CGEIT Practice Test 13 — 15 Questions

Question 1

An insurance company's IT governance committee is reviewing a proposal to migrate all customer policy data to a public cloud provider. The Chief Risk Officer notes that the provider cannot contractually guarantee data residency in the company's home jurisdiction. Which governance consideration should weigh MOST heavily in the committee's decision?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Whether the migration aligns with the enterprise's regulatory compliance obligations and risk appetite for data residency.. Regulatory compliance and alignment with the board-approved risk appetite are threshold governance criteria. If the cloud provider cannot guarantee data residency, the migration cannot be approved as proposed, because cost, skills, and peer trends are secondary to the legal and risk obligations that govern an insurer's handling of customer policy data.

Answer

Whether the IT team has the technical skills to manage the cloud environment.

Answer

Whether competitors in the insurance sector have already adopted public cloud platforms.

Answer

Whether the cloud provider offers a lower total cost of ownership than the current data center.

Question 2

A retail enterprise has grown through acquisitions, resulting in three separate IT organizations, each with its own project intake process, architecture review board, and budget approval cycle. The board has mandated a single, unified governance model across the group. As the newly appointed enterprise IT governance lead, which action should you take FIRST to establish effective governance across the merged IT function?

Accepted Answer

Establish a governing body with defined decision rights, mandates, and a common set of governance processes and metrics.. Fragmented governance from acquisitions is resolved by establishing clear decision rights, mandates, and shared processes through a governing body. That structure creates the authority and accountability needed to harmonize budgets, methodologies, and oversight. The other actions are downstream or supporting activities that depend on a governance foundation being in place first. Without agreed decision rights, technical and financial consolidation efforts lack legitimacy and enforcement.

Answer

Mandate that all three IT organizations immediately adopt the same project management methodology and tooling.

Answer

Commission an external maturity assessment of all three IT organizations against a recognized framework.

Answer

Consolidate all three IT budgets into a single central budget controlled by the enterprise CIO.

Question 3

An enterprise's IT steering committee has approved a portfolio of digital initiatives, but six months later, value delivery is unclear and business sponsors report that IT priorities do not reflect strategic objectives. A review finds that initiatives were approved based on technical feasibility rather than business case alignment. Which governance action should the committee take to correct this?

Accepted Answer

Institute a formal investment decision process that requires business case justification and explicit linkage to strategic objectives before approval.. The steering committee's failure was approving initiatives on technical feasibility rather than strategic value. Correcting this requires a formal investment process that mandates business case justification and traceable linkage to enterprise objectives. Such a process ensures decisions are grounded in value and alignment, which is the core governance purpose of IT investment oversight. Monitoring and delegation changes do not address the flawed selection criteria that produced the misalignment.

Answer

Delegate initiative prioritization to the enterprise architecture team, since they understand technical dependencies.

Answer

Increase the frequency of status reporting from project managers to the steering committee.

Answer

Require all new initiatives to be approved exclusively by the CIO to speed up decision-making.

Question 4

An energy utility's board is reviewing whether its IT governance framework remains effective after a major merger doubled the size of the organization. Which TWO actions should the governance committee take to reassess the framework's effectiveness? (Choose two.)

Accepted Answer

Re-evaluate whether the existing decision rights, committee structures, and escalation paths still match the merged organization's size and complexity.. A merger materially changes scale, strategy, and regulatory exposure, so effectiveness must be reassessed in two directions: whether the governance design still fits the new organizational structure, and whether it still aligns with updated strategic objectives and compliance obligations. Together, these checks confirm the framework remains relevant and workable rather than merely existing on paper.

Answer

Suspend governance activities until the post-merger integration is fully complete to avoid conflicting decisions.

Answer

Delegate all governance reassessment to the external auditor and implement its recommendations without internal review.

Answer

Replace the entire governance framework with a generic industry-standard template to simplify the transition.

Question 5

A financial services firm's IT governance committee is reviewing its performance measurement approach. Executives report that current IT metrics focus on uptime and help-desk volumes, and the board cannot tell whether IT is delivering strategic value. The committee wants metrics that demonstrate IT's contribution to enterprise objectives. Which approach should the committee adopt?

Accepted Answer

Implement a balanced scorecard linking IT objectives to enterprise goals with outcome-based measures.. Demonstrating IT's strategic contribution requires metrics that trace from IT objectives to enterprise goals, which a balanced scorecard with outcome-based measures provides. Operational metrics such as uptime, resolution times, and composite health indices describe activity and efficiency but cannot show value delivery. ISACA CGEIT stresses aligning IT performance measurement with enterprise strategy so governing bodies can assess whether IT is creating intended value.

Answer

Benchmark help-desk resolution times against industry averages and report the variance.

Answer

Adopt a single composite IT health index that aggregates all operational metrics into one score.

Answer

Increase the frequency of uptime reporting from monthly to weekly to improve visibility.

Question 6

Which THREE of the following are common IT resource management challenges?

Accepted Answer

Balancing operational support with innovation and growth. Option A is correct because IT resource management must continuously balance day-to-day operational support (keeping existing services running, meeting SLAs) against investing time and budget in innovation and growth initiatives, a classic tension in IT governance. Option B is correct because budget limitations and fiscal pressures are a fundamental constraint in IT resource management, forcing prioritization of projects, staffing, and infrastructure spending against finite capital and operational budgets. Option E is correct because managing and retiring legacy systems is a common challenge, involving risks such as unsupported hardware/software, technical debt, data migration, and integration dependencies when modernizing or decommissioning old platforms. Option C is not a resource management challenge but a cosmetic/web design decision, and Option D concerns workplace ergonomics/facilities rather than the management of IT resources such as staff, budgets, infrastructure, and systems.

Answer

Deciding on the color scheme of the IT website

Answer

Choosing the best office chair for staff

Question 7

An enterprise's IT governance committee meets quarterly and reviews a dashboard of operational metrics such as server uptime, ticket volumes, and patch compliance. The board has expressed concern that governance is not providing strategic oversight of IT. Which change to the committee's agenda would BEST address the board's concern?

Accepted Answer

Replace operational reporting with oversight of IT strategy alignment, value delivery, risk posture, and resource optimization.. The committee's agenda was dominated by operational metrics, which explains the board's perception that governance is not strategic. Oversight should focus on IT strategy alignment, value delivery, risk posture, and resource optimization, which are the core governance concerns. Operational metrics belong with IT management and should inform, not dominate, the governance agenda. Shifting the committee's focus to strategic topics restores its intended oversight role and addresses the board's concern directly.

Answer

Reduce the committee's scope to reviewing only cybersecurity incidents and compliance findings.

Answer

Increase the meeting cadence to monthly and include more detailed operational metrics.

Answer

Delegate all committee reporting to IT operations managers and have them present at each meeting.

Question 8

An organization realizes its IT strategy is not yielding the expected business benefits. What is the most effective approach to remediate this?

Accepted Answer

Perform a strategic alignment review to identify gaps between IT capabilities and business needs.. When IT strategy fails to deliver expected business benefits, the root cause is usually misalignment between IT capabilities and business needs, so a strategic alignment review is the most effective remediation. This review identifies gaps in objectives, priorities, resources, and governance, enabling corrective action rather than blind escalation or cancellation. It restores the linkage between IT investment and business value.

Answer

Increase the frequency of software deployments.

Answer

Cancel all current IT projects.

Answer

Immediately hire more IT staff.

Question 9

Which governance mechanism is best for ensuring that IT resource allocation remains aligned with changing business priorities?

Accepted Answer

Periodic review of the IT investment portfolio. A periodic review of the IT investment portfolio is the governance mechanism specifically designed to continuously evaluate whether IT spending, projects, and resources remain aligned with shifting business priorities. It provides a structured, recurring forum where investments are rebalanced, terminated, or accelerated based on strategic value. This makes it the most direct and responsive alignment tool among the options.

Answer

Review of individual employee performance metrics

Answer

Annual budgeting process

Answer

Monthly meeting with the IT help desk

Question 10

A project manager is calculating the Return on Investment (ROI) for an IT infrastructure upgrade. Which factor must be included in the 'Investment Cost' component of the ROI calculation?

Accepted Answer

The training costs for staff to operate the new infrastructure.. Training costs for staff to operate the new infrastructure are a direct, one-time cost required to realize the benefits of the investment, so they must be included in the Investment Cost component of ROI. ROI compares total costs (acquisition, implementation, training, transition) against total benefits. Omitting training costs understates the true investment and overstates ROI.

Answer

The depreciation schedule of existing legacy assets.

Answer

The projected increase in annual sales revenue.

Answer

The market value of competitor technology.

Question 11

A company is using a risk maturity model to improve its IT risk management. What is the main benefit?

Accepted Answer

To establish a baseline and track improvements over time.. A risk maturity model provides a structured framework to assess the current state of IT risk management capabilities, establish a baseline, and track progress over time toward higher maturity levels. Its primary benefit is enabling measurable, continuous improvement rather than prescribing specific tools or headcount. This makes it a governance and improvement instrument.

Answer

To automatically reduce the cost of IT security.

Answer

To force all departments to use the same IT tools.

Answer

To determine exactly how many employees are needed in the risk department.

Question 12

In the context of IT portfolio management, what does 'value optimization' mean?

Accepted Answer

Balancing investments to achieve the best possible outcomes for the organization given resource constraints.. Value optimization in IT portfolio management means balancing the mix of investments — across risk, return, cost, and strategic fit — to maximize overall organizational value given finite resources. It is not about minimizing cost or project count but about achieving the best aggregate outcome from the portfolio.

Answer

Always choosing the cheapest project.

Answer

Automating the IT support ticket system.

Answer

Minimizing the number of IT projects.

Question 13

A company is performing a risk assessment of a new software vendor. Which factor is most relevant for the governance of third-party risk?

Accepted Answer

The nature of the data accessed or processed by the vendor.. For third-party risk governance, the most relevant factor is the nature of the data the vendor accesses or processes, because this determines the potential impact and regulatory exposure if the vendor is breached. Data sensitivity drives the level of due diligence, contractual controls, and ongoing monitoring required. This is the foundation of risk-based vendor governance.

Answer

The location of the software vendor's headquarters.

Answer

The number of employees working for the software vendor.

Answer

The brand reputation of the software vendor.

Question 14

Which TWO of the following are primary pillars of IT Governance?

Accepted Answer

Strategic alignment. Strategic alignment (A) is a primary pillar of IT governance because it ensures IT investments and activities are directly linked to the organization's business goals and objectives, as defined in frameworks like COBIT. Value delivery (D) is also a core pillar, focusing on ensuring that IT delivers promised benefits against the agreed strategy, optimizing costs, and managing risks. These two pillars are explicitly recognized in IT governance literature (e.g., the IT Governance Institute's five focus areas: strategic alignment, value delivery, resource management, risk management, and performance measurement). Hardware procurement cost (B) is a tactical operational expense concern, not a governance pillar. Network speed optimization (C) is a technical performance activity, not a governance focus. Software development speed (E) is a delivery metric, not a primary governance pillar.

Answer

Hardware procurement cost

Answer

Network speed optimization

Answer

Software development speed

Question 15

Why must benefits be linked to strategic enterprise goals?

Accepted Answer

To ensure that IT projects contribute to the organization's mission and competitive advantage.. Benefits realization only has meaning when measured against the enterprise's strategic objectives, because IT exists to enable mission outcomes and competitive advantage, not to deliver outputs in isolation. Linking benefits to strategic goals ensures investment decisions are prioritized by contribution to enterprise value and that success is judged by outcomes rather than activity. This alignment is a core CGEIT governance principle connecting IT investment to business strategy.

Answer

To make the project documentation look professional.

Answer

To keep the IT department busy.

Answer

To satisfy the project manager's requirements.