CGEIT Practice Test 21 — 15 Questions

Question 1

An energy company's IT department has accumulated significant technical debt in its custom billing systems. The CIO wants to establish a governance mechanism to ensure technical debt is managed as an IT resource concern. Which action should the governance committee take FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establish a technical debt register that quantifies debt items by remediation cost, business risk, and impact on delivery velocity. Technical debt is an IT resource concern because it consumes future capacity and introduces risk. The governance committee's first step is to establish visibility through a register that quantifies each debt item's remediation cost, risk, and velocity impact. Only with that evidence can the committee make defensible decisions about refactoring allocations, development freezes, or outsourcing. The other options prescribe remedies before the problem has been measured.

Answer

Freeze all new feature development until the existing technical debt has been fully remediated

Answer

Require development teams to allocate a fixed percentage of each sprint to refactoring legacy code

Answer

Outsource maintenance of the billing systems to a third party contractually obligated to reduce defect rates

Question 2

Which THREE of the following are key steps in the lifecycle of IT infrastructure resource management?

Accepted Answer

Planning and acquisition. Option A (Planning and acquisition) is correct because the lifecycle begins with capacity planning, requirements gathering, budgeting, and procurement of hardware, software, and services before resources are deployed. Option B (Decommissioning and disposal) is correct because end-of-life handling—secure data wiping, asset retirement, and environmentally compliant disposal—is a formal final phase of infrastructure resource management. Option D (Monitoring and optimization of usage) is correct because ongoing performance monitoring, capacity tracking, and tuning ensure resources remain efficient and cost-effective throughout their operational life. Option C (Employee vacation scheduling) is incorrect because it is an HR/staffing function unrelated to managing infrastructure assets. Option E (Social media content creation) is incorrect because it is a marketing activity with no role in the infrastructure resource lifecycle.

Answer

Employee vacation scheduling

Answer

Social media content creation

Question 3

A mid-sized insurance company has no formal IT governance structure. The board wants assurance that IT is delivering value and managing risk appropriately. The CIO proposes creating a governance framework based on a recognized standard. Which action should be taken FIRST when establishing this framework?

Accepted Answer

Define governance objectives and scope in alignment with enterprise goals and stakeholder needs.. The first step in establishing any governance framework is to define its objectives and scope in alignment with enterprise goals and stakeholder needs. This establishes purpose and boundaries that guide every subsequent design choice, including structures, roles, processes, and tooling. Benchmarking, tool deployment, and role assignment are valuable but depend on knowing what governance must achieve and cover. Starting with them risks a framework that is technically complete yet strategically irrelevant.

Answer

Benchmark the company's IT maturity against industry peers to identify gaps.

Answer

Purchase and deploy a governance, risk, and compliance tool to automate oversight.

Answer

Appoint a chief risk officer to own all IT governance responsibilities.

Question 4

A global manufacturing firm's IT governance board is evaluating the performance of its IT governance framework. The board wants to ensure that the framework remains effective as the business environment changes. Which of the following should be the board's PRIMARY consideration?

Accepted Answer

The alignment of IT governance objectives with evolving business strategy and external factors.. The board's primary consideration should be the alignment of IT governance objectives with evolving business strategy and external factors. This ensures that the governance framework remains effective and relevant as the business environment changes. Without continuous alignment, even well-structured governance can become obsolete, failing to support the enterprise's strategic goals.

Answer

The frequency of IT governance meetings and attendance rates.

Answer

The number of IT policies and procedures documented and approved.

Answer

The percentage of IT staff who have completed governance training.

Question 5

An enterprise is transitioning to a hybrid cloud environment. Which governance mechanism is most critical to ensure compliance with data sovereignty regulations?

Accepted Answer

Implementing a robust data classification policy and control framework. A robust data classification policy and control framework is most critical because data sovereignty compliance depends on knowing what data exists, where it resides, and how it is protected across hybrid cloud environments. Classification drives the controls that ensure data is stored and processed in permitted jurisdictions.

Answer

Automated provisioning of infrastructure using Infrastructure as Code (IaC)

Answer

Establishing a service level agreement (SLA) with the cloud provider

Answer

Increasing the frequency of penetration testing on cloud endpoints

Question 6

A financial services firm is integrating its IT risk register with its enterprise risk management (ERM) framework. The CGEIT practitioner is asked to ensure that IT risk reporting to the board is both actionable and aligned with strategic objectives. Which TWO of the following practices are MOST critical to achieve this integration? (Choose two.)

Accepted Answer

Mapping IT risks to specific business processes and strategic objectives.. Integrating IT risk with ERM requires expressing IT risks in business terms and using consistent methodologies. Mapping IT risks to business processes and strategic objectives ensures the board understands impact on corporate goals. A common risk taxonomy and scoring methodology enables aggregation and comparison with other enterprise risks. Together, these practices make IT risk reporting actionable and aligned with strategy. Other options, such as equal reporting frequency or exclusive CIO ownership, undermine integration by creating silos or diluting focus.

Answer

Conducting annual IT risk assessments without continuous monitoring.

Answer

Delegating IT risk ownership exclusively to the CIO to streamline accountability.

Answer

Reporting all IT risks with equal frequency and detail to ensure completeness.

Question 7

During a portfolio review, a project is identified as having a positive Net Present Value (NPV) but a low 'Strategic Fit' score. What is the most appropriate governance action?

Accepted Answer

Conduct a re-assessment of the strategic goals to determine if the project's value proposition has been overlooked.. A positive NPV indicates the project delivers measurable financial value, so outright cancellation (A) would destroy value. The low Strategic Fit score signals a possible misalignment between the project and current strategic objectives, but governance should not assume the project is wrong — it should first validate whether the strategic goals themselves are still accurate or whether the project's value proposition has been overlooked. Re-assessing strategic goals (C) is the balanced governance action that preserves value while ensuring alignment.

Answer

Immediately cancel the project to preserve strategic alignment.

Answer

Transfer ownership of the project to the operations department for maintenance.

Answer

Prioritize the project to maximize immediate cash flow.

Question 8

An IT governance committee is defining how it will track the benefits of a new enterprise resource planning (ERP) system. The committee wants to ensure that reported benefits are credible and comparable over time. Which action is MOST important?

Accepted Answer

Establish a benefits register with defined metrics, baselines, targets, owners, and measurement frequency.. A benefits register with defined metrics, baselines, targets, owners, and reporting frequency is the foundational artifact that makes benefit tracking credible and comparable. It assigns accountability and creates an auditable record. Post-implementation reviews, project status reports, and vendor case studies are supporting inputs but cannot substitute for a structured register that governs measurement from the outset.

Answer

Require the project manager to report benefit status in the weekly project status report.

Answer

Conduct a post-implementation review six months after go-live.

Answer

Ask the vendor to provide a benefits case study from a similar ERP deployment.

Question 9

You are evaluating the maturity of your organization's risk reporting to the board. Which THREE of the following elements are essential for high-maturity reporting?

Accepted Answer

Presentation of risk trends in relation to strategic business milestones.. High-maturity board risk reporting must connect risk to strategy, so option A is correct because presenting risk trends against strategic business milestones shows how risk exposure evolves relative to the organization's objectives and major initiatives. Option B is correct because expressing residual risk against defined risk appetite thresholds tells the board whether current exposure is within tolerance and where remediation or acceptance decisions are needed. Option E is correct because documenting emerging risks that could affect the enterprise's long-term viability gives the board forward-looking insight beyond current operational issues. Option C does not belong because detailed technical architecture diagrams of security tools are operational artifacts, not board-level risk reporting elements. Option D does not belong because reporting on all low-impact vulnerability scans is excessive operational detail and does not focus on material risk or strategic impact.

Answer

Detailed technical architectural diagrams of all security tools.

Answer

Reporting on the status of all low-impact vulnerability scans.

Question 10

A newly appointed CIO is establishing an IT governance framework. Which approach best ensures that IT governance is integrated into the enterprise's existing management structure?

Accepted Answer

Map IT governance activities to existing business decision-making processes and accountabilities.. Integrating IT governance into the enterprise's existing management structure requires mapping IT governance activities to existing business decision-making processes and accountabilities. This ensures IT governance is not a parallel or isolated structure but is embedded in how the enterprise already makes decisions, allocates resources, and manages risk. Alignment with existing structures drives adoption and avoids duplication.

Answer

Require all IT departments to report directly to the Chief Risk Officer.

Answer

Adopt a proprietary framework developed by a third-party IT consulting firm.

Answer

Implement a parallel IT governance board independent of the executive committee.

Question 11

Who is ultimately responsible for the governance of enterprise IT?

Accepted Answer

The Board of Directors.. Under governance frameworks like COBIT and ISO/IEC 38500, the Board of Directors holds ultimate accountability for enterprise IT governance. The board sets direction, ensures IT aligns with business strategy, monitors performance, and oversees risk. While IT management executes governance, the board retains ultimate responsibility.

Answer

The IT Manager.

Answer

The CEO.

Answer

The IT Auditor.

Question 12

Which TWO of the following are common challenges in tracking benefits?

Accepted Answer

The long time lag between project implementation and benefit realization.. Option A is correct because benefits from IT investments often materialize only months or years after the project is implemented, making it hard to attribute and measure realized value within typical reporting cycles. Option C is correct because IT benefits are usually intertwined with process changes, organizational factors, and other business initiatives, so isolating the specific contribution of IT is genuinely difficult. Options B, D, and E are not common challenges specific to benefits tracking: cloud hosting cost is a budgeting/pricing concern, a steering committee is a governance mechanism rather than a tracking obstacle, and project milestone tracking tools are widely available and address schedule tracking, not benefit realization.

Answer

The high cost of cloud hosting services.

Answer

The requirement to have a steering committee.

Answer

The lack of software tools to track project milestones.

Question 13

A firm has decided to pursue a high-risk innovation strategy. How should the enterprise risk appetite statement be adjusted to support this goal?

Accepted Answer

Establish a higher risk appetite for experimental initiatives with clear sunset clauses.. To support a high-risk innovation strategy, the risk appetite statement should explicitly raise tolerance for experimental initiatives while imposing clear sunset clauses so that unsuccessful experiments are terminated rather than allowed to persist. This balances the pursuit of innovation with governance discipline. Sunset clauses ensure that elevated risk acceptance is time-bound and reviewed, preventing risk creep.

Answer

Mandate that all innovation projects pass a legacy audit before approval.

Answer

Outsource the management of all new innovation projects to a third party.

Answer

Lower the threshold for all IT risk controls to ensure maximum security.

Question 14

When balancing internal versus external IT resource sourcing, which factor best dictates the decision?

Accepted Answer

Whether the activity provides a core competitive advantage to the organization. The core determinant in sourcing decisions is whether the activity is a source of competitive differentiation. Activities that provide strategic or core competitive advantage should generally be kept internal to retain control, expertise, and IP, while commodity or non-differentiating activities are candidates for external sourcing. This aligns with the strategic alignment and value delivery principles of IT governance.

Answer

The current market salary for IT professionals

Answer

The historical preference of the IT department

Answer

The availability of local outsourcing vendors

Question 15

A company is experiencing friction between IT and business units regarding project priorities. What governance structure should be strengthened to resolve this?

Accepted Answer

The IT Steering Committee. The IT Steering Committee is the governance body that brings business and IT leadership together to prioritize projects, resolve competing demands, and ensure IT investments align with enterprise strategy. Friction over project priorities is precisely the mandate of this committee, which has the authority to arbitrate between business units and IT. Strengthening it — through clearer terms of reference, decision rights, and representation — directly addresses the root cause.

Answer

The IT Change Advisory Board (CAB)

Answer

The Security Operations Center (SOC)

Answer

The IT Infrastructure Architecture board