CGEIT Practice Test 22 — 15 Questions

Question 1

A global logistics enterprise has approved a multi-year digital transformation program. Six months into execution, the CIO discovers that the program's business case claims a 12% reduction in fleet maintenance costs, but the operations division never agreed to change its maintenance scheduling process. Which benefits realization governance gap does this situation MOST directly illustrate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The benefits dependency network was not validated with the business owner accountable for realizing the benefit.. Realizing a cost-reduction benefit depends on a business change being owned and committed to by the operational unit that must adopt it. Because operations never agreed to change maintenance scheduling, the enabling change underpinning the benefit was absent, and the benefits dependency network was therefore not validated with the accountable business owner before approval.

Answer

The enterprise architecture team did not perform a technology readiness assessment before program approval.

Answer

The IT steering committee lacked a documented escalation path for scope changes affecting program funding.

Answer

The program's stage gate review criteria did not include a mandatory post-implementation benefits audit.

Question 2

A government agency's IT governance board is defining how it will categorize the value expected from a new citizen-services portal. The board wants a classification that reflects both tangible and intangible returns so that trade-offs can be discussed consistently. Which categorization approach BEST supports this?

Accepted Answer

Classify benefits as either quantifiable or non-quantifiable, with quantified benefits expressed in monetary terms and non-quantifiable benefits described qualitatively.. A classification of quantifiable versus non-quantifiable benefits keeps both monetary returns and intangible outcomes visible and comparable, which is what the board needs to discuss trade-offs consistently. Expenditure, departmental, and technology-component taxonomies all describe cost, ownership, or solution structure rather than the nature of the value, and they obscure intangible benefits.

Answer

Classify benefits strictly by the department that requested the funding so that each unit can defend its own estimates.

Answer

Classify benefits by the technology component that enables them, such as portal, database, or integration layer.

Answer

Classify all benefits as either capital or operational expenditure to align with the agency's accounting treatment.

Question 3

When assessing the impact of a risk, what is the best perspective to take?

Accepted Answer

The effect on business objectives and value delivery.. Risk impact should be assessed from the perspective of the effect on business objectives and value delivery, because enterprise risk management exists to protect and enable value creation. Technical metrics such as hardware cost or restore time are inputs, but the governing question is how the risk affects the organization's ability to achieve its strategic and operational goals. This business-centric view ensures risk treatment is prioritized by materiality to the business.

Answer

The cost of the hardware that needs to be replaced.

Answer

The percentage of the IT budget consumed by the incident.

Answer

The number of hours required to restore the system.

Question 4

To optimize IT infrastructure resources, an organization adopts a software-defined infrastructure (SDI) approach. What is a key governance risk that must be addressed?

Accepted Answer

Complexity in maintaining consistent security and compliance policies across virtualized environments. Software-defined infrastructure abstracts compute, storage, and network resources from physical hardware, enabling programmatic provisioning and policy-driven management. The key governance risk is that this abstraction layer creates policy sprawl: security, compliance, and data-residency controls must be enforced consistently across dynamic, multi-tenant virtualized environments where workloads move and configurations change rapidly. Without governance guardrails, inconsistent policy enforcement becomes the dominant risk.

Answer

Inability to scale infrastructure resources rapidly

Answer

Increased dependency on proprietary hardware vendors

Answer

Decreased flexibility in managing application workloads

Question 5

An organization wants to improve its IT governance maturity. What is the most important first step?

Accepted Answer

Assessing the current state of governance maturity.. The most important first step in improving IT governance maturity is to assess the current state of governance maturity. This establishes a baseline, identifies gaps, and informs the development of a targeted improvement plan. Without this assessment, any subsequent actions—such as tool acquisition or framework implementation—lack direction and may not address the actual weaknesses. COBIT and other governance frameworks emphasize the need to understand the 'as-is' state before defining the 'to-be' state.

Answer

Buying an expensive IT governance tool.

Answer

Implementing all COBIT objectives at once.

Answer

Changing the IT leadership team.

Question 6

The enterprise is reviewing its IT governance structure. Which THREE of the following are primary responsibilities of the Board of Directors regarding IT governance?

Accepted Answer

Directing the strategic alignment of IT with business goals.. Option B is correct because the Board of Directors is responsible for directing the strategic alignment of IT with business goals, ensuring that IT initiatives support and enable the organization's overall strategy rather than operating in isolation. Option C is correct because overseeing the enterprise risk management framework falls under the Board's governance duties, including identifying, assessing, and mitigating IT-related risks that could impact the organization. Option E is correct because ensuring value delivery from IT investments is a core governance responsibility, where the Board confirms that IT expenditures generate expected business benefits and optimal returns. Options A and D are incorrect because defining technical server cluster configurations and managing daily helpdesk ticket queues are operational, hands-on tasks performed by IT staff, not strategic governance responsibilities of the Board of Directors.

Answer

Defining the technical configuration of server clusters.

Answer

Managing the daily IT helpdesk ticket queue.

Question 7

A multinational bank's board has set a low risk appetite for regulatory compliance failures. The CGEIT practitioner discovers that a critical IT system supporting anti-money laundering (AML) reporting is running on an unsupported operating system. The IT director argues that upgrading is too costly and proposes compensating controls. Which action should the practitioner recommend to the board?

Accepted Answer

Present a risk analysis to the board that quantifies the compliance exposure and evaluates options, including upgrade, compensating controls, and system replacement.. With a low risk appetite for compliance failures, the board must be presented with a thorough risk analysis that quantifies exposure and evaluates all viable options. This enables an informed decision that balances risk reduction with cost and operational considerations. The analysis should include the likelihood and impact of regulatory penalties, the effectiveness of compensating controls, and the feasibility of upgrade or replacement. This approach ensures the board exercises proper oversight and documents its rationale, which is crucial for regulatory accountability.

Answer

Accept the compensating controls because they reduce risk to an acceptable level.

Answer

Defer the decision to the next annual risk assessment cycle to gather more data.

Answer

Direct the IT director to upgrade the system immediately, regardless of cost.

Question 8

An IT investment shows a positive ROI, but the business units are not using the new system as intended. What is the most likely cause?

Accepted Answer

The benefits realization plan did not adequately address business change and adoption.. A positive ROI calculation only reflects projected or realized financial return, not whether the intended business outcomes were actually achieved. When business units fail to adopt a system as designed, the root cause is almost always that the benefits realization plan focused on delivering the technical solution rather than managing organizational change, training, and adoption incentives. Effective benefits realization requires explicit ownership of change management activities alongside the financial case.

Answer

The steering committee met too frequently.

Answer

The project lacked sufficient technical documentation.

Answer

The project was delivered under budget.

Question 9

An IT project is identified as having a high inherent risk that exceeds the board-approved appetite. The project is critical for competitive advantage. Which approach is most appropriate?

Accepted Answer

Present a business case to the board for formal risk acceptance with compensatory controls.. When a project's inherent risk exceeds board-approved appetite but the project is critical for competitive advantage, the appropriate governance action is to present a business case to the board for formal risk acceptance with compensatory controls. The board owns risk appetite and can authorize an exception with mitigating measures, preserving both strategic value and governance accountability.

Answer

Implement excessive controls regardless of project cost.

Answer

Direct the IT team to lower the risk by reducing project scope.

Answer

Cancel the project immediately to maintain compliance.

Question 10

An enterprise has completed a major IT-enabled transformation. Twelve months later, the benefits owner finds that some projected benefits were achieved, some were partially achieved, and some were not achieved at all. The board wants to understand why and to improve future benefits realization. Which action BEST addresses this governance need?

Accepted Answer

Conduct a benefits realization post-implementation review that compares actual outcomes to the business case and identifies root causes of variance.. A benefits realization post-implementation review is the governance mechanism that compares actual outcomes to the business case, explains variances, and extracts lessons for future investments. It answers the board's question about causes and provides input to improve the benefits realization framework, unlike technical audits, architecture updates, or administrative closure.

Answer

Commission a technical audit of the solution to confirm it was built to specification.

Answer

Close the program formally and reassign the remaining budget to other initiatives.

Answer

Update the enterprise architecture repository to reflect the new solution components.

Question 11

An enterprise is aligning its IT risk appetite with corporate strategic objectives. Which action should the CGEIT-certified practitioner prioritize first?

Accepted Answer

Define the enterprise risk capacity based on strategic objectives.. Aligning IT risk appetite with corporate strategic objectives begins with defining the enterprise risk capacity—the maximum amount of risk the organization can bear—based on its strategic objectives, financial strength, and regulatory constraints. This sets the boundary within which risk appetite is defined. Only after capacity is understood can the practitioner define risk appetite, tolerance levels, and then proceed to risk identification, assessment, and treatment. Therefore, defining enterprise risk capacity is the first priority.

Answer

Draft the IT risk register for department heads.

Answer

Conduct a technical vulnerability scan of all production servers.

Answer

Implement an automated GRC risk dashboard.

Question 12

Which TWO items are considered 'Governance enablers' in COBIT?

Accepted Answer

Organizational structures. In COBIT, governance enablers are the factors that influence how governance and management objectives are achieved, and they are grouped into categories such as principles/policies/frameworks, processes, organizational structures, culture/ethics/behavior, information, services/infrastructure/applications, people/skills/competencies, and so on. Option D, organizational structures, is correct because COBIT explicitly identifies organizational structures as a governance enabler category, defining where decision rights and accountability for governance activities reside. Option E, processes, is correct because processes are another recognized COBIT enabler category, describing the organized sets of practices and activities that achieve governance and management objectives. Options A, B, and C are incorrect because personal employee cars, office air conditioning, and breakroom snacks are physical workplace amenities, not COBIT governance enabler categories.

Answer

Personal employee cars

Answer

Office air conditioning

Answer

Breakroom snacks

Question 13

An enterprise's board is concerned that IT projects routinely exceed budgets while business units report that critical initiatives wait months for skilled staff. A review finds that resource demand is approved project by project with no enterprise view of supply. Which governance improvement BEST addresses this?

Accepted Answer

Introduce an enterprise IT resource capacity plan that forecasts supply and demand and is used to prioritize and sequence investments.. The root issue is the absence of an enterprise view of resource supply against demand. A governed capacity plan forecasts skills and budget, then informs prioritization and sequencing so commitments match reality. Contingency padding, decentralized approval or threshold-based outsourcing all treat symptoms and leave the structural mismatch between approved demand and available supply unmanaged.

Answer

Delegate project approval fully to business units so decisions happen closer to demand.

Answer

Require each project to include a larger budget contingency to absorb overruns.

Answer

Outsource all projects that have waited more than three months for internal staff.

Question 14

Which THREE components are critical for an IT governance system to be effective?

Accepted Answer

Defined processes. An effective IT governance system requires defined processes (A) because repeatable, documented procedures for decision-making, risk management, and resource allocation ensure consistency and accountability across the organization. Organizational structures (D) are also critical, as they establish clear roles, responsibilities, and decision rights (e.g., steering committees, CIO, board oversight) that determine who makes and enforces IT decisions. Information flows (E) are essential because governance depends on timely, accurate reporting and communication of performance metrics, risks, and compliance data to the right stakeholders. Options B and C are incorrect because unlimited breakroom coffee and the latest gaming console are workplace perks or entertainment items, not components of an IT governance framework.

Answer

Unlimited breakroom coffee

Answer

The latest gaming console

Question 15

Your organization is undergoing a major digital transformation. To ensure risk is optimized throughout the lifecycle, what is the most critical governance activity during the planning phase?

Accepted Answer

Defining explicit risk-based criteria for project prioritization in the business case.. During the planning phase of a digital transformation, the most critical governance activity is defining explicit risk-based criteria for project prioritization in the business case. This ensures that risk is optimized from the outset by aligning investment decisions with the organization's risk appetite and strategic objectives. It embeds risk consideration into the decision-making process before any technical work begins.

Answer

Ensuring the technical architecture is fully documented.

Answer

Setting up an automated monitoring tool for the new cloud environment.

Answer

Hiring a third-party consultant to conduct a penetration test on the future system.