignment with risk appetite.

Answer

Mitigate the risk by implementing additional encryption and monitoring controls on the gateway.

Answer

Transfer the risk by requiring the payment gateway provider to accept full liability for breaches.

Answer

Accept the risk because the third-party gateway is industry-standard and widely used.

Question 2

A global manufacturer is reviewing its IT investment portfolio. The CIO wants to reallocate funding from a stable back-office system to a digital supply-chain initiative. The CFO insists that the back-office system still delivers reliable cost avoidance. Which concept should guide the reallocation decision?

Accepted Answer

Value optimization across the portfolio, balancing risk, return, and strategic alignment.. Value optimization is the portfolio-level practice of directing finite resources to the combination of investments that best delivers enterprise strategy while balancing risk and return. It forces comparison between retaining the back-office system and funding the supply-chain initiative, rather than evaluating either in isolation. This is the concept that resolves competing stakeholder priorities in an IT investment portfolio.

Answer

Net present value (NPV) of the back-office system's remaining lifecycle.

Answer

Total cost of ownership (TCO) of the back-office system.

Answer

Return on investment (ROI) of the digital supply-chain initiative.

Question 3

A retail bank's IT investment committee is defining how it will confirm that a new fraud-detection platform delivered its intended value. The platform's business case promised reduced fraud losses and faster case resolution. Which artifact should the committee establish FIRST to enable later confirmation of these benefits?

Accepted Answer

A benefits realization plan with owners, measures, baselines, and target dates for each benefit.. Confirmation of benefits requires an agreed plan specifying measures, owners, baselines, and timing before the initiative alters the environment. The benefits realization plan provides that foundation, ensuring fraud-loss and case-resolution data are captured comparably. Risk registers, vendor SLAs, and review schedules support governance but do not by themselves enable verification that the promised business value was achieved.

Answer

A post-implementation review schedule aligned to the enterprise project lifecycle.

Answer

A revised enterprise risk register reflecting the residual risk after platform deployment.

Answer

A service level agreement with the platform vendor covering uptime and response times.

Question 4

A retail company's IT governance committee is reviewing the performance of its IT investments. The committee wants to ensure that IT is delivering value in line with business expectations. Which of the following is the MOST effective way to demonstrate IT value delivery?

Accepted Answer

Measuring the achievement of business case benefits defined for each IT investment.. The most effective way to demonstrate IT value delivery is to measure the achievement of business case benefits defined for each IT investment. This approach directly links IT spending to business outcomes, ensuring that IT is not just efficient but also effective in delivering strategic value. It aligns with governance principles that emphasize value creation as a key objective.

Answer

Counting the number of IT service incidents reported by users.

Answer

Monitoring the IT budget variance compared to the annual plan.

Answer

Tracking the number of IT projects completed on time and within budget.

Question 5

A healthcare insurer is revising its IT governance framework after a series of regulatory findings. The board wants assurance that IT governance will provide effective oversight of compliance, risk, and resource optimization across clinical and claims systems. Which TWO governance mechanisms should the CIO implement to provide this assurance? (Choose two.)

Accepted Answer

Establish an IT steering committee with defined membership, decision rights, and a charter that includes compliance and risk oversight responsibilities.. Effective governance assurance comes from standing structures with defined authority and from transparent performance and risk reporting to the board. A chartered IT steering committee provides decision-making oversight, while published metrics linked to enterprise objectives give the board evidence of compliance and resource optimization. Self-certification, CIO-directed audit, and unreviewed external standards do not provide independent, enterprise-level assurance.

Answer

Require the internal audit function to perform quarterly compliance testing and report results directly to the CIO.

Answer

Outsource regulatory interpretation to an external legal firm and adopt its recommendations as the IT compliance standard without board review.

Answer

Delegate all IT compliance decisions to the clinical systems owners and require them to self-certify adherence annually.

Question 6

Which TWO are common challenges in IT governance implementation?

Accepted Answer

Cultural resistance. Cultural resistance (A) is a common IT governance challenge because governance introduces new decision rights, policies, and accountability structures that clash with entrenched organizational habits, departmental autonomy, and informal power centers, making adoption slow and contentious. Lack of executive support (E) is equally critical because IT governance requires authority to enforce standards, allocate resources, and resolve cross-functional conflicts; without active sponsorship from senior leadership, governance bodies like steering committees lose legitimacy and compliance erodes. By contrast, insufficient desk space (B), slow elevator speed (C), and unreliable office internet (D) are physical facilities or infrastructure issues that do not pertain to establishing governance frameworks, decision-making processes, or stakeholder alignment.

Answer

Insufficient desk space

Answer

Slow elevator speed

Answer

Unreliable office internet

Question 7

A global insurance firm is designing its enterprise IT governance operating model. The board wants clarity on which decision rights must remain at the governance level versus being delegated to IT management. Which TWO decision areas should REMAIN with the governance body rather than be delegated? (Choose two.)

Accepted Answer

Approval of the enterprise IT risk appetite and tolerance thresholds.. Governance retains decision rights over matters that set boundaries and allocate enterprise value, specifically risk appetite and strategic investment priorities. Operational choices such as hardware models, firewall rules, and ticket routing belong to management executing within governance-set constraints. This separation ensures the governing body focuses on direction and oversight while management handles execution, aligning with ISACA CGEIT's governance-versus-management distinction.

Answer

Configuration of firewall rule sets for the perimeter security platform.

Answer

Selection of specific server hardware models for the data center refresh.

Answer

Assignment of daily incident response tickets to on-call engineers.

Question 8

A global manufacturer's governance committee has approved a benefits realization framework. Eighteen months later, an audit finds that several IT investments show 'green' benefits status in quarterly reports even though the underlying operational metrics have not improved. The framework requires business owners to self-report status. Which change to the framework would MOST improve the reliability of benefits reporting?

Accepted Answer

Require business owners to attach source-system evidence for each reported metric and have an independent function validate a sample each cycle.. The framework relied on unverified self-assessment, so status reflected optimism rather than evidence. Requiring source-system data and independent sampling validation introduces objective proof and a credible check while preserving business ownership of the metrics. That combination improves reliability far more than changing reporting frequency, centralizing the process, or adding penalties.

Answer

Add a financial penalty clause to business unit budgets when reported benefits are not achieved.

Answer

Increase the reporting frequency from quarterly to monthly so problems surface sooner.

Answer

Replace business owner self-reporting entirely with a central project management office that consolidates all benefits status.

Question 9

What is the primary objective of 'IT resource management' as part of IT governance?

Accepted Answer

To optimize the allocation and use of IT resources to support the business. IT resource management within IT governance exists to ensure that IT assets — people, infrastructure, applications, and budgets — are allocated and used in a way that maximizes business value and aligns with strategic objectives. It is about optimization and alignment, not cost minimization or headcount reduction. The primary objective is therefore to optimize allocation and use of IT resources to support the business.

Answer

To ensure IT staff are working 40 hours per week

Answer

To eliminate the need for IT staff through automation

Answer

To buy the cheapest available technology

Question 10

A global retailer operates in 14 countries, each with its own IT steering committee making independent technology investment decisions. The board has noticed duplicated spending, inconsistent security standards, and no consolidated view of IT risk. Which governance mechanism should the enterprise establish to address these issues while preserving regional responsiveness?

Accepted Answer

A federated IT governance model with an enterprise-level governance council that sets mandatory principles, standards, and decision rights, while regional committees retain authority within those boundaries.. A federated governance model is the right fit because it establishes enterprise-level principles, standards, and decision rights while allowing regional committees to operate within those boundaries. This resolves duplicated investment, inconsistent security, and fragmented risk reporting without discarding the local responsiveness that a 14-country retailer requires to remain competitive and compliant.

Answer

Outsourcing IT governance to a third-party consultancy that will define standards for all regions.

Answer

A decentralized model that strengthens each regional committee's autonomy and adds a quarterly reporting requirement to the board.

Answer

A centralized IT governance model in which all technology investment decisions are made by a single corporate committee.

Question 11

A multinational retailer's board has approved an enterprise risk appetite statement that explicitly limits financial exposure from any single IT outage to $2 million. The CIO reports that a core payment system runs on unsupported infrastructure with an estimated single-event loss of $8 million. The board asks the IT governance committee to respond. Which action BEST aligns with ISACA CGEIT governance principles?

Accepted Answer

Escalate the gap to the board with options to remediate, transfer, or formally approve a time-bound exception.. Governance bodies own risk appetite, so when an identified exposure exceeds the approved threshold, the committee must escalate to that owner with viable response options rather than accept, defer, or redefine the limit. Escalation preserves accountability, ensures the decision sits with the authority that set the tolerance, and produces a documented, time-bound resolution aligned with ISACA CGEIT governance expectations.

Answer

Ask the CIO to revise the risk appetite statement so the payment system falls within tolerance.

Answer

Direct management to accept the risk because the system has operated without failure for five years.

Answer

Instruct internal audit to add the payment system to next year's audit plan and wait for findings.

Question 12

Which TWO of the following are primary objectives of IT risk governance?

Accepted Answer

Ensuring risk management processes deliver value.. Option B is correct because a primary objective of IT risk governance is to ensure that risk management processes themselves are effective and deliver value to the organization, meaning they are properly designed, resourced, monitored, and continuously improved rather than being bureaucratic overhead. Option D is correct because IT risk governance must align IT risk decisions and tolerance with the organization's overall business strategy, ensuring that technology risks are managed in a way that supports business objectives and value creation. The unmarked options do not belong: A (fixing broken computer keyboards) is an operational hardware support task, not governance; C (increasing the IT budget by 20% annually) is an arbitrary financial target unrelated to risk governance objectives; and E (writing code for software developers) is a hands-on development activity, not a governance responsibility.

Answer

Fixing broken computer keyboards.

Answer

Increasing the IT budget by 20% annually.

Answer

Writing code for the software developers.

Question 13

A manufacturing company's IT governance policy states that the CIO reports to the CEO and that the board's audit committee reviews IT risk. During a governance review, it is found that the audit committee has not received an IT risk report in over a year and that the CIO has been reporting IT risk only to the CEO. What is the MOST likely consequence of this governance gap?

Accepted Answer

The board lacks visibility into IT risk, so its ability to challenge management's risk decisions and fulfill its oversight duty is weakened.. The governance policy assigns IT risk review to the audit committee, so the absence of reporting means the board cannot perform its oversight role or challenge management's risk decisions. The CEO's awareness does not replace board oversight, and accountability remains with the board. Reporting-line changes or restructuring do not follow from a missing report.

Answer

The CIO's reporting line becomes invalid, requiring an immediate restructure of the IT organization.

Answer

IT risk becomes the sole responsibility of the CEO, which automatically transfers accountability away from the board.

Answer

IT risk is effectively mitigated because the CEO has direct line of sight to the CIO and can act without board involvement.

Question 14

A multinational energy company operates in jurisdictions with conflicting data protection requirements. The CIO proposes a single global data governance standard to simplify compliance. The board's risk committee is concerned that a single standard could create regulatory exposure in some jurisdictions. Which action should the CIO take to balance governance consistency with local compliance?

Accepted Answer

Develop a global data governance framework with mandatory enterprise principles and a documented process for assessing and accommodating local regulatory requirements.. The balanced approach is a global framework with mandatory enterprise principles plus a defined process for assessing and accommodating local regulatory requirements. This maintains consistency and board oversight while managing jurisdictional compliance risk. Waiting for objections, full decentralization, or delegating to local counsel each sacrifices either consistency or proactive risk management.

Answer

Delegate data governance decisions to local legal counsel and require them to report only material breaches to the board.

Answer

Adopt the single global standard and require all jurisdictions to comply, documenting exceptions only where regulators formally object.

Answer

Abandon the global standard and allow each jurisdiction to define its own data governance requirements independently.

Question 15

A company's IT governance structure is being challenged because IT costs are inconsistent. What is the most appropriate governance step to take?

Accepted Answer

Review and align IT investment prioritization with business outcomes.. Reviewing and aligning IT investment prioritization with business outcomes ensures that IT spending is driven by strategic value rather than inconsistent or arbitrary factors. This governance step addresses the root cause of inconsistent costs by establishing a transparent, business-aligned process for funding IT initiatives. It is a core COBIT governance activity (Evaluate, Direct, Monitor) that ensures IT costs are justified by expected benefits.

Answer

Arbitrarily cap all IT spending.

Answer

Increase the IT department's headcount.

Answer

Switch to a cloud-only model.