CGEIT Practice Test 5 — 25 Questions

Question 1

Why is it important to define risk appetite before developing a risk response plan?

Accepted Answer

To provide a threshold for determining which risks require action.. Appetite acts as the boundary for decision-making.

Answer

To simplify the budget process for IT.

Answer

To automatically approve all low-impact risks.

Answer

Because the government requires it by law.

Question 2

The board of directors is concerned about the impact of recent cybersecurity threats on the company's reputation. Which TWO of the following actions should the Governance committee prioritize to address these concerns?

Accepted Answer

Reviewing the alignment of the current risk appetite with the brand resilience strategy.. Aligning risk reporting with board interests and ensuring management accountability are key responsibilities of the governance committee.

Answer

Directing the CISO to provide a summary of all blocked network packets.

Answer

Requiring the IT department to upgrade all legacy hardware immediately.

Answer

Changing the password rotation policy for all employees.

Question 3

An organization adopts a new IT governance policy. Which mechanism best ensures that employees understand and follow the policy?

Accepted Answer

Establishing a formal communication and training plan regarding the policy. Policy adherence is best fostered through communication, training, and integration into performance expectations.

Answer

Including the policy in the organization's long-term strategic plan

Answer

Threatening immediate termination for any policy deviation

Answer

Encrypting the policy document on the corporate intranet

Question 4

Which of the following is an example of an 'IT governance structure'?

Accepted Answer

An IT steering committee. An IT steering committee is a formal body specifically created to handle governance tasks like prioritization and alignment.

Answer

A daily backup job schedule

Answer

A database management system (DBMS) upgrade project

Answer

A list of helpdesk tickets for the week

Question 5

To effectively integrate risk management into enterprise governance, which THREE activities should be conducted?

Accepted Answer

Defining the enterprise risk appetite in quantitative or qualitative terms.. Governance of IT risk requires strategic alignment, clear communication, and defined accountability structures.

Answer

Standardizing the IT configuration management database (CMDB) structure.

Answer

Outsourcing the primary data center to a tier-one cloud provider.

Question 6

A company is planning a digital transformation. What governance action is necessary to ensure the transformation supports business strategy?

Accepted Answer

Establish a governance structure that includes business unit leaders in transformation decision-making. Linking the digital transformation initiative to clear, measurable business objectives is essential for governance.

Answer

Outsource the entire transformation to an external systems integrator

Answer

Focus primarily on reducing IT costs to fund the project

Answer

Select the latest cloud-based ERP software before defining business requirements

Question 7

Which TWO of the following are key indicators that an organization's IT resource allocation is ineffective?

Accepted Answer

Frequent misalignment between IT projects and business strategic objectives. Ineffective allocation leads to missed business goals and a high volume of 'keep-the-lights-on' work, leaving little room for innovation.

Answer

Low turnover rate among IT staff

Answer

Use of automated project management software

Answer

High adoption of standard, approved hardware platforms

Question 8

Which stakeholder is ultimately accountable for the governance of IT in an enterprise?

Accepted Answer

The Board of Directors. The Board of Directors and senior executive management are ultimately accountable for the enterprise and its governance, including IT.

Answer

The IT Steering Committee

Answer

The Internal Audit department

Answer

The Chief Information Officer (CIO)

Question 9

When a risk event occurs, what is the first step in the incident response process from a governance perspective?

Accepted Answer

Contain the threat to prevent further business impact.. The first step is to contain the issue and notify the appropriate parties.

Answer

Draft a press release.

Answer

Identify the person responsible for the incident.

Answer

Perform a root cause analysis.

Question 10

An organization is updating its IT governance policies. Which element must be included to ensure policy enforcement?

Accepted Answer

Defined roles, responsibilities, and accountability mechanisms. Policies must define roles, responsibilities, and clear consequences or procedures for compliance to be enforceable.

Answer

A copy of the IT department's budget spreadsheet

Answer

A detailed technical configuration guide for all servers

Answer

A list of all software vendor names used by the company

Question 11

Which TWO of the following are governance-related challenges when allocating resources for emerging technologies?

Accepted Answer

Lack of defined governance frameworks for the new technology. Emerging technologies often lack established governance models and possess significant skill gaps, making them difficult to manage.

Answer

The technology is too cheap to purchase

Answer

The technology is widely available in the market

Answer

It is always compatible with existing infrastructure

Question 12

An enterprise is evaluating the trade-off between the cost of risk mitigation and the potential business benefit. Which framework or approach should the practitioner use?

Accepted Answer

Return on Security Investment (ROSI).. Cost-benefit analysis in risk management is fundamental to risk optimization.

Answer

Total Cost of Ownership (TCO) analysis.

Answer

Key Risk Indicator (KRI) dashboarding.

Answer

Business Impact Analysis (BIA).

Question 13

Which TWO of the following are primary components of IT resource management?

Accepted Answer

Infrastructure resource management. IT resource management fundamentally involves both the human (workforce) and the technical (infrastructure) assets of the organization.

Answer

Office facility maintenance

Answer

Customer relationship marketing

Answer

Public relations strategy

Question 14

Which TWO of the following are effective strategies for optimizing workforce resources?

Accepted Answer

Using a flexible resource model for non-core, variable IT activities. Cross-training and flexible resource pools (like contractors for non-core work) are effective strategies for workforce optimization.

Answer

Reducing the frequency of staff performance reviews

Answer

Requiring all staff to work in the office five days a week

Answer

Increasing the number of layers in the management hierarchy

Question 15

During an IT governance board meeting, the CGEIT practitioner notices that the current risk profile deviates significantly from the approved risk appetite. What is the most appropriate next step?

Accepted Answer

Formally report the variance to the board and propose a remediation plan.. Governance requires transparency and corrective action when thresholds are exceeded.

Answer

Update the enterprise risk management policy to include the new risks.

Answer

Instruct the IT department to stop all new projects until the risk is lowered.

Answer

Adjust the risk appetite levels to match the current risk profile.

Question 16

Which THREE of the following are elements of a strong IT resource governance policy?

Accepted Answer

Defined KPIs and metrics to measure the effectiveness of resource usage. Clear definitions of roles, standard processes for allocation, and defined metrics for success are essential for a governance policy.

Answer

A list of all individual employee salaries

Answer

A list of all vendor passwords

Question 17

An IT project is identified as having a high inherent risk that exceeds the board-approved appetite. The project is critical for competitive advantage. Which approach is most appropriate?

Accepted Answer

Present a business case to the board for formal risk acceptance with compensatory controls.. Governance allows for risk acceptance at the appropriate level if the business value is high.

Answer

Implement excessive controls regardless of project cost.

Answer

Direct the IT team to lower the risk by reducing project scope.

Answer

Cancel the project immediately to maintain compliance.

Question 18

An IT project is failing to deliver promised business value. What is the most likely governance failure?

Accepted Answer

Inadequate alignment between IT risk management and business value objectives.. Value delivery is directly linked to effective risk and performance management.

Answer

The IT team was not using the latest programming language.

Answer

The IT budget was slightly over the projected amount.

Answer

The project manager lacked a certification.

Question 19

Which TWO of the following are primary objectives of IT risk governance?

Accepted Answer

Ensuring risk management processes deliver value.. Governance focuses on ensuring risk management aligns with strategy and business value.

Answer

Fixing broken computer keyboards.

Answer

Increasing the IT budget by 20% annually.

Answer

Writing code for the software developers.

Question 20

You are auditing the integration of IT risk management. Which finding indicates a failure in the governance of enterprise risk?

Accepted Answer

IT risk assessments are performed independently of business impact analysis (BIA).. If risk management activities are not linked to the strategic business objectives, the organization lacks effective governance over IT risk.

Answer

The IT risk register is reviewed quarterly by the IT steering committee.

Answer

The CISO reports to the CIO instead of the CEO.

Answer

The risk management policy was updated 18 months ago.