CGEIT Practice Exam 2 — 20 Questions

Question 1

A retail bank's board has approved a risk appetite stating that no single technology failure may cause more than two hours of customer-facing outage. The CIO reports that the core banking platform depends on a single data center with a tested recovery time objective of six hours. Which action should the CGEIT practitioner recommend FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Escalate the appetite gap to the board risk committee with options to remediate the recovery capability or formally revise the appetite.. The board-approved appetite defines acceptable exposure, and the six-hour recovery objective exceeds the two-hour tolerance. The practitioner's first duty is to surface that gap to the board risk committee with remediation options and the alternative of formally revising the appetite. This preserves board ownership, enables an informed decision, and prevents either silent acceptance or unilateral spending.

Answer

Immediately approve funding for a second data center without consulting the board risk committee.

Answer

Revise the risk appetite statement to a six-hour tolerance so that reporting shows full compliance.

Answer

Accept the six-hour recovery time objective because the platform has never experienced a full outage.

Question 2

A healthcare provider's IT organization relies heavily on a small group of specialists who maintain a legacy clinical records interface. The specialists are approaching retirement, and documentation is sparse. The governance committee is asked to address this human resource risk. Which action BEST aligns with IT resource governance objectives?

Accepted Answer

Commission a knowledge transfer program that documents the interface, cross-trains additional staff, and sets a succession timeline. Human capital is a core IT resource, and concentrated knowledge in a few individuals is a governance risk to service continuity. A knowledge transfer program that documents the interface, cross-trains staff, and establishes a succession timeline reduces that concentration and builds durable capability. Retention bonuses, replacement projects, and contract staffing each leave the fundamental single-point-of-failure exposure in place.

Answer

Engage a staffing agency to provide contract specialists who can step in if any of the current specialists leave

Answer

Approve a retention bonus program to keep the specialists employed for as long as possible

Answer

Initiate a project to replace the legacy interface with a modern platform, eliminating the need for the specialists' skills

Question 3

Which TWO factors are essential for a successful benefits realization culture?

Accepted Answer

A focus on learning from both successes and failures.. Option A is correct because a benefits realization culture depends on continuous learning: organizations must systematically capture lessons from both successful and failed initiatives and feed them back into portfolio and program decisions, which is a core principle in frameworks such as Managing Successful Programmes (MSP) and the Benefits Realization Management (BRM) discipline. Option C is correct because clear accountability for benefit achievement ensures that named owners are responsible for defining, tracking, and reporting benefits through the benefits register and benefits realization plan, preventing benefits from being orphaned after project delivery. The remaining options do not belong: requiring all employees to learn programming (B) is a skills mandate unrelated to benefits realization, frequent updates to the technical architecture (D) is an IT maintenance activity rather than a cultural factor, and reducing the number of board meetings (E) would weaken governance and oversight of benefits rather than strengthen a benefits realization culture.

Answer

Requiring all employees to learn programming.

Answer

Frequent updates to the technical architecture.

Answer

Reducing the number of board meetings.

Question 4

A hospital network's IT governance committee is establishing its oversight structure. The committee needs a mechanism that provides independent, objective assurance to the board on whether IT controls are designed and operating effectively. Which mechanism should the committee establish?

Accepted Answer

An internal audit function with a reporting line to the board or audit committee.. Independent assurance over IT control design and operating effectiveness is delivered by internal audit when it reports to the board or audit committee, free from management influence. Steering committees, operations reviews, and vendor scorecards all serve valid purposes but are management-aligned activities that cannot objectively attest to controls. ISACA CGEIT emphasizes this separation as fundamental to effective governance oversight.

Answer

A weekly operations review meeting with IT managers to track incident metrics.

Answer

An IT steering committee chaired by the CIO to prioritize project requests.

Answer

A vendor scorecard process that rates third-party service providers quarterly.

Question 5

An organization's governance committee decides to stop funding a legacy IT system that is still critical for a specific department. What should be done?

Accepted Answer

Conduct an impact analysis and develop a migration strategy.. When funding is withdrawn from a system that remains critical to a department, the governance-driven response is to assess the business and operational impact and plan a controlled transition rather than abruptly terminating service. An impact analysis identifies dependencies, data retention needs, and continuity risks, while a migration strategy provides a governed path to a replacement or alternative. This preserves business continuity while respecting the committee's funding decision.

Answer

Decommission it immediately to save money.

Answer

Force the department to find their own funding.

Answer

Ignore the committee's decision and keep paying.

Question 6

Why should benefit realization planning start at the inception of an IT investment?

Accepted Answer

To ensure that the desired business outcomes are clearly defined and measurable.. Benefit realization planning must begin at inception because the entire investment rationale depends on defining what business outcomes the investment is meant to deliver and how those outcomes will be measured. If the desired outcomes are not clearly articulated and made measurable up front, there is no baseline against which to track value delivery, and the initiative risks drifting into a technology project with no demonstrable business return. CGEIT frames IT investment management around value delivery, so anchoring measurable outcomes at the start is what enables later benefit tracking, stage-gate reviews, and post-implementation evaluation.

Answer

To secure the budget before the project is approved.

Answer

To identify technical risks in the software architecture.

Answer

To ensure that the project team is selected correctly.

Question 7

A global retail enterprise runs its e-commerce platform on a mix of on-premises servers and IaaS virtual machines. The CIO wants to ensure that IT resource capacity decisions are driven by business demand signals rather than by infrastructure team convenience. Which governance mechanism BEST supports this objective?

Accepted Answer

Establish a demand management process that translates business forecasts into capacity plans reviewed by the IT steering committee.. Capacity governance must connect business demand to resource provisioning. A demand management process that feeds business forecasts into capacity plans, with steering committee oversight, ensures decisions are driven by business needs rather than infrastructure convenience. The other options either delegate to technical teams, use cost allocation alone, or apply rigid thresholds that ignore demand signals.

Answer

Delegate all capacity decisions to the infrastructure operations team because they have the deepest technical knowledge.

Answer

Adopt a policy that requires all new capacity to be procured only after the existing infrastructure reaches 95% utilization.

Answer

Implement a chargeback model that bills business units for every CPU cycle consumed on the e-commerce platform.

Question 8

When assessing the feasibility of a project, why is it necessary to evaluate the 'risk of benefit realization'?

Accepted Answer

To determine if the expected value can realistically be achieved under current conditions.. Evaluating the risk of benefit realization determines whether the projected business value can actually be delivered given current organizational, technical, and market conditions. It separates optimistic benefit forecasts from achievable outcomes by factoring in uncertainty, dependencies, and constraints. This assessment directly informs investment decisions and whether the business case is defensible.

Answer

To ensure the project follows the vendor's best practices.

Answer

To ensure the technical project has no bugs.

Answer

To reduce the number of stakeholders involved.

Question 9

A manufacturing firm's CIO is establishing benefits ownership for a portfolio of IT-enabled change programs. The steering committee wants to ensure each benefit has clear accountability so that realization can be tracked and intervened upon. Which TWO of the following are essential components of effective benefits ownership? (Choose two.)

Accepted Answer

A named business owner who is accountable for the outcome and has authority over the processes that generate the benefit.. Effective benefits ownership requires an accountable business owner with authority over the process that generates the benefit, plus an agreed measure with baseline and target. Together these create a clear contract for delivery and a basis for intervention. Tracking by the PMO, custody by finance, or executive reporting are supporting mechanisms but do not themselves establish ownership or make the benefit measurable.

Answer

Assignment of benefit tracking to the project management office for the duration of the program.

Answer

A commitment from the CIO to report benefit status directly to the board each quarter.

Answer

A benefits register maintained exclusively by the finance department to ensure consistency of valuation.

Question 10

Which document is essential for formalizing the relationship and expectations between IT and the business units?

Accepted Answer

Service Level Agreement (SLA).. A Service Level Agreement (SLA) is the formal document that defines the services IT will deliver, the expected performance levels, responsibilities of both parties, and remedies for non-performance. It is the primary instrument for codifying the relationship and mutual expectations between IT and business units. While other documents set direction or authorize work, the SLA operationalizes the IT-business relationship.

Answer

Governance Policy Statement.

Answer

Project Charter.

Answer

IT Strategic Plan.

Question 11

A global company needs to compare IT investment performance across different business units using different currencies and operational models. Which metric is most suitable for normalization?

Accepted Answer

Normalized TCO relative to business unit output.. Normalized Total Cost of Ownership relative to business unit output adjusts for differences in currency, scale, and operating model by expressing IT cost per unit of business output (e.g., per transaction, per revenue dollar, per customer). This creates an apples-to-apples comparison across units that operate in different currencies and with different cost structures. It is the only option that both normalizes for currency and contextualizes cost against productive output.

Answer

Number of active projects per business unit.

Answer

IT spend as a percentage of total head count.

Answer

Local currency ROI calculations.

Question 12

Which type of IT resource is most likely to become a bottleneck during a rapid increase in business demand?

Accepted Answer

Computing infrastructure. Computing infrastructure (servers, storage, network capacity) is a finite, physical resource that cannot scale instantly, so a rapid spike in business demand will exhaust capacity and create a bottleneck. Policies, culture, and documentation are intangible and do not constrain throughput in the same way. This makes computing infrastructure the most likely bottleneck under sudden demand growth.

Answer

Policies and procedures

Answer

Organizational culture

Answer

Strategic documentation

Question 13

A governance review reveals that IT decision-making is too slow to support rapid market changes. What should be done?

Accepted Answer

Delegate specific decision-making authorities to lower levels based on defined thresholds. When governance slows decision-making, the correct remedy is to redesign decision rights, not to remove oversight or centralise further. Delegating specific authorities to lower levels with defined thresholds (e.g., spend limits, risk tiers) preserves accountability while enabling speed. This is a core principle of effective governance design — matching decision latency to the pace of the business.

Answer

Require the board of directors to approve every IT change

Answer

Remove all governance oversight requirements to speed up decisions

Answer

Stop all development until the governance process is redesigned

Question 14

A large organization is attempting to reduce technical debt. Which resource management approach is most effective?

Accepted Answer

Allocating a set percentage of capacity to technical debt remediation in every sprint/cycle. The most effective approach to reducing technical debt is to allocate a consistent, planned percentage of capacity in every sprint or cycle to remediation, making debt reduction a continuous, funded activity rather than a one-off project. This prevents debt from compounding and balances new feature delivery with maintainability. It also embeds remediation into governance and resource management routines.

Answer

Outsourcing the maintenance of legacy systems

Answer

Pausing all new development until all legacy systems are replaced

Answer

Waiting for a major system failure to justify remediation budget

Question 15

When balancing risk and value in IT investment, what is the primary consideration for the CGEIT practitioner?

Accepted Answer

Optimizing the realization of benefits while maintaining risk exposure within the enterprise appetite.. The primary consideration for a CGEIT practitioner is to optimize value realization while keeping risk exposure within the enterprise's defined risk appetite. This balances the pursuit of benefits with the constraint of acceptable risk, aligning IT investment with business strategy. It is not about eliminating risk or ignoring it for ROI.

Answer

Prioritizing compliance over all other business requirements.

Answer

Total elimination of IT risk.

Answer

Maximizing the return on investment (ROI) regardless of risk exposure.

Question 16

An organization's risk appetite has been set as 'low' for data breaches. A new project introduces a moderate risk of a breach. What is the most appropriate governance action?

Accepted Answer

Implement additional security controls to bring the residual risk within the 'low' appetite.. The organization has explicitly set a 'low' risk appetite for data breaches, meaning any risk above that threshold is unacceptable without treatment. Since the project introduces a moderate breach risk that exceeds the stated appetite, governance must direct treatment — implementing additional controls to reduce residual risk to within the 'low' appetite. This preserves both the project's value and the board-approved risk posture, which is the core purpose of risk appetite-driven governance.

Answer

Accept the risk because the project is strategically important.

Answer

Lower the 'low' appetite threshold to 'moderate'.

Answer

Document the risk in the risk register and ignore it for now.

Question 17

An organization adopts a multi-cloud strategy. Which governance challenge is most significant regarding resource optimization?

Accepted Answer

The lack of consistent visibility, policy enforcement, and cost management across platforms. In a multi-cloud environment, the dominant governance challenge for resource optimisation is the fragmentation of visibility, policy, and cost control across providers. Each cloud has its own management console, IAM model, tagging conventions, and billing structure, making it difficult to enforce consistent governance or optimise spend holistically. This fragmentation — not provisioning speed or talent — is what undermines governance effectiveness.

Answer

The slower speed of provisioning resources

Answer

The difficulty of finding cloud architects

Answer

The increased cost of data egress fees between clouds

Question 18

A corporation is shifting from a centralized to a decentralized IT structure. How does this affect governance?

Accepted Answer

Governance must define common standards while allowing local decision-making flexibility.. When IT shifts from centralized to decentralized, governance must adapt by defining common enterprise-wide standards (security, data, architecture) while granting business units flexibility for local decisions. This federated model preserves enterprise coherence without stifling local responsiveness. Governance does not disappear — it changes form to balance control and autonomy.

Answer

The board should take over all local IT decisions.

Answer

The governance framework is no longer required.

Answer

Decentralization makes IT governance impossible.

Question 19

Which stakeholder is ultimately accountable for the governance of IT in an enterprise?

Accepted Answer

The Board of Directors. Ultimate accountability for IT governance rests with the Board of Directors (D). In governance frameworks such as COBIT and ISO/IEC 38500, the board is responsible for setting direction, ensuring IT delivers value, optimizing risk, and optimizing resources. While IT steering committees, the CIO, and audit provide oversight and execution, the board holds the ultimate fiduciary accountability to stakeholders for how IT is governed.

Answer

The IT Steering Committee

Answer

The Internal Audit department

Answer

The Chief Information Officer (CIO)

Question 20

A large enterprise is transitioning to a hybrid cloud environment. How should the governance policy be updated to maintain effective oversight?

Accepted Answer

Develop policies addressing shared responsibility and cloud governance controls.. In a hybrid cloud model, governance must be updated to reflect the shared responsibility model, where the cloud provider secures the cloud infrastructure while the enterprise remains accountable for data, identities, and configurations in the cloud. Developing policies that explicitly address shared responsibility and cloud-specific governance controls (e.g., CASB, CSPM, contract SLAs) ensures oversight is maintained across both on-premises and cloud environments. This aligns with CGEIT's focus on aligning IT governance with enterprise strategy and risk.

Answer

Centralize all IT infrastructure back to on-premises.

Answer

Shift all responsibility for security to the cloud provider.

Answer

Eliminate the need for internal IT policies.