CGEIT Practice Exam 3 — 20 Questions

Question 1

An organization is updating its IT governance policies. Which element must be included to ensure policy enforcement?

Accepted Answer

Defined roles, responsibilities, and accountability mechanisms. To ensure policy enforcement, an IT governance policy must include defined roles, responsibilities, and accountability mechanisms (B). Policies without assigned ownership and consequences are unenforceable; defining who is responsible for compliance, who monitors it, and what happens when it is violated is what turns a policy document into an enforceable governance instrument. This aligns with COBIT's emphasis on organizational structures and accountability.

Answer

A copy of the IT department's budget spreadsheet

Answer

A detailed technical configuration guide for all servers

Answer

A list of all software vendor names used by the company

Question 2

What is the primary benefit of asset management within IT resource governance?

Accepted Answer

Providing visibility into the IT inventory for optimization and compliance. Asset management in IT resource governance provides visibility into the IT inventory — hardware, software, licenses, and configurations — enabling optimization (cost, utilization, lifecycle) and compliance (license audits, regulatory requirements). This visibility is the foundation for informed investment, retirement, and risk decisions. Without it, governance cannot know what resources exist or whether they are being used effectively.

Answer

Reducing the need for IT staff

Answer

Ensuring all hardware is painted the same color

Answer

Automating the password reset process

Question 3

A project delivers a new system, but the benefits are not realized due to an outdated manual process that was not updated. Where did the benefits management plan fail?

Accepted Answer

In the business change management and process alignment components.. Benefits realization depends not only on delivering the technology but also on changing the business processes and organizational behaviors that surround it. If an outdated manual process remains in place after the system goes live, the expected benefits cannot materialize — this is a failure of the business change management and process alignment components of the benefits management plan.

Answer

In the software coding standards.

Answer

In the technical design phase.

Answer

In the project budget management.

Question 4

An organization is merging with another company. How should the governance structures be reconciled?

Accepted Answer

Conduct a gap analysis and develop a unified governance framework.. When merging organizations, governance structures should be reconciled through a gap analysis that identifies differences, overlaps, and best practices, followed by development of a unified framework. This ensures the merged entity has a coherent governance model aligned with its new strategy, risk profile, and regulatory obligations. Simply adopting one side's framework or keeping both creates inconsistency and accountability gaps.

Answer

Adopt the framework of the company with more employees.

Answer

Keep both frameworks as they are.

Answer

Abandon both frameworks and start from scratch.

Question 5

What is the primary difference between a Project Manager and a Benefits Owner?

Accepted Answer

The project manager is responsible for the technical output; the benefits owner is responsible for the business outcome.. The project manager owns delivery of the project's defined scope, schedule, and technical outputs within constraints, while the benefits owner is accountable for realizing the intended business outcomes and value after delivery. In CGEIT terms, this separation reflects the distinction between project execution (outputs) and benefits realization (outcomes), which is central to IT governance and value delivery.

Answer

There is no difference between these two roles.

Answer

The project manager is responsible for the company's financial results.

Answer

The benefits owner manages the daily development tasks.

Question 6

An organization adopts a new IT governance policy. Which mechanism best ensures that employees understand and follow the policy?

Accepted Answer

Establishing a formal communication and training plan regarding the policy. Establishing a formal communication and training plan is the most effective mechanism because it proactively ensures that employees are aware of the policy, understand its requirements, and know how to comply. Training and communication are core components of IT governance implementation, as they translate policy intent into actionable behavior. This approach aligns with COBIT's focus on culture, ethics, and behavior, ensuring that governance policies are embedded in the organization. Without such a plan, even the best policy remains unknown or misunderstood.

Answer

Including the policy in the organization's long-term strategic plan

Answer

Threatening immediate termination for any policy deviation

Answer

Encrypting the policy document on the corporate intranet

Question 7

Which TWO stakeholders are essential for successful IT governance?

Accepted Answer

Executive Management. Executive Management (C) is essential because IT governance requires top leadership to set strategic direction, approve IT policies, allocate budgets, and ensure IT investments align with business objectives and risk appetite. The Board of Directors (D) is also essential because it provides ultimate oversight and accountability, ensuring that IT governance frameworks, risk management, and compliance obligations are met at the highest organizational level. Together, these two stakeholders supply the authority, strategic alignment, and oversight that define successful IT governance. Local IT repair technicians (A) perform operational support tasks rather than governance-level decision-making, delivery drivers (B) are unrelated to IT governance, and external janitorial staff (E) have no governance role, so none of these belong.

Answer

Local IT repair technicians

Answer

Delivery drivers

Answer

External janitorial staff

Question 8

A retail company's IT risk register shows that a legacy point-of-sale system has a high likelihood of failure due to unsupported hardware. The CIO wants to replace it, but the CFO argues that the system still works and replacement is too expensive. The CEO asks the CGEIT practitioner to facilitate a decision. Which of the following should be the primary basis for the decision?

Accepted Answer

The alignment of the decision with the enterprise's risk appetite and tolerance levels.. Governance decisions about IT risk should be anchored in the enterprise's risk appetite. When a risk exceeds tolerance, the organization must act to bring it within acceptable levels, even if that requires investment. The CGEIT practitioner facilitates this by ensuring the decision is framed around risk-return alignment rather than cost or technical specifications alone.

Answer

The CFO's cost-benefit analysis showing that replacement is not financially justified.

Answer

The total cost of ownership of the legacy system versus the replacement.

Answer

The technical specifications of the replacement system compared to the legacy system.

Question 9

Which of the following best defines IT Governance?

Accepted Answer

A structure of relationships and processes to direct and control the enterprise.. IT governance is defined as the structure of relationships and processes used to direct and control the enterprise's IT resources toward business objectives. This definition (rooted in COBIT and ITGI) emphasizes direction, control, and accountability rather than operational execution. It encompasses leadership, organizational structures, and processes that ensure IT sustains and extends the enterprise's strategy and objectives.

Answer

Purchasing new software for the company.

Answer

Managing daily IT support tickets.

Answer

Updating antivirus software across the network.

Question 10

When benefits are reported as 'percentage of goal achieved', what is a potential risk?

Accepted Answer

Percentages may hide the underlying absolute values and total costs.. Reporting benefits as a percentage of goal achieved can obscure the absolute magnitude of the benefit and the costs incurred. For example, achieving 100% of a small goal may look successful, but if the total cost was enormous, the net value could be negative. Percentages alone do not reveal whether the benefit is material to the organization or whether the investment was worthwhile.

Answer

Percentages are too difficult for stakeholders to understand.

Answer

Percentages cannot be calculated for IT projects.

Answer

Percentages are always accurate.

Question 11

An organization experiences a high frequency of minor IT incidents. What is the most effective governance action to ensure this does not result in a significant enterprise risk?

Accepted Answer

Implementing a root cause analysis (RCA) program to identify systemic patterns across recurring incidents.. The most effective governance action is to implement a root cause analysis (RCA) program to identify systemic patterns across recurring incidents. This addresses the underlying causes rather than symptoms, preventing minor incidents from accumulating into a significant enterprise risk. Governance focuses on systemic improvement, not just operational fixes.

Answer

Updating the incident management policy to mandate shorter SLA targets.

Answer

Increasing the budget for incident response staff.

Answer

Requiring all incidents to be reported directly to the board of directors.

Question 12

A company is conducting a risk analysis. Which of the following is an example of an 'inherent risk'?

Accepted Answer

The risk that exists in the absence of any controls.. Inherent risk is defined as the level of risk that exists before any controls, mitigations, or countermeasures are applied. It represents the raw exposure of an asset or process to a given threat. Option A correctly captures this by describing risk 'in the absence of any controls.' This baseline is used in risk analysis to determine how much risk treatment is actually reducing exposure.

Answer

The risk remaining after all security patches are installed.

Answer

The risk that is accepted by the board of directors.

Answer

The risk that has been mitigated by insurance.

Question 13

When planning for the retirement of legacy systems, which factor is most critical for resource optimization?

Accepted Answer

Detailed mapping of interdependencies and data flows with current systems. When retiring legacy systems, the most critical factor for resource optimization is a detailed mapping of interdependencies and data flows between the legacy system and current systems. Without this map, retirement can break integrations, orphan data, or trigger unplanned remediation work that consumes more resources than the retirement saves. Understanding dependencies enables sequenced decommissioning and accurate resource forecasting.

Answer

The initial cost of implementing the system

Answer

The amount of documentation available for the system

Answer

The age of the hardware

Question 14

A telecommunications provider has completed a risk assessment for a new 5G network slicing service. The CGEIT practitioner must ensure the results are used to optimize risk. Which action best demonstrates that risk assessment outputs are driving resource allocation decisions?

Accepted Answer

Prioritizing security investment for the highest-rated slicing risks and adjusting the service launch plan to remediate them before go-live.. Risk optimization means assessment outputs change where money, time, and attention go. Prioritizing investment toward the highest-rated network slicing risks and making remediation a condition of launch converts analysis into concrete allocation and sequencing decisions. Archiving, counting, or equalizing budgets do not alter resource flows in response to risk severity, so they fail to demonstrate optimization.

Answer

Assigning every identified risk an equal remediation budget to avoid perceived favoritism among business units.

Answer

Presenting the total number of identified risks to the executive committee as a measure of assessment thoroughness.

Answer

Filing the assessment in the project repository so it is available for future audits.

Question 15

To effectively integrate risk management into enterprise governance, which THREE activities should be conducted?

Accepted Answer

Defining the enterprise risk appetite in quantitative or qualitative terms.. Option A is correct because defining the enterprise risk appetite in quantitative or qualitative terms establishes the boundaries and thresholds against which all risk decisions are made, which is foundational for embedding risk management into governance. Option B is correct because establishing clear accountability for risk ownership at the executive level ensures that risk decisions are tied to strategic objectives and that someone with authority is answerable for outcomes, a core governance principle. Option D is correct because integrating risk reporting into the existing enterprise performance management process embeds risk into the same metrics, reviews, and decision cycles used to steer the business, making risk management continuous rather than a separate exercise. Option C is not correct because standardizing the CMDB structure is an IT service management configuration task, not a governance-level risk management activity. Option E is not correct because outsourcing the primary data center to a tier-one cloud provider is a specific sourcing decision that may address some risks but does not itself integrate risk management into enterprise governance.

Answer

Standardizing the IT configuration management database (CMDB) structure.

Answer

Outsourcing the primary data center to a tier-one cloud provider.

Question 16

When implementing a resource governance policy, which action is most critical to success?

Accepted Answer

Securing executive sponsorship and driving organizational buy-in. Executive sponsorship and organizational buy-in are the most critical success factors because resource governance policies require authority to enforce trade-offs, resolve conflicts, and change behavior across silos. Without top-level sponsorship, even well-designed policies lack the mandate to be adopted and sustained.

Answer

Hiring a dedicated resource governance manager

Answer

Automating all policy enforcement mechanisms

Answer

Creating a 500-page policy document covering every scenario

Question 17

Which TWO of the following are considered key elements of a robust Benefits Realization Plan (BRP)?

Accepted Answer

Clear identification of benefits and their owners.. Option D is correct because a robust Benefits Realization Plan must explicitly identify each intended benefit and assign a named benefit owner who is accountable for its delivery and tracking, ensuring benefits are actively managed rather than assumed. Option E is correct because the BRP requires defined metrics with baseline performance measurements so that benefit delivery can be quantified and compared against the pre-project state, enabling objective realization tracking. Options A, B, and C do not belong: vendor licensing terms, a project team contact list, and technical architectural diagrams are project or solution artifacts that support delivery but do not constitute the benefit identification, ownership, measurement, and baselining elements that define a BRP.

Answer

Detailed software vendor licensing terms.

Answer

Project team contact list.

Answer

Technical architectural diagrams.

Question 18

An enterprise is facing significant shadow IT growth. What is the best governance action to optimize resources?

Accepted Answer

Implement a cloud access security broker (CASB) to provide secure, governed alternatives. Shadow IT grows because central IT is perceived as too slow or too restrictive, so business units procure their own cloud services. The best governance action is to implement a CASB that provides secure, governed alternatives — this addresses the root cause by giving business units a fast, compliant path to the services they want while restoring visibility and policy enforcement. A CASB brokers access, discovers unsanctioned cloud usage, and applies data protection controls, converting shadow IT into managed IT.

Answer

Audit all business units and penalize those using shadow IT

Answer

Restrict all unauthorized cloud service access via the firewall

Answer

Mandate that all IT needs be submitted via the central IT ticketing system

Question 19

Which of the following is an example of an 'indirect' benefit?

Accepted Answer

Improved employee morale and productivity due to better UI.. Improved employee morale and productivity due to a better UI is an indirect benefit because it is a secondary, often intangible outcome that flows from the system rather than being a directly measurable financial return. Indirect benefits are harder to quantify but still contribute to organizational value.

Answer

Increased revenue from new digital sales channels.

Answer

Decrease in server hardware acquisition costs.

Answer

Reduction in annual software maintenance costs.

Question 20

A global retailer's board has approved a risk appetite statement that permits a maximum acceptable annual loss from e-commerce fraud of $2 million. Six months into the fiscal year, the CISO reports cumulative fraud losses of $1.9 million, and the fraud team projects an additional $600,000 in losses before year-end if no action is taken. The CISO proposes deploying an AI-based fraud detection tool costing $400,000 annually. What should the CGEIT practitioner recommend FIRST?

Accepted Answer

Escalate the projected risk appetite breach to the board with a risk analysis and recommended response options.. A projected breach of the board-approved risk appetite triggers a governance obligation to escalate with a thorough risk analysis and response options. The board must decide whether to accept, mitigate, transfer, or avoid the risk. Approving a specific tool or adjusting the appetite without board involvement bypasses governance and could lead to misalignment with strategic objectives.

Answer

Instruct the fraud team to increase manual review of transactions to reduce losses below the threshold.

Answer

Approve the AI-based fraud detection tool because the projected losses exceed the risk appetite threshold.

Answer

Revise the risk appetite statement to allow a higher fraud loss limit so the enterprise remains within tolerance.