CGEIT Practice Test 5 — 25 Questions

Question 1

The board of a multinational bank has approved a risk appetite statement that explicitly prohibits any single operational risk event exceeding $5 million. The CIO proposes migrating the core banking platform to a public cloud provider, which would introduce a concentration risk that could potentially cause a $12 million outage. The CIO argues that the cloud provider's certifications and service-level agreements mitigate the risk. As the CGEIT practitioner, what should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require a formal risk assessment to quantify the potential impact and identify controls that could reduce it to within the approved appetite before proceeding.. The board-approved risk appetite sets a hard limit on acceptable loss. Before approving any initiative that appears to exceed that limit, the CGEIT practitioner must ensure a formal risk assessment quantifies the potential impact and identifies controls that can reduce residual risk to within appetite. This preserves governance integrity and enables informed decision-making.

Answer

Approve the migration because the provider's certifications and SLAs effectively transfer the risk.

Answer

Reject the migration outright because any concentration risk is unacceptable under the risk appetite.

Answer

Recommend that the board revisit the risk appetite statement to accommodate the strategic benefits of cloud migration.

Question 2

A retail enterprise's IT steering committee is reviewing how application portfolio resources should be governed. The portfolio has grown to over 400 applications, many with overlapping functionality and unclear ownership. The committee wants to establish a repeatable governance process for rationalizing the portfolio. Which TWO of the following actions are MOST effective for this purpose? (Choose two.)

Accepted Answer

Mandate that all new application acquisitions follow a standardized business case and architecture review process. Effective application portfolio governance rests on two pillars: visibility and prevention. An inventory with capability mapping and ownership provides the visibility needed to make rationalization decisions, while a standardized intake process prevents new duplication from accumulating. Together they form a repeatable, evidence-based cycle. Delegation, arbitrary targets, and wholesale replacement each fail to establish sustainable governance over application resources.

Answer

Set a fixed target of retiring 25% of applications within twelve months to create urgency for the rationalization effort

Answer

Migrate the entire portfolio to a single vendor's SaaS platform to eliminate integration and ownership complexity

Answer

Delegate all application retirement decisions to individual business unit leaders to accelerate the rationalization process

Question 3

A global retailer is implementing a new enterprise resource planning (ERP) system. The CGEIT practitioner is tasked with ensuring that risk optimization is embedded throughout the project lifecycle. Which TWO of the following actions are most critical to achieve this? (Choose two.)

Accepted Answer

Establish a risk register that is reviewed at key project milestones.. Embedding risk optimization in the ERP project lifecycle requires continuous risk assessment and a dynamic risk register reviewed at milestones. These actions ensure risks are managed proactively. Assigning all risk to one person, conducting a one-time assessment, or delegating decisions to the vendor are ineffective and misaligned with governance.

Answer

Conduct a single comprehensive risk assessment at the project's initiation.

Answer

Assign risk ownership to the project manager for all identified risks.

Answer

Delegate all risk decisions to the ERP vendor to leverage their expertise.

Question 4

A global manufacturing firm has a decentralized IT governance model. Each region manages its own IT risk register and reports quarterly to the corporate risk committee. The CGEIT practitioner discovers that one region has been classifying a critical supplier outage as 'low risk' because it has a local backup supplier. However, the corporate risk appetite states that any single supplier failure affecting more than 10% of global production is unacceptable. What is the MOST effective action for the CGEIT practitioner to take?

Accepted Answer

Escalate the discrepancy to the corporate risk committee and recommend a review of the risk governance framework to ensure consistent application of risk appetite across all regions.. In a decentralized governance model, inconsistent application of risk appetite is a governance failure. The CGEIT practitioner should escalate the specific discrepancy to the corporate risk committee and recommend strengthening the framework with a common risk taxonomy, clear escalation criteria, and regular calibration. This addresses both the immediate misclassification and the systemic root cause.

Answer

Recommend that the region increase its quarterly reporting frequency to monthly to improve oversight.

Answer

Direct the region to reclassify the risk as high and update its risk register immediately.

Answer

Accept the region's classification because local backup suppliers mitigate the risk at the regional level.

Question 5

A hospital's board has established a risk appetite that prioritizes patient safety over cost efficiency. The CGEIT practitioner is reviewing IT investment proposals and must ensure they align with this risk appetite. Which TWO of the following actions best demonstrate alignment with the board's risk appetite? (Choose two.)

Accepted Answer

Prioritize funding for a redundant electronic health record (EHR) system to minimize downtime risk, even though it increases costs.. The board's risk appetite prioritizes patient safety over cost efficiency. Therefore, investments that increase costs but reduce patient safety risks—such as redundant EHR systems and clinical decision support tools—are aligned. Actions that cut costs by deferring security patching, outsourcing to low-cost providers, or reducing backup testing increase patient safety risks and thus misalign with the stated appetite.

Answer

Outsource the management of patient monitoring systems to a low-cost provider to reduce expenses and free up internal resources.

Answer

Defer security patching on medical devices to avoid disrupting clinical workflows, as patient safety takes precedence.

Answer

Reduce the frequency of backup testing for clinical databases to save on operational costs, since backups are rarely needed.

Question 6

An insurance company is developing a new mobile app that will allow customers to file claims and upload sensitive documents. The CGEIT practitioner is asked to ensure that risk is optimized during the development lifecycle. Which of the following should be the PRIMARY consideration when integrating risk management into the project?

Accepted Answer

Embedding risk assessment and response activities into each phase of the development lifecycle.. Risk optimization during a project requires continuous risk management integrated into every phase of the lifecycle. This enables early identification of threats and opportunities, informed decision-making, and timely adjustments. While compliance, penetration testing, and insurance are important, they are individual controls or responses, not the overarching approach to embedding risk management into the development process.

Answer

Ensuring that all regulatory requirements for data privacy are met before launch.

Answer

Purchasing cyber insurance to transfer the risk of a data breach.

Answer

Conducting a penetration test before the app is released to production.

Question 7

A global retailer's board has approved a risk appetite statement specifying that the enterprise will accept no more than a 5% annual loss of availability for its e-commerce platform. The CIO proposes moving the platform to a public cloud provider whose standard SLA guarantees 99.5% uptime. Which action should the CGEIT practitioner recommend FIRST?

Accepted Answer

Validate the cloud provider's SLA terms, measurement methodology, and historical performance against the board's tolerance before deciding.. The board's risk appetite is a 5% annual availability loss tolerance for the e-commerce platform. The proposed SLA's 99.5% uptime nominally fits, but SLAs frequently exclude planned maintenance, have vague measurement windows, and offer service credits rather than guaranteed uptime. The practitioner must validate the SLA's actual terms, exclusions, and the provider's historical performance to confirm the real risk exposure. Only after this validation can a recommendation be made that aligns with the board's stated tolerance.

Answer

Accept the proposal because the SLA meets the availability target, and proceed with migration.

Answer

Escalate the decision to the board for a vote because cloud migration inherently changes the risk profile.

Answer

Reject the proposal because 99.5% uptime does not meet the 5% loss tolerance.

Question 8

A multinational retailer's board has approved an enterprisewide risk appetite statement. The CIO now needs to ensure that the IT risk management process is aligned with this appetite. Which action should the CIO take FIRST?

Accepted Answer

Translate the enterprise risk appetite into specific IT risk tolerance thresholds and integrate them into the IT risk management framework.. The correct answer is to translate the enterprise risk appetite into specific IT risk tolerance thresholds and integrate them into the IT risk management framework. This ensures that IT risk management is not just philosophically aligned but operationally guided by clear, measurable limits that reflect the board's stated appetite. Without this translation, subsequent risk assessments and monitoring lack a consistent basis for decision-making.

Answer

Conduct a comprehensive IT risk assessment to identify all potential risks and their impacts.

Answer

Implement a real-time IT risk dashboard for the board to monitor key risk indicators.

Answer

Update the IT risk policy to state that IT risk management will adhere to the enterprise risk appetite.

Question 9

A retail bank's IT investment committee is reviewing a proposal to replace its legacy loan origination system. The business case forecasts reduced loan processing time, but the finance division insists that only cash-releasing savings count as benefits. Which action BEST aligns the committee's benefits categorization with CGEIT benefits realization principles?

Accepted Answer

Document the processing-time benefit as a non-financial benefit with a measurable indicator, and separately identify any cash-releasing savings.. Benefits realization governance requires a complete register that captures both financial and non-financial benefits, each with an owner and a measurable indicator. Recording the processing-time gain as a non-financial benefit with a cycle-time indicator, while separately tracking cash-releasing savings, keeps the portfolio view accurate and respects the distinction CGEIT draws between benefit types.

Answer

Reclassify all non-cash benefits as intangible and exclude them from the benefits register until they convert to cash.

Answer

Ask the finance division to own the processing-time benefit since it controls the definition of organizational value.

Answer

Defer the entire business case until finance can quantify the processing-time improvement in monetary terms.

Question 10

A financial services firm is reviewing its IT risk management framework. The CGEIT practitioner has been asked to identify the factors that should be considered when determining the appropriate risk response for a critical IT system failure. Which TWO of the following factors are MOST important for this determination? (Choose two.)

Accepted Answer

The cost-benefit analysis of each risk response option.. Determining the appropriate risk response requires aligning with the organization's risk appetite and tolerance, and evaluating the cost-benefit of response options. These factors ensure the response is both strategically aligned and economically justified. Technical details, staffing, and vendor reputation are secondary considerations that may affect implementation but do not drive the fundamental choice of response.

Answer

The IT department's current staffing levels and skills.

Answer

The number of vulnerabilities identified in the last penetration test.

Answer

The technology vendor's market share and brand reputation.

Question 11

A hospital's IT steering committee is reviewing a proposed electronic health record (EHR) upgrade. The business case claims annual savings of $2.4M from reduced duplicate testing, but the finance department cannot trace those savings to any existing cost center or budget line. Which benefits realization action should the committee require BEFORE approving funding?

Accepted Answer

Validate the savings against a documented baseline of current duplicate-test volumes and unit costs.. Benefits claims must be traceable to a measurable baseline before investment approval, otherwise realization cannot be proven later. Establishing current duplicate-test volumes and unit costs creates that baseline and clarifies which cost centers will actually realize the savings. The other choices either shift accountability, postpone verification, or disguise the claim rather than establishing the measurement foundation the committee needs.

Answer

Defer the savings claim to the post-implementation benefits review and approve funding on strategic grounds alone.

Answer

Reclassify the $2.4M as an intangible benefit so it no longer needs to appear in the financial business case.

Answer

Require the vendor to contractually guarantee the $2.4M savings in the software license agreement.

Question 12

A financial services firm has funded an IT program to migrate core banking workloads to a hybrid cloud. Six months after go-live, the CIO reports that the program is 'complete' because all workloads were migrated on schedule. The governance committee observes that the expected reduction in infrastructure cost and the expected improvement in release frequency have not been independently verified. Which TWO governance actions should the committee take to strengthen benefits realization for this program? (Choose two.)

Accepted Answer

Require the program to transition from a delivery-focused closure report to a benefits tracking report that compares actual infrastructure cost and release frequency against the approved baseline.. Declaring a program complete on delivery milestones alone confuses output with outcome. The committee must shift the evidence base to actual-versus-baseline benefit performance and ensure someone owns those metrics after the project team disbands. Together, benefits tracking and post-project ownership create the accountability loop that lets governance confirm, challenge, or condition the claimed completion.

Answer

Reopen the program charter and extend the schedule until the cloud provider confirms all migration wave acceptance criteria are met.

Answer

Ask the internal audit function to verify that the migration adhered to the approved change management process.

Answer

Commission a technology refresh assessment to determine whether the hybrid cloud platform remains aligned with the enterprise architecture roadmap.

Question 13

A global logistics firm has completed a $12M telematics rollout. Six months after go-live, fleet managers report improved route visibility, but the CFO notes that fuel spend is unchanged and no budget reductions have occurred. The benefits register still shows the original $3M annual fuel-savings target as 'on track.' Which governance weakness does this MOST clearly illustrate?

Accepted Answer

Benefits are being tracked as activity completion rather than as realized business outcomes.. The register treats rollout completion as proof of benefit while the financial outcome, fuel savings, has not occurred. Effective benefits realization distinguishes outputs from outcomes and requires evidence that business results changed. Because no fuel-spend reduction or budget release is visible, the benefit should be flagged as at risk, with root-cause analysis on adoption, routing behavior, and idle-time reduction rather than continued green status.

Answer

The capital investment was approved without a formal post-implementation review gate.

Answer

The benefits register lacks a named executive sponsor accountable for the telematics program.

Answer

Fuel savings were never included in the enterprise's annual operating budget assumptions.

Question 14

A government agency's IT steering committee is prioritizing a set of candidate investments for the coming fiscal year. One proposal promises a 15 percent reduction in case-processing time, and the committee wants to compare it fairly against proposals that promise revenue growth and risk reduction. Which approach should the committee use to compare these dissimilar benefits?

Accepted Answer

Score each proposal against weighted criteria that reflect the agency's strategic objectives, including financial, operational, and risk dimensions.. When benefits are heterogeneous, the committee needs a common scale that reflects strategy, not just cash. A weighted scoring model converts financial, operational, and risk benefits into comparable scores, supports transparent trade-offs, and documents why each investment was selected. That makes the prioritization defensible and directly connected to enterprise objectives.

Answer

Fund the proposal with the shortest payback period first, then allocate remaining budget by project size.

Answer

Rank all proposals by net present value and fund them in descending order until the budget is exhausted.

Answer

Ask each business sponsor to present a qualitative business case and let the committee reach consensus by discussion.

Question 15

A healthcare organization is establishing an IT governance framework to improve alignment between IT and business strategy. The governance body must define key roles and responsibilities. Which TWO of the following are essential governance mechanisms to ensure effective IT decision-making? (Choose two.)

Accepted Answer

Defining a formal IT decision-making process with clear escalation paths.. The essential governance mechanisms are establishing an IT steering committee with business and IT leadership and defining a formal IT decision-making process with clear escalation paths. These mechanisms ensure that IT decisions are made collaboratively, aligned with business objectives, and escalated appropriately. They provide the structure for accountability and strategic alignment, which are core to effective IT governance.

Answer

Implementing a chargeback model to allocate IT costs to business units.

Answer

Outsourcing all IT operations to a third-party provider to reduce internal complexity.

Answer

Adopting a technology-first approach where IT determines business requirements.

Question 16

An e-commerce company's risk register shows that a third-party payment gateway poses a high risk of data breach. The CGEIT practitioner is asked to recommend a risk response that aligns with the enterprise's risk appetite. The board has stated that it will not accept any risk that could lead to a material data breach. Which risk response should the practitioner recommend?

Accepted Answer

Avoid the risk by discontinuing use of the third-party gateway and developing an in-house payment solution.. The board's risk appetite explicitly rejects any risk that could lead to a material data breach. Among risk responses, avoidance is the only option that eliminates the risk entirely. Discontinuing the third-party gateway removes the exposure, while mitigation, transfer, and acceptance leave residual risk that could still result in a breach. Although developing an in-house solution may be costly, it aligns with the board's directive and ensures the enterprise does not violate its stated tolerance. This recommendation demonstrates governance alignment with risk appetite.

Answer

Mitigate the risk by implementing additional encryption and monitoring controls on the gateway.

Answer

Transfer the risk by requiring the payment gateway provider to accept full liability for breaches.

Answer

Accept the risk because the third-party gateway is industry-standard and widely used.

Question 17

A global manufacturer is reviewing its IT investment portfolio. The CIO wants to reallocate funding from a stable back-office system to a digital supply-chain initiative. The CFO insists that the back-office system still delivers reliable cost avoidance. Which concept should guide the reallocation decision?

Accepted Answer

Value optimization across the portfolio, balancing risk, return, and strategic alignment.. Value optimization is the portfolio-level practice of directing finite resources to the combination of investments that best delivers enterprise strategy while balancing risk and return. It forces comparison between retaining the back-office system and funding the supply-chain initiative, rather than evaluating either in isolation. This is the concept that resolves competing stakeholder priorities in an IT investment portfolio.

Answer

Net present value (NPV) of the back-office system's remaining lifecycle.

Answer

Total cost of ownership (TCO) of the back-office system.

Answer

Return on investment (ROI) of the digital supply-chain initiative.

Question 18

A retail bank's IT investment committee is defining how it will confirm that a new fraud-detection platform delivered its intended value. The platform's business case promised reduced fraud losses and faster case resolution. Which artifact should the committee establish FIRST to enable later confirmation of these benefits?

Accepted Answer

A benefits realization plan with owners, measures, baselines, and target dates for each benefit.. Confirmation of benefits requires an agreed plan specifying measures, owners, baselines, and timing before the initiative alters the environment. The benefits realization plan provides that foundation, ensuring fraud-loss and case-resolution data are captured comparably. Risk registers, vendor SLAs, and review schedules support governance but do not by themselves enable verification that the promised business value was achieved.

Answer

A post-implementation review schedule aligned to the enterprise project lifecycle.

Answer

A revised enterprise risk register reflecting the residual risk after platform deployment.

Answer

A service level agreement with the platform vendor covering uptime and response times.

Question 19

A retail company's IT governance committee is reviewing the performance of its IT investments. The committee wants to ensure that IT is delivering value in line with business expectations. Which of the following is the MOST effective way to demonstrate IT value delivery?

Accepted Answer

Measuring the achievement of business case benefits defined for each IT investment.. The most effective way to demonstrate IT value delivery is to measure the achievement of business case benefits defined for each IT investment. This approach directly links IT spending to business outcomes, ensuring that IT is not just efficient but also effective in delivering strategic value. It aligns with governance principles that emphasize value creation as a key objective.

Answer

Counting the number of IT service incidents reported by users.

Answer

Monitoring the IT budget variance compared to the annual plan.

Answer

Tracking the number of IT projects completed on time and within budget.

Question 20

A healthcare insurer is revising its IT governance framework after a series of regulatory findings. The board wants assurance that IT governance will provide effective oversight of compliance, risk, and resource optimization across clinical and claims systems. Which TWO governance mechanisms should the CIO implement to provide this assurance? (Choose two.)

Accepted Answer

Establish an IT steering committee with defined membership, decision rights, and a charter that includes compliance and risk oversight responsibilities.. Effective governance assurance comes from standing structures with defined authority and from transparent performance and risk reporting to the board. A chartered IT steering committee provides decision-making oversight, while published metrics linked to enterprise objectives give the board evidence of compliance and resource optimization. Self-certification, CIO-directed audit, and unreviewed external standards do not provide independent, enterprise-level assurance.

Answer

Require the internal audit function to perform quarterly compliance testing and report results directly to the CIO.

Answer

Outsource regulatory interpretation to an external legal firm and adopt its recommendations as the IT compliance standard without board review.

Answer

Delegate all IT compliance decisions to the clinical systems owners and require them to self-certify adherence annually.