CGEIT Practice Test 3 — 10 Questions

Question 1

A retail bank's board has approved a risk appetite stating that no single technology failure may cause more than two hours of customer-facing outage. The CIO reports that the core banking platform depends on a single data center with a tested recovery time objective of six hours. Which action should the CGEIT practitioner recommend FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Escalate the appetite gap to the board risk committee with options to remediate the recovery capability or formally revise the appetite.. The board-approved appetite defines acceptable exposure, and the six-hour recovery objective exceeds the two-hour tolerance. The practitioner's first duty is to surface that gap to the board risk committee with remediation options and the alternative of formally revising the appetite. This preserves board ownership, enables an informed decision, and prevents either silent acceptance or unilateral spending.

Answer

Immediately approve funding for a second data center without consulting the board risk committee.

Answer

Revise the risk appetite statement to a six-hour tolerance so that reporting shows full compliance.

Answer

Accept the six-hour recovery time objective because the platform has never experienced a full outage.

Question 2

A healthcare provider's IT organization relies heavily on a small group of specialists who maintain a legacy clinical records interface. The specialists are approaching retirement, and documentation is sparse. The governance committee is asked to address this human resource risk. Which action BEST aligns with IT resource governance objectives?

Accepted Answer

Commission a knowledge transfer program that documents the interface, cross-trains additional staff, and sets a succession timeline. Human capital is a core IT resource, and concentrated knowledge in a few individuals is a governance risk to service continuity. A knowledge transfer program that documents the interface, cross-trains staff, and establishes a succession timeline reduces that concentration and builds durable capability. Retention bonuses, replacement projects, and contract staffing each leave the fundamental single-point-of-failure exposure in place.

Answer

Engage a staffing agency to provide contract specialists who can step in if any of the current specialists leave

Answer

Approve a retention bonus program to keep the specialists employed for as long as possible

Answer

Initiate a project to replace the legacy interface with a modern platform, eliminating the need for the specialists' skills

Question 3

Which TWO factors are essential for a successful benefits realization culture?

Accepted Answer

A focus on learning from both successes and failures.. Option A is correct because a benefits realization culture depends on continuous learning: organizations must systematically capture lessons from both successful and failed initiatives and feed them back into portfolio and program decisions, which is a core principle in frameworks such as Managing Successful Programmes (MSP) and the Benefits Realization Management (BRM) discipline. Option C is correct because clear accountability for benefit achievement ensures that named owners are responsible for defining, tracking, and reporting benefits through the benefits register and benefits realization plan, preventing benefits from being orphaned after project delivery. The remaining options do not belong: requiring all employees to learn programming (B) is a skills mandate unrelated to benefits realization, frequent updates to the technical architecture (D) is an IT maintenance activity rather than a cultural factor, and reducing the number of board meetings (E) would weaken governance and oversight of benefits rather than strengthen a benefits realization culture.

Answer

Requiring all employees to learn programming.

Answer

Frequent updates to the technical architecture.

Answer

Reducing the number of board meetings.

Question 4

A hospital network's IT governance committee is establishing its oversight structure. The committee needs a mechanism that provides independent, objective assurance to the board on whether IT controls are designed and operating effectively. Which mechanism should the committee establish?

Accepted Answer

An internal audit function with a reporting line to the board or audit committee.. Independent assurance over IT control design and operating effectiveness is delivered by internal audit when it reports to the board or audit committee, free from management influence. Steering committees, operations reviews, and vendor scorecards all serve valid purposes but are management-aligned activities that cannot objectively attest to controls. ISACA CGEIT emphasizes this separation as fundamental to effective governance oversight.

Answer

A weekly operations review meeting with IT managers to track incident metrics.

Answer

An IT steering committee chaired by the CIO to prioritize project requests.

Answer

A vendor scorecard process that rates third-party service providers quarterly.

Question 5

An organization's governance committee decides to stop funding a legacy IT system that is still critical for a specific department. What should be done?

Accepted Answer

Conduct an impact analysis and develop a migration strategy.. When funding is withdrawn from a system that remains critical to a department, the governance-driven response is to assess the business and operational impact and plan a controlled transition rather than abruptly terminating service. An impact analysis identifies dependencies, data retention needs, and continuity risks, while a migration strategy provides a governed path to a replacement or alternative. This preserves business continuity while respecting the committee's funding decision.

Answer

Decommission it immediately to save money.

Answer

Force the department to find their own funding.

Answer

Ignore the committee's decision and keep paying.

Question 6

Why should benefit realization planning start at the inception of an IT investment?

Accepted Answer

To ensure that the desired business outcomes are clearly defined and measurable.. Benefit realization planning must begin at inception because the entire investment rationale depends on defining what business outcomes the investment is meant to deliver and how those outcomes will be measured. If the desired outcomes are not clearly articulated and made measurable up front, there is no baseline against which to track value delivery, and the initiative risks drifting into a technology project with no demonstrable business return. CGEIT frames IT investment management around value delivery, so anchoring measurable outcomes at the start is what enables later benefit tracking, stage-gate reviews, and post-implementation evaluation.

Answer

To secure the budget before the project is approved.

Answer

To identify technical risks in the software architecture.

Answer

To ensure that the project team is selected correctly.

Question 7

A global retail enterprise runs its e-commerce platform on a mix of on-premises servers and IaaS virtual machines. The CIO wants to ensure that IT resource capacity decisions are driven by business demand signals rather than by infrastructure team convenience. Which governance mechanism BEST supports this objective?

Accepted Answer

Establish a demand management process that translates business forecasts into capacity plans reviewed by the IT steering committee.. Capacity governance must connect business demand to resource provisioning. A demand management process that feeds business forecasts into capacity plans, with steering committee oversight, ensures decisions are driven by business needs rather than infrastructure convenience. The other options either delegate to technical teams, use cost allocation alone, or apply rigid thresholds that ignore demand signals.

Answer

Delegate all capacity decisions to the infrastructure operations team because they have the deepest technical knowledge.

Answer

Adopt a policy that requires all new capacity to be procured only after the existing infrastructure reaches 95% utilization.

Answer

Implement a chargeback model that bills business units for every CPU cycle consumed on the e-commerce platform.

Question 8

When assessing the feasibility of a project, why is it necessary to evaluate the 'risk of benefit realization'?

Accepted Answer

To determine if the expected value can realistically be achieved under current conditions.. Evaluating the risk of benefit realization determines whether the projected business value can actually be delivered given current organizational, technical, and market conditions. It separates optimistic benefit forecasts from achievable outcomes by factoring in uncertainty, dependencies, and constraints. This assessment directly informs investment decisions and whether the business case is defensible.

Answer

To ensure the project follows the vendor's best practices.

Answer

To ensure the technical project has no bugs.

Answer

To reduce the number of stakeholders involved.

Question 9

A manufacturing firm's CIO is establishing benefits ownership for a portfolio of IT-enabled change programs. The steering committee wants to ensure each benefit has clear accountability so that realization can be tracked and intervened upon. Which TWO of the following are essential components of effective benefits ownership? (Choose two.)

Accepted Answer

A named business owner who is accountable for the outcome and has authority over the processes that generate the benefit.. Effective benefits ownership requires an accountable business owner with authority over the process that generates the benefit, plus an agreed measure with baseline and target. Together these create a clear contract for delivery and a basis for intervention. Tracking by the PMO, custody by finance, or executive reporting are supporting mechanisms but do not themselves establish ownership or make the benefit measurable.

Answer

Assignment of benefit tracking to the project management office for the duration of the program.

Answer

A commitment from the CIO to report benefit status directly to the board each quarter.

Answer

A benefits register maintained exclusively by the finance department to ensure consistency of valuation.

Question 10

Which document is essential for formalizing the relationship and expectations between IT and the business units?

Accepted Answer

Service Level Agreement (SLA).. A Service Level Agreement (SLA) is the formal document that defines the services IT will deliver, the expected performance levels, responsibilities of both parties, and remedies for non-performance. It is the primary instrument for codifying the relationship and mutual expectations between IT and business units. While other documents set direction or authorize work, the SLA operationalizes the IT-business relationship.

Answer

Governance Policy Statement.

Answer

Project Charter.

Answer

IT Strategic Plan.