CGEIT Practice Test 19 — 15 Questions

Question 1

A manufacturing enterprise is consolidating three data centers into one colocation facility. The IT governance committee must ensure that infrastructure resources remain aligned with business continuity and cost objectives throughout the migration. Which TWO governance actions are MOST appropriate? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define availability and recovery objectives for each business service and validate that the consolidated infrastructure can meet them.. Consolidation concentrates infrastructure risk while promising cost efficiency, so governance must tie the target environment to per-service availability and recovery objectives and must set capacity and performance thresholds monitored against service levels. These two actions preserve continuity and confirm the efficiency case with evidence. Choosing providers on price alone, dismantling monitoring prematurely, or delegating without oversight each removes a control the committee needs during a high-risk transition.

Answer

Approve the migration budget based solely on the lowest bid from the colocation provider.

Answer

Retire all legacy monitoring tools before the migration begins to reduce tooling costs.

Answer

Delegate all migration decisions to the facilities team and report outcomes only after completion.

Question 2

A multinational bank's IT leadership is concerned that its current IT workforce plan is not aligned with the strategic goal of expanding digital services in emerging markets. The CHRO and CIO jointly decide to implement a strategic workforce planning process. Which of the following is the MOST important initial step in this process?

Accepted Answer

Analyze the business strategy to determine the future demand for IT capabilities and services.. The correct answer is to analyze the business strategy to determine future IT capability demand. Strategic workforce planning is a governance process that ensures IT human resources are aligned with business goals. By starting with strategy, the organization can identify the skills, roles, and competencies needed to support expansion into emerging markets, and then decide whether to build, buy, or borrow those capabilities.

Answer

Conduct a skills inventory of the current IT staff to identify gaps against future needs.

Answer

Benchmark the current IT workforce against industry competitors to identify areas for improvement.

Answer

Develop a recruitment plan to hire IT professionals with digital skills in emerging markets.

Question 3

A global retailer has completed an IT-enabled supply chain transformation. Twelve months after go-live, the PMO reports that the expected reduction in inventory carrying cost has not materialized, even though the system is fully operational and user adoption is high. The CIO asks the benefits realization manager to determine why the expected benefit is not being realized. Which action should the benefits realization manager take FIRST?

Accepted Answer

Verify whether the benefit was assigned to a named benefits owner and whether the associated business process changes were actually implemented.. When technology is delivered and adopted but expected benefits do not appear, the most frequent causes are lack of a named benefits owner and failure to implement the business process changes the benefit depends on. Confirming ownership and process change is a fast, targeted diagnostic that addresses the enterprise's accountability for outcomes rather than the solution's technical functionality.

Answer

Escalate to the vendor to confirm that the supply chain module is configured to deliver the promised inventory optimization functionality.

Answer

Re-run the business case to recalculate the projected inventory carrying cost savings using actual post-implementation data.

Answer

Commission a post-implementation review to compare the original business case assumptions against the current supply chain operating model.

Question 4

A national retail chain is selecting a cloud-based point-of-sale analytics provider that will process aggregated sales and loyalty data. The vendor will store data in a multi-tenant environment and subcontract a third party for data enrichment. The information security manager proposes approving the vendor based on its ISO/IEC 27001 certificate alone. As the CGEIT practitioner, which action BEST ensures third-party risk is governed appropriately before contract signature?

Accepted Answer

Perform risk-based due diligence that evaluates the vendor's controls, the subcontractor's role, contractual liability, and the sensitivity of the data, then document residual third-party risk for acceptance.. Third-party risk must be governed through due diligence scaled to data sensitivity and service criticality, extending to subcontractors and contractual protections. A certification supports but does not replace that assessment. The practitioner should ensure the evaluation covers controls, data handling, liability, and breach obligations, and that the resulting residual risk is documented and accepted by the appropriate risk owner before the enterprise becomes contractually committed.

Answer

Require the vendor to purchase cyber liability insurance and proceed once the certificate of insurance confirms coverage limits exceed the contract value.

Answer

Accept the certification as sufficient assurance because ISO/IEC 27001 requires an independent audit of the vendor's control environment.

Answer

Delegate the decision to the procurement team because vendor selection is a sourcing activity rather than an enterprise risk governance matter.

Question 5

A government agency has approved a benefits realization plan for a new citizen services portal. During execution, the program manager proposes deferring a planned integration with the identity verification service to accelerate the portal launch by two months. The benefits owner notes that the deferred integration will delay the projected reduction in identity fraud losses. Which action should the governance committee take to protect benefits realization?

Accepted Answer

Require a benefit impact assessment that quantifies the deferred fraud reduction, identifies any offsetting benefits, and then decide on the trade-off.. When a proposed change affects an approved benefit, the governance committee should require a benefit impact assessment that quantifies the effect and identifies compensating benefits before deciding. This keeps benefits realization as the decision criterion, allows informed trade-offs, and avoids both blind approval driven by schedule and rigid rejection of all change.

Answer

Approve the deferral because accelerating launch improves time-to-value and the fraud reduction benefit will still be delivered later.

Answer

Refer the decision to the program manager because operational scheduling trade-offs fall within the program's delegated authority.

Answer

Reject the deferral outright because any deviation from the approved benefits realization plan must not be permitted during execution.

Question 6

A regional energy utility is integrating operational technology with corporate IT to enable remote monitoring of substations. The CGEIT practitioner is defining how risk treatment options will be selected and governed across the resulting exposure. Which TWO considerations are MOST important when establishing the enterprise's approach to risk treatment? (Choose two.)

Accepted Answer

Risk treatment decisions must be aligned with the enterprise's risk appetite and tolerance, with residual risk accepted by an accountable risk owner.. Risk treatment must be anchored to the board-approved appetite and tolerance and to explicit ownership of residual risk, and each option should be judged by the residual position it produces and the trade-offs it imposes on cost, availability, and capability. Cost minimization and purely local decision-making undermine consistent, aggregable enterprise risk management, and treatments never close a risk outright because residual exposure and control effectiveness require continued monitoring.

Answer

Once a treatment such as control implementation or risk transfer is executed, the associated risk can be closed in the register because the chosen response has been applied.

Answer

Selecting the treatment option with the lowest implementation cost is the primary criterion, since cost minimization maximizes the value delivered by the risk function.

Answer

Treatment decisions should be made independently by each substation operations team so that local expertise drives the selection of controls.

Question 7

A retail bank has defined a risk appetite stating that any customer data breach affecting more than 10,000 records is unacceptable. During a project to implement a new CRM system, the project manager identifies that the design would store unencrypted customer data in a third-party cloud environment. The project is in the design phase, and the go-live is six months away. What should the CGEIT professional recommend FIRST?

Accepted Answer

Require the project team to redesign the solution to include encryption at rest and in transit, and update the risk register.. The risk appetite explicitly makes breaches over 10,000 records unacceptable. The project is in design, so the most effective first step is to ensure the solution meets the appetite by mandating encryption. This is a management-level action that aligns with governance responsibilities. Escalation, acceptance, or transfer are premature or inappropriate because the risk can be mitigated and the appetite is clear.

Answer

Accept the risk because the third-party cloud provider is contractually obligated to notify the bank of any breach.

Answer

Transfer the risk by purchasing cyber insurance that covers data breach costs up to $10 million.

Answer

Escalate the risk to the board's risk committee for a decision on whether to accept the risk.

Question 8

A global pharmaceutical company is implementing a new cloud-based clinical trial management system. The system will store sensitive patient data and must comply with strict regulatory requirements. The CGEIT professional is reviewing the risk register and notes that the risk of data leakage due to misconfiguration of the cloud environment is rated as high likelihood and high impact. The project team proposes to accept the risk because the cloud provider has a robust security certification. What should the CGEIT professional recommend?

Accepted Answer

Require the project team to implement configuration management and continuous monitoring controls to reduce the risk to an acceptable level.. The most appropriate recommendation is to implement configuration management and continuous monitoring controls. These directly mitigate the risk of misconfiguration, which is a high-likelihood and high-impact risk. Accepting or transferring the risk is inappropriate because the risk exceeds appetite and mitigation is feasible. Escalation may be needed if residual risk remains high, but the first step is to apply controls.

Answer

Accept the risk because the cloud provider's certification transfers the risk to the provider.

Answer

Transfer the risk by purchasing additional cyber insurance that covers cloud misconfiguration incidents.

Answer

Escalate the risk to the board and recommend delaying the project until the cloud provider agrees to accept liability for misconfiguration.

Question 9

An enterprise has just approved a three-year digital customer portal program. The CIO asks the IT governance committee to establish how benefits will be measured and reported to the board. The committee must decide which instrument gives the board the most reliable basis for judging whether the program is delivering value. Which of the following is the MOST appropriate instrument?

Accepted Answer

A benefits register that records each benefit, its owner, baseline, target, measurement method, and reporting frequency. The committee needs a forward-looking, ongoing governance instrument that ties each expected benefit to an owner, a baseline, a target, and a measurement method. That is precisely what a benefits register provides, enabling the board to compare actual outcomes with commitments at each review point. Cost, schedule, and retrospective reporting mechanisms describe activity or hindsight, not realized value.

Answer

A post-implementation review conducted once the portal has been live for twelve months

Answer

An earned value management report comparing planned spend with actual spend and work completed

Answer

A detailed project schedule showing milestones, deliverables, and resource assignments for all three years

Question 10

An enterprise's IT governance committee has approved a new cloud-first strategy, but six months later a post-implementation review finds that several business units procured on-premises infrastructure outside the approved strategy. The committee wants to prevent recurrence while keeping the strategy intact. Which action BEST addresses the governance gap?

Accepted Answer

Embed strategy alignment checks into the investment and procurement approval workflow so non-compliant requests require documented exception approval.. Governance gaps persist when strategy is communicated but not embedded in decision-making controls. The failure occurred because infrastructure requests could be approved without testing alignment to the approved cloud-first direction. Adding an alignment check and an exception path converts the strategy into an operational control, ensuring deviations are escalated and documented instead of silently funded.

Answer

Commission an external audit of all infrastructure purchases made in the last three years to quantify the extent of non-compliance.

Answer

Transfer responsibility for all infrastructure procurement decisions to the central IT department to remove business unit discretion.

Answer

Reissue the cloud-first strategy with an executive memo reiterating that all infrastructure purchases must align to it.

Question 11

A retail enterprise has completed an omnichannel order management platform. Eighteen months after go-live, the finance function reports that the expected reduction in inventory carrying cost has not appeared, even though the technology is functioning as designed. The governance committee is asked to determine the most likely governance failure. Which of the following is the MOST probable cause?

Accepted Answer

Benefits were never transitioned into business operations with accountable owners and process changes. Benefits realization depends on transitioning capability into operational change with named owners. When a platform works but the outcome does not appear, the usual cause is that no business owner was made accountable for the benefit and the supporting processes were never redesigned. Cost estimation, delivery methodology, and planning artifacts do not by themselves produce or block the inventory reduction.

Answer

The platform was implemented using agile delivery methods rather than a stage-gate approach

Answer

The benefits dependency network was documented at too high a level of abstraction

Answer

The business case understated the total cost of ownership of the platform

Question 12

A financial services enterprise is designing its IT governance system using COBIT 2019. The board wants assurance that IT-related risk is managed within the enterprise risk appetite, but the CIO is concerned that overly rigid controls will slow digital product launches. Which design factor consideration BEST balances these competing objectives?

Accepted Answer

Set differentiated capability targets by objective so that risk-sensitive areas such as change and release management are governed more tightly than low-risk innovation activities.. COBIT 2019 design factors exist precisely to tailor governance intensity to enterprise context and risk. The board needs assurance that risk stays within appetite, while the CIO needs speed for low-risk innovation. Setting differentiated capability targets by objective concentrates control effort where risk is highest and lightens it elsewhere, achieving both objectives without uniform, disproportionate overhead.

Answer

Delegate all IT risk decisions to the CIO and require quarterly reporting to the board on residual risk levels.

Answer

Exclude digital product development from the IT governance system until the products reach general availability.

Answer

Adopt all COBIT governance and management objectives at the highest capability level to provide maximum assurance.

Question 13

A government agency is preparing a benefits realization plan for a new case management system. The governance committee wants to ensure that the plan can support later intervention if benefits begin to lag. Which TWO characteristics must the plan include to enable timely corrective action? (Choose two.)

Accepted Answer

Named benefit owners empowered to make operational changes when measurements deviate. Timely intervention requires two things: the ability to detect a shortfall and the ability to act on it. Baselines with quantified targets and agreed measurement methods provide detection, while named benefit owners with operational authority provide the capacity to act. Architecture, training, and rigid funding are delivery concerns that do not by themselves enable corrective action on lagging benefits.

Answer

A detailed training curriculum for all end users of the new system

Answer

A fixed three-year capital budget with no reallocation provisions

Answer

A complete technical architecture diagram showing all system interfaces and data flows

Question 14

A manufacturing firm is closing out a completed infrastructure modernization program. The CIO wants to confirm that the program's claimed benefits will continue to be tracked after the program team disbands. Which of the following is the MOST important governance action at closure?

Accepted Answer

Transfer each benefit to a named operational owner with a defined measurement and reporting routine. Program closure is the point at which benefits accountability must move into the operational organization. Naming an operational owner for each benefit, with an agreed measurement method and reporting routine, keeps the value claim alive after the team disbands. Administrative closure, lessons learned, and delivery sign-off do not by themselves sustain benefits tracking.

Answer

Archive all project documentation and close the program budget

Answer

Obtain final sign-off from the steering committee that the program delivered as specified

Answer

Conduct a lessons-learned workshop with the program team

Question 15

An enterprise's IT governance framework defines decision rights for IT investment, but a recent review shows that business unit leaders routinely make technology commitments that bypass the defined approval authority. Which governance component is MOST directly deficient?

Accepted Answer

The organizational structures and decision rights that define who may commit IT resources.. When defined approval authority is routinely bypassed, the governance weakness is in organizational structures and decision rights, not in measurement, architecture, or continuity. The framework must make authority visible, enforced, and aligned with accountability so that IT resource commitments occur only through the intended governance channels and deviations are detected and addressed.

Answer

The IT architecture standards that specify approved technology platforms and integration patterns.

Answer

The service continuity arrangements that ensure critical systems can be recovered after disruption.

Answer

The performance measurement mechanism used to score IT service delivery against service levels.