CGEIT Practice Test 14 — 15 Questions

Question 1

An enterprise is adopting a 'Risk-Based Approach' to IT governance. How should this impact the IT budget allocation?

Accepted Answer

Budget is prioritized for areas with the highest risk exposure.. A risk-based approach to IT governance directs resources toward the areas of greatest potential loss or impact. Since budget is a finite governance lever, allocating it to the highest risk exposures ensures that mitigation spending is proportional to the likelihood and business impact of each risk. This aligns IT investment with enterprise risk appetite and maximizes the return on every dollar spent on controls.

Answer

Budget is focused entirely on upgrading legacy systems.

Answer

Budget is minimized to save costs across the board.

Answer

Budget is distributed equally across all IT departments.

Question 2

A healthcare provider experiences a ransomware attack that encrypts patient records. The incident response team has contained the malware and restored systems from backups. According to IT governance principles, which action should the CGEIT practitioner ensure is performed NEXT?

Accepted Answer

Conduct a post-incident review to identify root causes and update the risk register.. Following containment and recovery, the governance priority is to learn from the incident. A post-incident review identifies root causes, evaluates control effectiveness, and updates the risk register. This ensures that risk management is iterative and that the board receives assurance of improvement. Notification, personnel actions, and insurance decisions are important but should be informed by the review's findings. The review is the foundational step that enables other actions to be taken correctly and in the right sequence.

Answer

Immediately notify all patients and regulators about the breach.

Answer

Purchase additional cyber insurance to transfer future ransomware risks.

Answer

Terminate the employment of the IT staff responsible for the backup failure.

Question 3

Which key element should a balanced scorecard (BSC) for IT governance include?

Accepted Answer

Financial, customer, internal process, and learning and growth perspectives.. A balanced scorecard for IT governance must include multiple perspectives to avoid tunnel vision on any single dimension. The classic Kaplan-Norton BSC framework comprises financial, customer, internal process, and learning and growth perspectives, which together provide a holistic view of IT's contribution to business value. This balance ensures governance considers both current performance and future capability.

Answer

Only financial metrics.

Answer

Only technical uptime metrics.

Answer

Only employee satisfaction metrics.

Question 4

An organization is migrating to a hybrid cloud environment. Which IT resource allocation strategy best aligns with CGEIT principles for optimizing cloud expenditure?

Accepted Answer

Implement a centralized tag-based chargeback and showback model. A centralized tag-based chargeback and showback model gives the governance board visibility into who consumes which cloud resources and at what cost, enabling accountability and informed investment decisions — the core of CGEIT's value-delivery and resource-optimization domains. Tags map consumption to business units, cost centers, or applications, so cloud spend can be attributed, budgeted, and optimized without sacrificing the agility that drove the hybrid cloud decision.

Answer

Transition all workloads to on-demand instances to ensure maximum agility

Answer

Standardize on a single cloud service provider to simplify vendor management

Answer

Automate infrastructure provisioning through Infrastructure as Code (IaC) without budget gates

Question 5

Which TWO activities are necessary to ensure that IT benefits are sustainably realized post-implementation?

Accepted Answer

Conducting ongoing post-implementation reviews of benefit metrics.. Option A is correct because sustainably realizing IT benefits requires continuous measurement and review of benefit metrics after go-live, so that deviations from the business case can be detected and corrective action taken rather than assuming benefits are delivered automatically. Option D is correct because benefits persist only when the new ways of working, controls, and operational processes are embedded into business-as-usual (BAU) and owned by the operational organization, not left as a temporary project activity. Option B is not sufficient because archiving project documents is a records-management/housekeeping task that preserves evidence but does not itself drive or sustain benefit realization. Option C is incorrect as stated because an immediate handover to the maintenance team without knowledge transfer, agreed service levels, and operational readiness can cause benefits to erode; transition must be planned and supported. Option E is incorrect because increasing the IT budget to add new features expands scope and cost rather than ensuring the originally approved benefits continue to be realized.

Answer

Archiving all project documents to a secure repository.

Answer

Transitioning support responsibility to the maintenance team immediately.

Answer

Increasing the IT budget for the project team to add new features.

Question 6

The board of directors requests a summary of the current IT risk posture. Which documentation should the practitioner use as the primary source?

Accepted Answer

The latest enterprise risk register.. The enterprise risk register is the centralized, authoritative record of identified risks, their likelihood, impact, owners, and mitigation status across the organization. It is the primary source for summarizing IT risk posture to the board because it aggregates risk data at the enterprise level and aligns with governance reporting requirements.

Answer

The system administrator's patch management reports.

Answer

The IT department's operational incident logs.

Answer

The annual budget allocation for IT security.

Question 7

An enterprise's audit finds that privileged administrator accounts for its core ERP platform are shared among several engineers, with no individual attribution. Which IT resource governance action should be prioritized FIRST?

Accepted Answer

Implement privileged access management with unique named accounts, session logging and just-in-time elevation.. Shared privileged accounts destroy attribution and violate least privilege over a critical IT resource. Implementing unique named accounts with session logging and just-in-time elevation directly remediates the audit finding, restores accountability and reduces standing access. The other actions either leave the root cause unaddressed or introduce disproportionate change before the basic control gap is closed.

Answer

Require engineers to sign an updated acceptable use policy covering shared accounts.

Answer

Increase the frequency of vulnerability scans on the ERP servers.

Answer

Move the ERP platform to a managed service provider that administers its own privileged accounts.

Question 8

A hospital group's board has set a low tolerance for clinical system availability risk. The IT director proposes a multi-year program to reduce downtime, but the CFO wants to defer funding to next year's budget cycle. Which governance principle should the CGEIT practitioner cite to support immediate funding consideration?

Accepted Answer

Risk response decisions must be aligned with the board-approved risk appetite and tolerance levels.. The board's low tolerance for clinical system availability risk obligates the enterprise to resource responses consistent with that tolerance, regardless of budget cycle timing. Citing appetite and tolerance alignment supports immediate funding consideration because deferral would leave exposure outside the board-defined boundary. The other statements are financial or procedural heuristics that do not reflect governance accountability for risk appetite.

Answer

Operational risk decisions should be delegated entirely to the IT director without board involvement.

Answer

All IT investments must achieve a positive return on investment within twelve months.

Answer

Risk treatment should always be postponed until the next annual enterprise risk assessment cycle.

Question 9

If a project is completed but the expected benefits are not realized, what is the best initial step for a CGEIT professional?

Accepted Answer

Analyze the 'Benefit Dependency Network' to identify where the link between output and outcome failed.. The Benefit Dependency Network (BDN) maps the causal chain from IT/change outputs through business outcomes to enterprise goals, showing the dependencies and enablers required to realize value. When a project delivers its outputs but benefits fail to materialize, the BDN is the diagnostic tool that reveals where the causal link broke — for example, a missing organizational change management enabler or an unaddressed dependency. Analyzing it is the correct first step because it produces evidence-based root cause insight rather than blame or premature re-investment.

Answer

Ignore the missing benefits as long as the system works.

Answer

Start a new, more expensive project.

Answer

Blame the technical team for poor coding.

Question 10

During a merger, the IT risk governance team identifies incompatible security standards. What is the correct approach?

Accepted Answer

Develop a harmonized set of standards that addresses the risks of the combined entity.. During a merger, incompatible security standards must be reconciled into a single harmonized framework that reflects the risk profile of the combined entity. This ensures consistent control coverage, avoids gaps and overlaps, and supports unified governance and reporting. Harmonization also enables the merged organization to operate under one risk appetite and one set of compliance obligations.

Answer

Allow each department to continue using their own standards.

Answer

Hire an external firm to manage the integration.

Answer

Force the smaller company to immediately adopt the larger company's standards.

Question 11

Which metric is the most effective indicator of IT governance success?

Accepted Answer

Degree of alignment between IT investments and business value realized. IT governance exists to ensure IT delivers value aligned with business strategy, so the most effective success indicator is the degree to which IT investments align with and produce realized business value. This metric directly measures the governance objective of value delivery and strategic alignment, which COBIT and ISO/IEC 38500 both identify as the primary governance outcomes. Operational metrics like cost, schedule, or patch counts are inputs or enablers, not indicators of governance success.

Answer

Total cost of IT hardware and software maintenance

Answer

Number of IT projects completed on time

Answer

Number of IT security patches applied per month

Question 12

Which THREE items are required for an effective IT investment governance process?

Accepted Answer

Project prioritization process. A project prioritization process (A) is required because governance must rank competing IT investments against strategic objectives and resource constraints so that funding flows to the highest-value initiatives. A formal business case review (D) is required because each proposed investment must be justified with costs, benefits, risks, and alignment before approval, providing the documented basis for the go/no-go decision. Post-implementation value tracking (E) is required because governance is a closed loop: after delivery, actual benefits, costs, and outcomes must be measured against the business case to confirm value realization and inform future decisions. The remaining options do not belong: employee birthday party planning (B) and office chair selection (C) are routine administrative or facilities matters, not IT investment governance controls, and neither addresses prioritization, justification, or value realization of IT spending.

Answer

Employee birthday party planning

Answer

Office chair selection

Question 13

Which THREE items should be included in a benefit realization plan?

Accepted Answer

The specific metrics to measure the benefit.. A benefit realization plan must define how benefits will be measured, so option B (the specific metrics to measure the benefit) is correct because without quantifiable KPIs or metrics the benefit cannot be tracked or proven. Option C (the target date for the realization of the benefit) is correct because a benefit realization plan must state when the benefit is expected to be achieved, enabling progress tracking against a timeline. Option E (the name of the benefit owner) is correct because every benefit needs an accountable individual responsible for ensuring it is realized and reported. Options A (technical software vulnerabilities) and D (server hardware specifications) are incorrect because they are technical/operational details belonging to risk registers or infrastructure documentation, not to a benefit realization plan, which focuses on business outcomes, measurement, timing, and ownership.

Answer

The list of technical software vulnerabilities.

Answer

The server hardware specifications.

Question 14

Why is it important to define risk appetite before developing a risk response plan?

Accepted Answer

To provide a threshold for determining which risks require action.. Risk appetite defines the amount and type of risk an organization is willing to accept in pursuit of its objectives. Without it, there is no objective threshold for deciding which risks require treatment, which can be accepted, and which must be avoided — making the risk response plan arbitrary. Defining risk appetite first ensures responses are calibrated to the organization's tolerance and strategic goals.

Answer

To simplify the budget process for IT.

Answer

To automatically approve all low-impact risks.

Answer

Because the government requires it by law.

Question 15

Which of the following is an example of an 'IT governance structure'?

Accepted Answer

An IT steering committee. An IT steering committee is a classic example of an IT governance structure — a formal body with defined membership, charter, and decision rights that oversees IT strategy, prioritization, and alignment with business objectives. Governance structures are the organizational mechanisms (committees, councils, roles) that enable direction-setting and accountability, not the operational artifacts or projects themselves.

Answer

A daily backup job schedule

Answer

A database management system (DBMS) upgrade project

Answer

A list of helpdesk tickets for the week