CGEIT Practice Test 16 — 15 Questions

Question 1

Which TWO of the following are key indicators that an organization's IT resource allocation is ineffective?

Accepted Answer

Frequent misalignment between IT projects and business strategic objectives. Option D is correct because frequent misalignment between IT projects and business strategic objectives is a classic symptom of ineffective resource allocation — when resources (budget, staff, time) are directed at initiatives that do not support the organization's goals, the allocation process has failed to prioritize correctly. Option E is correct because a high percentage of the IT budget spent on 'keep-the-lights-on' maintenance indicates that resources are being consumed by ongoing operational upkeep rather than strategic or transformative investments, which is a recognized indicator of poor resource allocation and an unbalanced IT spend profile. Options A, B, and C are not indicators of ineffectiveness: a low turnover rate among IT staff (A) generally reflects good retention and stability, use of automated project management software (B) is a productivity enabler rather than a sign of misallocation, and high adoption of standard, approved hardware platforms (C) demonstrates standardization and cost control, all of which are positive rather than negative signals.

Answer

Low turnover rate among IT staff

Answer

Use of automated project management software

Answer

High adoption of standard, approved hardware platforms

Question 2

A company is integrating a new AI technology. How should the governance structure oversee this risk?

Accepted Answer

Update governance policies and risk thresholds for new technology.. Integrating new AI technology introduces novel risks (bias, opacity, data misuse) that existing governance may not address, so the governance structure must update policies and risk thresholds to cover these emerging risks. This ensures oversight remains relevant and that AI use aligns with organizational risk appetite and regulatory expectations. Proactive policy evolution is the hallmark of effective IT governance.

Answer

Mandate that no new AI technology is used.

Answer

Allow the IT team to proceed without oversight.

Answer

Focus solely on the cost of the technology.

Question 3

Which TWO of the following describe the role of the 'Risk Owner'?

Accepted Answer

Responsible for monitoring the effectiveness of controls.. Option B is correct because the Risk Owner is responsible for monitoring the effectiveness of the controls put in place to mitigate a risk, ensuring they continue to reduce the risk to an acceptable level. Option D is correct because the Risk Owner is accountable for managing the identified risk, including decisions on treatment and acceptance. Options A, C, and E are incorrect because marketing emails, tax filing, and hardware repairs are unrelated to the risk management role of a Risk Owner.

Answer

Writing all the company's marketing emails.

Answer

Approving the company's annual tax filing.

Answer

Fixing all hardware issues in the company.

Question 4

An IT project is failing to deliver promised business value. What is the most likely governance failure?

Accepted Answer

Inadequate alignment between IT risk management and business value objectives.. When an IT project fails to deliver promised business value, the most likely governance failure is inadequate alignment between IT risk management and business value objectives. Governance exists to ensure IT investments are directed toward and deliver expected business outcomes; a disconnect between risk management and value objectives means the project was not properly governed from a benefits-realization perspective.

Answer

The IT team was not using the latest programming language.

Answer

The IT budget was slightly over the projected amount.

Answer

The project manager lacked a certification.

Question 5

Which metric is most useful for reporting the effectiveness of IT risk management to the board?

Accepted Answer

The trend of residual risk levels compared to risk appetite.. The most useful board-level metric is the trend of residual risk levels compared to the organization's risk appetite, because it directly shows whether the enterprise is operating within its stated tolerance and whether risk treatment is effective over time. Boards need this forward-looking, aggregated view to make governance decisions. Operational metrics like ticket counts or spam blocked do not convey enterprise risk posture.

Answer

The number of help desk tickets closed.

Answer

The number of emails blocked by the spam filter.

Answer

The total volume of data stored on the servers.

Question 6

Which of the following is the best way to ensure the business is prepared for a new IT solution?

Accepted Answer

Develop a comprehensive change management and training plan.. The best way to ensure the business is prepared for a new IT solution is to develop a comprehensive change management and training plan. This addresses the people and process aspects of the change, ensuring that employees understand the new solution, are trained to use it effectively, and are supported through the transition. Without proper change management and training, even the most technically sound solution can fail due to user resistance or lack of adoption. This aligns with CGEIT's focus on ensuring that IT investments deliver business value and that organizational change is managed effectively.

Answer

Increase the marketing budget for the product.

Answer

Update the technical server hardware.

Answer

Finalize the security policy document.

Question 7

An IT audit reveals that risk mitigation activities are being performed, but they are not being tracked. What is the governance risk?

Accepted Answer

There is no evidence to demonstrate that risks are being effectively managed.. The core governance risk when mitigation activities are performed but not tracked is the absence of an audit trail and evidence that risks are actually being managed. Without tracking, the board and auditors cannot verify that controls are effective, that residual risk is within appetite, or that resources are being used appropriately. This breaks the accountability and monitoring components of the risk management framework.

Answer

The hardware will become obsolete faster.

Answer

The IT department will be overstaffed.

Answer

The budget will be spent on unnecessary tools.

Question 8

Which THREE items are necessary to calculate the 'Total Cost of Ownership' (TCO) for a new IT project?

Accepted Answer

Project staff salaries during the development phase.. TCO captures the full lifecycle cost of an IT project, so it must include the direct capital outlay for hardware and software acquisition (option C), since these upfront procurement costs are a core component of the ownership cost. It must also include project staff salaries during the development phase (option B), because internal labor for design, build, and deployment is a real cost incurred before the system goes live. Finally, ongoing annual maintenance and support costs (option E) are essential because TCO extends beyond initial acquisition to include recurring operational expenses such as licensing renewals, patching, and vendor support over the asset's useful life. Option A is not required because the number of users to be trained is a training-scope metric, not a cost figure, unless converted into training expenses. Option D does not belong because predicted revenue increase is a benefit/ROI input, not a cost element of TCO.

Answer

The number of users who will be trained.

Answer

The predicted revenue increase.

Question 9

A firm is experiencing 'governance drift' where IT initiatives are no longer aligned with corporate strategy. Which action should the governance committee take first?

Accepted Answer

Perform a review of business strategy and IT design factors.. Governance drift means the linkage between IT initiatives and corporate strategy has weakened, so the first step is to re-examine the business strategy and the IT design factors that should drive IT direction. This re-establishes the 'Evaluate' and 'Direct' inputs the governance committee needs before any corrective action. Auditing projects or changing leadership without first re-validating strategy would treat symptoms rather than the root cause.

Answer

Replace the existing CIO.

Answer

Conduct an audit of all current IT projects.

Answer

Increase the IT budget to support more initiatives.

Question 10

Which TWO of the following are key elements of a Business Impact Analysis (BIA)?

Accepted Answer

Identification of critical business processes.. Option C is correct because a Business Impact Analysis (BIA) fundamentally begins by identifying the critical business processes and functions whose disruption would most harm the organization, so they can be prioritized for recovery. Option E is correct because the BIA quantifies impact over time by determining the maximum tolerable downtime (MTD), along with related metrics such as the recovery time objective (RTO) and recovery point objective (RPO), which drive continuity and recovery strategies. Options A, B, and D are incorrect because website color schemes, specific server hardware models, and IT staff salaries are not BIA elements; hardware and staffing details belong to later resource and recovery planning, while salary data is a budgeting concern, not an impact analysis of business processes.

Answer

The color scheme of the company website.

Answer

The specific model of server hardware.

Answer

The annual salary of the IT staff.

Question 11

When establishing a Benefits Management Plan, which stakeholder group is primarily responsible for the ultimate realization of the benefits identified in the business case?

Accepted Answer

The Business Process Owners.. Business Process Owners are the stakeholders who own the processes that must change to deliver the benefits, and they are accountable for realizing those benefits after the project delivers its outputs. The PMO, CIO, and Enterprise Architect support delivery and governance but do not own benefit realization.

Answer

The Project Management Office (PMO) Manager.

Answer

The Chief Information Officer (CIO).

Answer

The Enterprise Architect.

Question 12

Which THREE of the following are common challenges when implementing IT governance?

Accepted Answer

Lack of strategic alignment between IT and business. Option A is correct because a common IT governance challenge is the lack of strategic alignment between IT and business, which prevents IT investments and priorities from directly supporting business goals and value delivery. Option C is correct because resistance to change within the organization is a frequent governance obstacle, as new decision rights, policies, and accountability structures disrupt established practices and stakeholder interests. Option D is correct because insufficient executive and board support undermines governance, since IT governance requires top-level sponsorship, authority, and ongoing commitment to enforce decisions and align IT with enterprise strategy. Option B is not a governance challenge because office furniture cost is a facilities or procurement expense unrelated to IT decision-making, risk, and value delivery. Option E is not a governance challenge because difficulty finding IT technicians is a staffing or recruitment issue, not a structural problem of directing and controlling IT.

Answer

The high cost of office furniture

Answer

The inability to find enough IT technicians

Question 13

Which role is primarily accountable for ensuring the 'Business Case' for a new IT investment is accurate and justifiable?

Accepted Answer

The Business Sponsor.. The Business Sponsor is the executive who owns the business outcome and the funding for the IT investment, so they are accountable for ensuring the business case is accurate and justifiable. They understand the strategic context, the expected benefits, and the cost/risk trade-offs, and they bear the consequences if the investment fails to deliver. This accountability cannot be delegated to technical or delivery roles.

Answer

The Lead Developer.

Answer

The IT Security Officer.

Answer

The Project Manager.

Question 14

Which THREE of the following are essential components of a risk reporting framework?

Accepted Answer

Actionable insights and trends.. A risk reporting framework must deliver actionable insights and trends (A), because raw risk data is only useful when it is analyzed to show direction, emerging issues, and prioritized remediation actions that decision-makers can act on. Clear identification of the target audience (B) is essential because reports must be tailored in content, depth, frequency, and format to the specific stakeholders receiving them, such as executives, the board, or operational teams. Definition of risk appetite thresholds (D) is also required, since reporting must compare actual risk exposure against the organization's approved risk tolerance/appetite so that stakeholders can judge whether risks are within acceptable limits. A comprehensive list of every single IT asset (C) is not an essential component of the reporting framework itself; asset inventory belongs to the risk assessment/identification process, and exhaustive asset lists would overwhelm reports. The source code of the reporting software (E) is irrelevant to the framework's design, as reporting frameworks focus on governance, content, and audience needs rather than software implementation details.

Answer

A comprehensive list of every single IT asset.

Answer

The source code of the reporting software.

Question 15

Which TWO of the following are governance-related challenges when allocating resources for emerging technologies?

Accepted Answer

Lack of defined governance frameworks for the new technology. Option C is correct because emerging technologies often lack established governance frameworks—policies, standards, controls, and accountability structures—so organizations struggle to decide who approves, funds, and oversees resource allocation for them. Option D is correct because significant skill gaps in the current IT workforce mean governance bodies cannot adequately assess, risk-manage, or staff these technologies, making resource allocation decisions difficult and uncertain. Options A and B are incorrect because low cost and wide market availability are procurement or adoption advantages, not governance challenges. Option E is incorrect because emerging technologies are frequently incompatible with existing infrastructure, and universal compatibility is neither true nor a governance issue.

Answer

The technology is too cheap to purchase

Answer

The technology is widely available in the market

Answer

It is always compatible with existing infrastructure