CGEIT Practice Test 23 — 15 Questions

Question 1

A utility company's CIO must recommend how to govern benefits realization across a portfolio of 40 IT initiatives with a combined budget of $90M. Initiatives range from regulatory compliance to customer experience. The board wants assurance that value is being delivered, not just that projects are completed. Which governance approach BEST provides this assurance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establish portfolio-level benefit categories with standardized measures, and require periodic benefit status reporting with escalation for variances.. Portfolio-level value assurance requires common benefit categories and measures, clear ownership, and regular reporting with escalation when results deviate. This lets the board compare and challenge outcomes across heterogeneous initiatives. Certification of deliverables, program consolidation, or PMO-delegated spend reporting all emphasize activity and cost rather than realized value, leaving the board unable to confirm that the $90M produced intended benefits.

Answer

Delegate benefits tracking to the project management office and report only aggregate spend versus budget to the board.

Answer

Consolidate all initiatives into a single strategic program with one executive sponsor and one integrated benefits register.

Answer

Require each initiative manager to certify completion of all deliverables at project closure and report closure status monthly.

Question 2

A newly appointed CIO at a global manufacturing firm discovers that each of the five regional business units independently contracts its own cloud infrastructure, leading to duplicated data egress charges and inconsistent security controls. The CIO wants to establish a governance mechanism that optimizes these IT resources without halting regional agility. Which action should the CIO take FIRST?

Accepted Answer

Mandate a centralized cloud center of excellence that defines approved service catalogs and enforces procurement through a single enterprise agreement.. A cloud center of excellence is the appropriate first governance action because it creates approved service catalogs, standardized controls, and consolidated procurement while preserving regional autonomy. It directly targets duplicated costs and inconsistent security. The other actions either overcorrect by removing agility, provide only retrospective visibility, or shift authority without establishing enterprise standards.

Answer

Immediately terminate all regional cloud contracts and migrate every workload to a single corporate data center.

Answer

Ask each regional CIO to submit a monthly report of cloud spending for review by the audit committee.

Answer

Delegate full cloud procurement authority to the largest business unit to leverage its volume discounts.

Question 3

An organization is transitioning to a cloud-based infrastructure. Which governance mechanism is most effective for ensuring that the cloud service provider's risk management practices remain aligned with the enterprise's risk appetite?

Accepted Answer

Embedding ongoing risk assessment requirements into the service provider contract.. Embedding ongoing risk assessment requirements directly into the service provider contract creates a binding, enforceable governance mechanism that requires the CSP to continuously demonstrate alignment with the enterprise's risk appetite—not just once a year. Contracts are the primary governance lever in outsourced/cloud relationships because they translate risk appetite into measurable obligations, audit rights, and remediation timelines. This ensures alignment persists as the provider's environment, subprocessors, and threat landscape change.

Answer

Performing an annual penetration test on the provider's infrastructure.

Answer

Mandating a SOC 2 Type II report review on an annual basis.

Answer

Establishing clear service level agreements (SLAs) with penalty clauses for downtime.

Question 4

Which TWO activities are part of the post-implementation benefits review?

Accepted Answer

Evaluating actual benefits against the business case.. Option C is correct because the post-implementation benefits review compares the benefits actually realized after go-live against the benefits forecast in the original business case, using the agreed metrics and baselines to determine whether the expected value was delivered. Option D is correct because the review also captures lessons learned about how benefits were estimated, tracked, and realized, so that future benefits planning and business cases are more accurate. Options A, B, and E are not part of this review: changing the project manager's job description is an HR/role matter, re-installing the software is a technical deployment task rather than a benefits evaluation, and deleting project documentation would destroy the evidence needed for the review and for lessons learned.

Answer

Changing the project manager's job description.

Answer

Re-installing the software.

Answer

Deleting the project documentation.

Question 5

During a strategic alignment review, the governance committee identifies that IT investments are not delivering expected value. What is the most effective first step for the committee?

Accepted Answer

Conduct a portfolio review to map current IT investments to strategic business objectives. When IT investments are not delivering expected value, the governance committee's most effective first step is to conduct a portfolio review that maps current investments to strategic business objectives. This diagnostic step reveals which investments are misaligned, duplicative, or underperforming, providing the evidence needed for subsequent decisions such as reallocation, cancellation, or remediation.

Answer

Cancel all current IT projects and restart with new priorities

Answer

Outsource the IT portfolio management function to a third-party consultant

Answer

Reduce the IT budget by 20% to increase efficiency metrics

Question 6

In the context of benefits realization, what is a 'leading indicator'?

Accepted Answer

The adoption rate of a new system during the pilot phase.. A leading indicator is a forward-looking metric that predicts future outcomes and allows early corrective action. The adoption rate of a new system during the pilot phase is a leading indicator because it signals whether the system will ultimately deliver its intended benefits — low pilot adoption predicts poor full-scale realization.

Answer

The final revenue growth reported at year-end.

Answer

The number of users who attended training sessions.

Answer

The total cost of the project.

Question 7

An IT manager is conducting workforce planning for an upcoming digital transformation. Which approach is most effective for identifying skill gaps?

Accepted Answer

Conducting a gap analysis comparing current IT staff competencies against future state requirements. A gap analysis comparing current staff competencies against future-state requirements directly identifies the specific skills missing for the digital transformation. This structured comparison links workforce capability to strategic needs, making it the most effective approach for skill-gap identification.

Answer

Surveying staff on their preferred technologies for professional development

Answer

Reviewing employee performance appraisals from the previous two years

Answer

Increasing the budget for external recruitment to bring in new talent

Question 8

You are auditing the integration of IT risk management. Which finding indicates a failure in the governance of enterprise risk?

Accepted Answer

IT risk assessments are performed independently of business impact analysis (BIA).. Performing IT risk assessments independently of the business impact analysis (BIA) is a governance failure because it disconnects technical risk from business consequence, which is the essence of enterprise risk integration. A properly governed process uses the BIA to determine which systems and processes are critical, then prioritizes IT risk treatment accordingly. Without that linkage, risk ratings become arbitrary and cannot inform strategic decisions.

Answer

The IT risk register is reviewed quarterly by the IT steering committee.

Answer

The CISO reports to the CIO instead of the CEO.

Answer

The risk management policy was updated 18 months ago.

Question 9

A financial services firm is implementing an enterprise risk management (ERM) framework. The CGEIT practitioner is asked to ensure that IT risk is integrated with overall ERM. Which of the following is the MOST important action to achieve this integration?

Accepted Answer

Ensure IT risk is assessed using the same risk taxonomy and scoring methodology as other enterprise risks.. Integrating IT risk with ERM requires a common risk taxonomy and scoring methodology so that IT risks can be compared, aggregated, and prioritized alongside other enterprise risks. This shared approach enables consistent reporting and informed decision-making at the board level, breaking down silos between IT and business risk management.

Answer

Purchase cyber insurance to transfer IT risks, thereby aligning with enterprise risk transfer strategies.

Answer

Assign the CIO as the sole owner of all IT risks to ensure clear accountability.

Answer

Conduct an annual IT risk assessment separate from the enterprise risk assessment to maintain focus.

Question 10

Which TWO of the following are essential components of an effective IT governance framework?

Accepted Answer

Organizational structures. An effective IT governance framework is fundamentally built on organizational structures (Option A), which define the roles, responsibilities, and reporting relationships—such as steering committees, CIO functions, and board oversight—that establish who has authority over IT decisions. Equally essential are processes for decision-making and accountability (Option B), which specify how IT investment, risk, and resource decisions are made, who is accountable for outcomes, and how performance is monitored and enforced. Together, these two components align IT strategy with business objectives and ensure transparency and control, as reflected in frameworks like COBIT and ISO/IEC 38500. Option C is incorrect because a hardware serial-number inventory is an asset-management detail, not a governance mechanism. Option D is incorrect because a daily operational budget is a tactical financial artifact, not a governance component. Option E is incorrect because detailed programming language standards are technical development conventions, not part of governance structure or decision-making processes.

Answer

A list of all IT hardware serial numbers

Answer

The daily IT operational budget

Answer

Detailed programming language standards

Question 11

A financial services enterprise runs its core transaction processing on a mainframe that is now five years old. The CIO proposes migrating to a distributed x86 platform to reduce hardware maintenance costs by 30%. The IT governance committee is asked to approve the business case. Before making a decision, which action should the committee require FIRST to ensure effective governance of IT resources?

Accepted Answer

A risk assessment that evaluates the impact of the platform change on business service continuity and regulatory compliance obligations. The governance committee must evaluate any material change to foundational IT resources against risk appetite and business objectives before committing. A risk assessment covering business service continuity and regulatory compliance directly supports that fiduciary responsibility. Cost comparisons, peer benchmarks, and technical pilots are all useful inputs but are subordinate to understanding whether the resource change exposes the enterprise to unacceptable risk.

Answer

A pilot project that migrates one non-critical transaction workload to the x86 platform to validate performance claims

Answer

A benchmark of the proposed x86 platform against peer institutions that have already completed similar migrations

Answer

A detailed total cost of ownership comparison covering a five-year horizon, including licensing, migration labor, and retraining costs

Question 12

Which THREE of the following should be considered when assessing the resource requirements for a new IT project?

Accepted Answer

Necessary computing and storage infrastructure capacity. Option C is correct because resource planning must account for the computing and storage infrastructure capacity the project will consume, such as CPU, RAM, disk, and network throughput, so that hardware or cloud resources can be provisioned adequately. Option D is correct because the required technical skills and available expertise determine whether the team can deliver the project or whether training, hiring, or contractors are needed. Option E is correct because resource requirements extend beyond go-live; ongoing operational and maintenance needs such as support staff, monitoring, patching, backups, and licensing must be budgeted for the system's lifecycle. Options A and B are not valid because a project manager's lunch preferences and team members' personal hobbies are irrelevant to estimating the infrastructure, skills, and operational resources a project requires.

Answer

The preferred lunch break times of the project manager

Answer

The personal hobbies of the project team members

Question 13

Which of the following is a key component of an effective IT risk management policy?

Accepted Answer

Roles and responsibilities for risk ownership.. An effective IT risk management policy must define who owns which risks so that accountability is unambiguous across the enterprise. Assigning roles and responsibilities for risk ownership ensures each identified risk has a named accountable party who monitors, treats, and reports on it, which is the foundational governance element of the policy. Without clear ownership, risk treatment decisions stall and no one is answerable to executive management or the board.

Answer

The specific model of routers used in the network.

Answer

The salary structure for IT staff.

Answer

A detailed list of all system passwords.

Question 14

How should IT governance ensure that IT-related risks are identified and managed?

Accepted Answer

By incorporating risk management into the enterprise's IT governance policy.. IT governance ensures risk identification and management by embedding risk management into the enterprise's IT governance policy, making it a systematic and repeatable part of decision-making. This integrates risk appetite, assessment, and treatment into the governance framework rather than treating risk as an ad hoc activity. It aligns with COBIT's EDM03 (Ensured Risk Optimization) and ISO/IEC 38500 principles.

Answer

By eliminating IT risk entirely.

Answer

By outsourcing all IT operations to a third party.

Answer

By performing all risk assessments at the board level.

Question 15

In the context of benefits realization, what does the term 'disbenefit' mean?

Accepted Answer

A negative consequence of the IT investment.. In benefits realization, a 'disbenefit' is a negative consequence or outcome of an IT investment — an unintended harm or cost that reduces overall value. It is the opposite of a benefit and must be identified and managed alongside positive benefits to assess the true net value of an investment.

Answer

A cost that was not included in the original budget.

Answer

A benefit that was planned but not achieved.

Answer

The depreciation of hardware assets over time.