CGEIT Practice Test 18 — 15 Questions

Question 1

A project team is using a 'Benefits-Based' approach. What would they do differently than a 'Project-Based' team?

Accepted Answer

Re-evaluate project features and deliverables against the expected benefits throughout the project lifecycle.. A benefits-based approach continuously validates that the work being done is still expected to deliver the intended business benefits, re-evaluating features and deliverables against those benefits throughout the lifecycle. This allows the team to pivot or stop work when benefits are no longer achievable, rather than blindly completing scope. A project-based team, by contrast, tends to optimize for on-time, on-budget delivery of the defined scope.

Answer

Spend more time on technical documentation.

Answer

Ignore the business outcomes until the end of the project.

Answer

Focus more on meeting the project milestones on time.

Question 2

What is the benefit of a standardized IT governance framework?

Accepted Answer

It provides a clear structure, common language, and consistent practices.. A standardized IT governance framework provides a clear structure (domains, processes, roles), a common language (shared terminology across business and IT), and consistent practices (repeatable, auditable processes). These benefits improve communication, decision-making, and compliance without claiming automatic cost reductions or eliminating oversight.

Answer

It automatically reduces IT costs by 50%.

Answer

It eliminates the need for any oversight.

Answer

It replaces the need for IT management.

Question 3

The board of directors is concerned about the impact of recent cybersecurity threats on the company's reputation. Which TWO of the following actions should the Governance committee prioritize to address these concerns?

Accepted Answer

Reviewing the alignment of the current risk appetite with the brand resilience strategy.. The Governance committee's role is to provide oversight and strategic direction, not to manage technical operations, so it should prioritize actions that connect security risk to business reputation. Option B is correct because reviewing the alignment of the current risk appetite with the brand resilience strategy ensures that the level of risk the organization is willing to accept matches its ability to protect and recover its reputation, which directly addresses the board's concern. Option E is correct because requesting a report on the effectiveness of incident response and crisis communication plans evaluates whether the organization can contain an incident and manage public perception during and after an attack, which is central to reputational impact. Option A is not appropriate because a summary of blocked network packets is a low-level technical metric that does not inform governance-level reputational risk decisions. Option C is not appropriate because immediately upgrading all legacy hardware is a tactical IT remediation task, not a governance priority, and may not be justified by risk. Option D is not appropriate because changing the password rotation policy is an operational security control that does not directly address the board's reputational concerns.

Answer

Directing the CISO to provide a summary of all blocked network packets.

Answer

Requiring the IT department to upgrade all legacy hardware immediately.

Answer

Changing the password rotation policy for all employees.

Question 4

Which THREE types of risks should IT governance oversee?

Accepted Answer

Operational risks. IT governance should oversee operational risks (A) because they cover failures in day-to-day IT services, processes, and infrastructure that can disrupt business continuity, and governance ensures controls, SLAs, and incident management are in place. Compliance risks (D) must be governed because IT must satisfy legal, regulatory, and contractual requirements such as GDPR, HIPAA, SOX, or PCI DSS, and governance ensures policies, audits, and evidence of adherence exist. Strategic risks (E) belong under governance because IT investments, architecture, and digital transformation decisions must align with business objectives and be managed against risks that could prevent achieving those goals. The unmarked options do not belong: office plant death (B) is a trivial facilities matter, and a printer paper jam (C) is a routine operational incident handled by end-user support, not a governance-level risk category.

Answer

Risk of office plant death

Answer

Risk of printer paper jam

Question 5

A firm's IT audit identifies a lack of accountability for data governance. Which governance mechanism should be implemented?

Accepted Answer

Appoint data owners and establish a data governance committee.. Lack of accountability for data governance is a structural governance gap, and the correct remedy is to assign explicit ownership — appointing data owners (and ideally data stewards) and establishing a data governance committee that sets policy, resolves conflicts, and holds owners accountable. This creates named responsibility and an oversight body, directly addressing the identified deficiency.

Answer

Outsource all data storage.

Answer

Install more data encryption tools.

Answer

Centralize all data in one database.

Question 6

A company is struggling with shadow IT. Which governance strategy is most effective?

Accepted Answer

Identify the cause of shadow IT and provide sanctioned, secure alternatives.. Shadow IT exists because business units adopt unsanctioned tools to solve real problems faster than IT can deliver approved alternatives. The most effective governance strategy is to diagnose the root cause—whether it's slow procurement, missing functionality, or poor user experience—and then provide sanctioned, secure alternatives that meet the business need. This addresses the underlying driver rather than just the symptom, reducing the incentive to bypass IT governance.

Answer

Block all unauthorized websites and applications.

Answer

Increase the budget for the IT department.

Answer

Fire any employee caught using non-sanctioned tools.

Question 7

Which THREE of the following are common risk response strategies?

Accepted Answer

Avoid.. Risk response strategies in risk management (as defined in PMBOK and similar frameworks) include Avoid, Transfer, and Accept, making B, C, and E the correct choices. Avoid (B) is right because it involves changing the project plan or scope to eliminate the threat or risk entirely, such as removing a risky feature. Transfer (C) is correct because it shifts the risk's impact and ownership to a third party, typically via insurance, warranties, or outsourcing contracts. Accept (E) is correct because it acknowledges the risk and decides to take no proactive action, either actively (with a contingency plan) or passively. The unmarked options do not belong: Ignore (A) is not a recognized formal strategy since risks cannot simply be ignored under proper risk management, and Delete (D) is not a standard risk response term—it is more akin to data or file operations, not risk handling.

Answer

Ignore.

Answer

Delete.

Question 8

Which TWO of the following are key inputs for defining the IT governance strategy?

Accepted Answer

The enterprise's risk appetite. Option C is correct because the enterprise's risk appetite is a fundamental governance input: it determines how much risk the organization is willing to accept, which directly shapes IT governance policies, control objectives, and investment priorities (e.g., how strictly to enforce security controls or how much redundancy to fund). Option D is correct because the overall business strategy defines the organization's goals, markets, and value drivers, and IT governance must align IT decisions, resources, and performance measures with those business objectives to deliver value. The unmarked options do not belong: A (number of IT employees) and B (current server capacity) are operational resource metrics rather than strategic governance inputs, and E (vendor names of installed software) is an inventory detail, not a driver of governance direction.

Answer

The number of employees in the IT department

Answer

The IT department's current server capacity

Answer

The vendor names of all installed software

Question 9

Which TWO metrics are used to measure strategic alignment?

Accepted Answer

Percentage of projects aligned with business strategy. Strategic alignment measures how well IT initiatives support business goals, so option C (Percentage of projects aligned with business strategy) is correct because it directly quantifies the proportion of IT projects that map to the organization's strategic objectives. Option E (Business value realized from IT investments) is also correct because it captures the tangible outcomes and value that IT spending delivers in support of business strategy, a core dimension of alignment. The remaining options are operational or HR/financial metrics rather than strategic alignment indicators: A (Number of server reboots) reflects infrastructure reliability, B (Average salary of IT staff) is a compensation measure, and D (Number of printers repaired) is a help-desk/asset maintenance statistic, none of which assess whether IT is aligned with business strategy.

Answer

Number of server reboots

Answer

Average salary of IT staff

Answer

Number of printers repaired

Question 10

Which TWO items are commonly included in an IT Governance Policy?

Accepted Answer

Scope of governance. Option A (Scope of governance) is correct because an IT Governance Policy must define its boundaries — which business units, systems, processes, and geographies the governance framework applies to — so that accountability and decision rights are unambiguous. Option D (Roles and responsibilities) is correct because governance policies must specify who owns decisions and oversight, such as the IT steering committee, CIO, business unit leaders, and data owners, mapping authority for approvals, risk acceptance, and policy exceptions. The unmarked options do not belong: network IP addresses (B) and server rack layout (C) are operational/technical configuration details found in network and data center documentation, not governance policy, and a daily task list (E) is an operational work artifact rather than a governance-level statement of scope, authority, and accountability.

Answer

Network IP addresses

Answer

Server rack layout

Answer

Daily task list

Question 11

Which practice best ensures that IT workforce planning aligns with the enterprise's long-term business strategy?

Accepted Answer

Integrating IT human capital planning with the enterprise strategic planning process. The most effective way to ensure IT workforce planning aligns with long-term business strategy is to integrate IT human capital planning directly into the enterprise strategic planning process. This ensures that IT skills, roles, and capacity are derived from and continuously aligned with business objectives, rather than being managed in isolation.

Answer

Focusing exclusively on reducing IT headcount

Answer

Hiring only the most certified candidates

Answer

Relying on contractors for all new initiatives

Question 12

An enterprise is facing a high-impact risk that cannot be fully mitigated. The board decides to transfer this risk. Which of the following is the best implementation of risk transfer?

Accepted Answer

Purchasing comprehensive cyber-insurance to cover potential financial losses.. Risk transfer involves shifting the financial impact of a risk to a third party, typically through insurance or contractual agreements. Purchasing comprehensive cyber-insurance is the clearest implementation because it explicitly transfers the financial consequences of a cyber event to the insurer. The other options may reduce or share risk but do not constitute transfer in the strict sense.

Answer

Moving all data to a public cloud provider.

Answer

Outsourcing the entire IT department to a third-party managed service provider.

Answer

Signing an indemnity clause in a software license agreement.

Question 13

Which of the following describes the 'Benefit Dependency Network' (BDN)?

Accepted Answer

A visualization of how investments and changes lead to business benefits.. The Benefit Dependency Network (BDN) is a technique from benefits management, notably associated with Ward and Daniel, that maps how investments and changes lead to business benefits through a network of dependencies. It visualizes cause-and-effect relationships among enablers, changes, benefits, and objectives, helping organizations understand and manage benefit realization rather than just tracking deliverables.

Answer

A network diagram of project team communication channels.

Answer

A list of all server interdependencies.

Answer

A schedule of hardware maintenance updates.

Question 14

A global logistics company maintains a critical customs-clearance application built on an unsupported database version. The governance committee must decide how to allocate limited IT budget and skilled staff across the application portfolio. Which action BEST aligns with IT resource governance principles?

Accepted Answer

Prioritize remediation based on the business criticality and risk exposure of each application, then assign budget and staff accordingly.. IT resource governance directs constrained budget and specialist capacity using assessed business criticality and risk. Prioritizing remediation by the exposure each application creates ensures the customs-clearance system receives attention proportional to its importance, while lower-risk items compete fairly for remaining resources. Blanket technical remedies or blanket outsourcing substitute a single decision for the balanced, portfolio-wide allocation that governance requires.

Answer

Fund a full rewrite of the application in the newest technology stack to eliminate all technical debt immediately.

Answer

Outsource the entire application portfolio to a managed service provider and release all internal specialists.

Answer

Defer all action until the next fiscal year when additional budget and headcount may become available.

Question 15

An enterprise's board has tasked the CIO with implementing a governance framework that ensures IT investments deliver value while balancing risk and resource optimization. The CIO decides to use COBIT 2019 as the guiding framework. The board now asks how to measure whether the governance system is effective. Which of the following is the MOST appropriate way to measure governance effectiveness?

Accepted Answer

Evaluate the enterprise's achievement of governance objectives using COBIT performance management metrics.. The board wants to know if the governance system is effective, not just active. COBIT 2019's performance management framework provides a structured way to measure the achievement of governance and management objectives, which directly reflects effectiveness. Metrics like policy counts, training completion, or spending benchmarks are activity or input measures and do not demonstrate whether the governance system is delivering value and managing risk as intended.

Answer

Compare IT spending as a percentage of revenue against industry benchmarks.

Answer

Track the number of IT policies approved by the board during each quarter.

Answer

Monitor the percentage of IT staff who have completed compliance training.