CGEIT Practice Test 24 — 15 Questions

Question 1

An enterprise has completed a customer relationship management implementation. Twelve months later, the sales director reports that win rates have improved, but the original business case targeted a reduction in customer churn. Which action should the benefits realization manager take FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compare actual churn against the baseline and target, and investigate why the forecasted benefit was not realized.. The disciplined first step is to measure the committed benefit, churn reduction, against its baseline and target, then analyze the variance. Recording the unplanned win-rate improvement is useful, but it cannot substitute for evaluating the forecast benefit or justify re-baselining before the governance body reviews the evidence.

Answer

Immediately re-baseline the business case to show win rate as the primary benefit.

Answer

Escalate to the audit committee because the project failed to deliver its approved benefits.

Answer

Close the benefits register because a positive outcome was achieved even if it differs from the forecast.

Question 2

A business case includes a 'Sensitivity Analysis'. What is the purpose of this analysis in benefits realization?

Accepted Answer

To determine how changes in key assumptions affect the projected return on investment.. Sensitivity analysis in a business case tests how the projected ROI or NPV changes when key assumptions (e.g., adoption rate, cost of capital, benefit timing) are varied. Its purpose is to reveal which assumptions the business case is most sensitive to, so decision-makers understand the range of possible outcomes. This directly supports benefits realization by exposing the drivers that must be monitored and managed.

Answer

To test the security of the application against breaches.

Answer

To identify which stakeholders are sensitive to change.

Answer

To measure the speed of the software.

Question 3

A hospital group's IT governance committee wants to ensure that clinical staff have a formal voice in prioritizing electronic health record (EHR) enhancements. Which governance structure is MOST appropriate?

Accepted Answer

Establish a clinical informatics advisory council that includes physicians, nurses, and IT representatives to review and prioritize EHR change requests.. A clinical informatics advisory council provides the formal, cross-functional structure needed to incorporate clinical perspectives into EHR prioritization. It connects clinicians and IT in a documented review process, giving the governance committee reliable input on patient-care value while preserving clear accountability for final decisions at the governance level.

Answer

Create an anonymous suggestion box for clinical staff and have the IT help desk triage submissions.

Answer

Allow the IT department to prioritize EHR enhancements based on technical effort and system stability.

Answer

Delegate all EHR prioritization to the hospital's finance committee to ensure budget alignment.

Question 4

An insurance company's IT portfolio contains three initiatives: a regulatory compliance upgrade, a customer portal refresh, and an analytics platform. During a benefits review, the committee finds that the analytics platform is consuming 40% of the portfolio budget but its benefits depend on data quality improvements owned by a separate program that has been descoped. Which governance response is MOST appropriate?

Accepted Answer

Reassess the analytics platform's business case in light of the broken dependency and decide whether to re-scope, re-sequence, or stop it.. A broken dependency changes the analytics platform's benefit case, so the committee must reassess it and decide whether to re-scope, re-sequence, or stop it. This targeted response protects portfolio value without disrupting the compliance and portal initiatives whose benefits remain intact and independently achievable.

Answer

Suspend all three initiatives until the portfolio is rebalanced against strategic goals.

Answer

Continue funding the analytics platform and record the dependent benefits as deferred until data quality improves.

Answer

Transfer ownership of the data quality improvements to the analytics platform team so the benefits remain achievable.

Question 5

An insurance company's IT steering committee is reviewing a proposed core system replacement. The business case shows strong financial returns, but the chief risk officer notes that the benefits depend on retiring three legacy systems within 18 months, and no decommissioning funding has been approved. Which governance response is MOST appropriate?

Accepted Answer

Condition approval on including the legacy decommissioning work and its funding within the investment scope and benefits baseline.. Benefits in a business case are only credible when their enabling dependencies are in scope, funded, and owned. The decommissioning of legacy systems is a prerequisite for the projected savings, so the committee should make approval conditional on incorporating that work and its funding into the investment and baseline. Ignoring, rejecting, or merely discounting the dependency all fail to make the benefit achievable.

Answer

Approve the investment but reduce the projected benefits by the value of the legacy systems to reflect the uncertainty.

Answer

Reject the investment outright because benefit dependencies were not fully funded in the original proposal.

Answer

Approve the investment because the financial returns are strong and decommissioning can be handled as a separate future initiative.

Question 6

An insurance company's CIO has asked the governance committee to approve early termination of a multi-year core platform replacement. The platform has consumed 60 percent of its budget but delivered only the policy administration module, and the remaining scope is projected to exceed the approved funding envelope. Which consideration should MOST influence the committee's decision?

Accepted Answer

Whether the remaining scope can still deliver benefits that justify the additional funding required.. Benefits realization governance requires decisions based on future costs and future benefits, not on what has already been spent. The committee should test whether the incremental investment needed to finish still produces benefits that exceed that investment. If not, redirecting the remaining capital to stronger alternatives creates more enterprise value than continuing.

Answer

The amount of budget already consumed, because terminating now would waste the 60 percent already invested.

Answer

The reputational impact on the CIO and the delivery team if the program is cancelled publicly.

Answer

Whether the vendor contract includes penalties for early termination of the remaining phases.

Question 7

Which TWO of the following are examples of 'Avoidance' as a risk response?

Accepted Answer

Deciding not to enter a new market with high regulatory risk.. Option B is correct because avoidance means eliminating the risk entirely by not engaging in the activity that creates it — deciding not to enter a high-regulatory-risk market removes the exposure rather than mitigating or transferring it. Option E is correct for the same reason: canceling a project with excessive security risks removes the risk source altogether, which is the defining characteristic of the Avoid response. Option A is incorrect because buying insurance is a Transfer response, shifting the financial impact to a third party while the risk remains. Option C is incorrect because creating a database backup is a Mitigation (risk reduction) action that lessens impact but does not eliminate the threat. Option D is incorrect because installing antivirus software is also Mitigation, reducing the likelihood or impact of malware rather than avoiding the risk.

Answer

Buying insurance for a data center.

Answer

Creating a backup of the database.

Answer

Installing an antivirus program.

Question 8

An enterprise is preparing a benefits-based review of a proposed IT investment before the board approves funding. The benefits owner must ensure the review is rigorous and defensible. Which TWO actions are MOST critical for this review? (Choose two.)

Accepted Answer

Validate that each claimed benefit is linked to a specific strategic objective with an accountable business owner.. A rigorous benefits-based business case review tests two things above all: that each claimed benefit is linked to a strategic objective with an accountable owner, and that each benefit has a defined metric, baseline, target, and timeframe. Together these convert aspirational claims into measurable, owned commitments that governance can monitor after approval.

Answer

Ensure the project schedule includes all technical milestones and dependencies.

Answer

Confirm that the vendor's reference customers have achieved similar results.

Answer

Confirm the technical architecture aligns with the enterprise architecture standards.

Question 9

A multinational corporation is standardizing its IT resource governance across 30 countries. The CIO must ensure that resource allocation decisions are aligned with enterprise strategy while respecting local regulatory requirements. Which TWO of the following are the MOST effective governance mechanisms to achieve this balance? (Choose two.)

Accepted Answer

Establish a global IT investment committee with delegated authority to approve resource allocations above a defined threshold.. A global investment committee with delegated authority ensures strategic alignment for major allocations, while a global policy with a formal exception process for regulatory needs provides consistency with necessary local flexibility. Together they balance enterprise strategy and local compliance. The other mechanisms are either too rigid, too decentralized, or overcentralized to achieve that balance effectively.

Answer

Delegate all resource allocation decisions to local country managers and rely on annual audits to ensure alignment.

Answer

Require each country to submit an annual IT budget for central approval without any local discretion.

Answer

Create a centralized project management office that controls all IT projects globally, including local regulatory projects.

Question 10

A multinational retailer's governance committee is reviewing an IT initiative that will replace in-store point-of-sale terminals with cloud-connected tablets. The business case claims 'improved customer experience' as the primary benefit, but the committee cannot determine whether this benefit actually materialized after go-live. Which action should the committee take FIRST to address this governance gap?

Accepted Answer

Require the sponsor to define specific, measurable customer-experience benefit metrics and baselines before further funding is released.. The benefit was stated as an aspiration rather than a measurable outcome, so no one can later prove or disprove realization. Governance requires the sponsor to convert the claim into specific metrics with baselines and targets before committing further funds. That restores the causal link between the investment, the expected outcome, and the evidence that will be used to confirm it.

Answer

Instruct internal audit to conduct a full review of the vendor's contract and service-level agreements.

Answer

Escalate the initiative to the enterprise risk committee for reassessment of technology risk exposure.

Answer

Request that the project manager produce a post-implementation review comparing actual sales per store against the pre-launch baseline.

Question 11

Which THREE of the following represent effective ways to monitor IT governance compliance?

Accepted Answer

Reviewing IT governance performance dashboards. Option A is correct because IT governance performance dashboards present key governance metrics and KPIs (e.g., control effectiveness, risk exposure, audit findings) in a consolidated view, enabling continuous oversight of whether governance objectives and policies are being met. Option C is correct because regular internal audits systematically test and verify that governance controls are designed and operating effectively, providing independent assurance and identifying gaps against frameworks such as COBIT or ISO/IEC 38500. Option D is correct because providing the board with regular policy-compliance reports establishes formal accountability and escalation to top management, which is essential for monitoring governance compliance at the highest level. Option B is not a governance monitoring method—Wi-Fi throughput is an operational network performance metric unrelated to governance controls. Option E is not effective because informal, ad hoc staff reporting lacks structure, objectivity, and traceability, and cannot substitute for formal audit and reporting mechanisms.

Answer

Monitoring the speed of the office Wi-Fi

Answer

Asking staff to informally report any issues

Question 12

A multinational enterprise's IT steering committee must decide how to govern the growing use of open source software components across development teams. Security incidents traced to unmaintained libraries have increased, yet developers argue that approval gates slow delivery. Which governance action BEST balances resource optimization with risk?

Accepted Answer

Establish a curated internal artifact repository with automated vulnerability scanning and approved component versions.. A curated internal repository with automated scanning gives developers fast, self-service access to vetted components while embedding preventive governance. It directly reduces incidents from unmaintained libraries, preserves delivery speed and produces auditable evidence. The other choices either create bottlenecks, ban a valuable resource outright or abandon preventive control, none of which balances resource optimization with risk.

Answer

Prohibit all open source usage until a new enterprise architecture standard is ratified.

Answer

Delegate full open source decisions to each development team and rely on post-incident reviews for accountability.

Answer

Mandate that every open source component be reviewed by the legal department before use in any project.

Question 13

An insurance company is preparing a post-implementation benefits review for a claims automation program. The program sponsor wants the review to produce credible conclusions about whether promised benefits were achieved. Which TWO actions should the reviewer perform to strengthen the credibility of the review? (Choose two.)

Accepted Answer

Compare actual results against the baselines and targets recorded in the approved benefits realization plan.. Credibility in a benefits review comes from measuring actual results against pre-agreed baselines and targets, and from independent validation of the data and method. Together these prevent hindsight bias and self-reported optimism. Rebuilding the business case, surveying the delivery team, or extending the measurement window all substitute convenient evidence for objective evidence and would weaken the review's conclusions.

Answer

Survey the program team to confirm that the automation features were delivered as specified in the requirements.

Answer

Recalculate the original business case using current assumptions to show the program would still be approved today.

Answer

Extend the review period until the reported benefits match the original targets in the business case.

Question 14

A company is shifting from a project-based to a value-based management model. Which of the following best describes an 'outcome' versus an 'output'?

Accepted Answer

An output is the automated reporting tool; an outcome is the reduction in manual data entry time.. In value-based management, an output is a tangible deliverable produced by a project or process, while an outcome is the measurable business result or change that the output enables. The automated reporting tool is the output; the reduction in manual data entry time is the outcome it produces. This distinction is central to shifting from delivering features to delivering value.

Answer

An output is a strategic goal; an outcome is a project milestone.

Answer

An output is the increased sales revenue; an outcome is the new CRM software.

Answer

An output and an outcome are essentially the same and can be used interchangeably.

Question 15

An organization is integrating IT risk management into its enterprise governance framework. Which approach best ensures that IT risk is treated as a component of enterprise risk?

Accepted Answer

Establishing a common risk taxonomy shared between the IT risk and Enterprise Risk Management (ERM) functions.. A common risk taxonomy shared between IT risk and ERM functions is the mechanism that lets IT risk be expressed, aggregated, and reported in the same language as enterprise risk. This enables the board and ERM to see IT risk as a subset of enterprise risk rather than a separate technical silo. COBIT's EDM03 (Ensure Risk Optimization) and APO12 (Manage Risk) explicitly call for integration with enterprise risk management.

Answer

Implementing a standalone IT risk registry managed only by the CISO.

Answer

Focusing exclusively on technical vulnerabilities in the IT asset inventory.

Answer

Delegating all IT risk assessments to the IT infrastructure team.