CGEIT Practice Test 2 — 30 Questions

Question 1

A global company needs to compare IT investment performance across different business units using different currencies and operational models. Which metric is most suitable for normalization?

Accepted Answer

Normalized TCO relative to business unit output.. Normalized Total Cost of Ownership relative to business unit output adjusts for differences in currency, scale, and operating model by expressing IT cost per unit of business output (e.g., per transaction, per revenue dollar, per customer). This creates an apples-to-apples comparison across units that operate in different currencies and with different cost structures. It is the only option that both normalizes for currency and contextualizes cost against productive output.

Answer

Number of active projects per business unit.

Answer

IT spend as a percentage of total head count.

Answer

Local currency ROI calculations.

Question 2

Which type of IT resource is most likely to become a bottleneck during a rapid increase in business demand?

Accepted Answer

Computing infrastructure. Computing infrastructure (servers, storage, network capacity) is a finite, physical resource that cannot scale instantly, so a rapid spike in business demand will exhaust capacity and create a bottleneck. Policies, culture, and documentation are intangible and do not constrain throughput in the same way. This makes computing infrastructure the most likely bottleneck under sudden demand growth.

Answer

Policies and procedures

Answer

Organizational culture

Answer

Strategic documentation

Question 3

A governance review reveals that IT decision-making is too slow to support rapid market changes. What should be done?

Accepted Answer

Delegate specific decision-making authorities to lower levels based on defined thresholds. When governance slows decision-making, the correct remedy is to redesign decision rights, not to remove oversight or centralise further. Delegating specific authorities to lower levels with defined thresholds (e.g., spend limits, risk tiers) preserves accountability while enabling speed. This is a core principle of effective governance design — matching decision latency to the pace of the business.

Answer

Require the board of directors to approve every IT change

Answer

Remove all governance oversight requirements to speed up decisions

Answer

Stop all development until the governance process is redesigned

Question 4

A large organization is attempting to reduce technical debt. Which resource management approach is most effective?

Accepted Answer

Allocating a set percentage of capacity to technical debt remediation in every sprint/cycle. The most effective approach to reducing technical debt is to allocate a consistent, planned percentage of capacity in every sprint or cycle to remediation, making debt reduction a continuous, funded activity rather than a one-off project. This prevents debt from compounding and balances new feature delivery with maintainability. It also embeds remediation into governance and resource management routines.

Answer

Outsourcing the maintenance of legacy systems

Answer

Pausing all new development until all legacy systems are replaced

Answer

Waiting for a major system failure to justify remediation budget

Question 5

When balancing risk and value in IT investment, what is the primary consideration for the CGEIT practitioner?

Accepted Answer

Optimizing the realization of benefits while maintaining risk exposure within the enterprise appetite.. The primary consideration for a CGEIT practitioner is to optimize value realization while keeping risk exposure within the enterprise's defined risk appetite. This balances the pursuit of benefits with the constraint of acceptable risk, aligning IT investment with business strategy. It is not about eliminating risk or ignoring it for ROI.

Answer

Prioritizing compliance over all other business requirements.

Answer

Total elimination of IT risk.

Answer

Maximizing the return on investment (ROI) regardless of risk exposure.

Question 6

An organization's risk appetite has been set as 'low' for data breaches. A new project introduces a moderate risk of a breach. What is the most appropriate governance action?

Accepted Answer

Implement additional security controls to bring the residual risk within the 'low' appetite.. The organization has explicitly set a 'low' risk appetite for data breaches, meaning any risk above that threshold is unacceptable without treatment. Since the project introduces a moderate breach risk that exceeds the stated appetite, governance must direct treatment — implementing additional controls to reduce residual risk to within the 'low' appetite. This preserves both the project's value and the board-approved risk posture, which is the core purpose of risk appetite-driven governance.

Answer

Accept the risk because the project is strategically important.

Answer

Lower the 'low' appetite threshold to 'moderate'.

Answer

Document the risk in the risk register and ignore it for now.

Question 7

An organization adopts a multi-cloud strategy. Which governance challenge is most significant regarding resource optimization?

Accepted Answer

The lack of consistent visibility, policy enforcement, and cost management across platforms. In a multi-cloud environment, the dominant governance challenge for resource optimisation is the fragmentation of visibility, policy, and cost control across providers. Each cloud has its own management console, IAM model, tagging conventions, and billing structure, making it difficult to enforce consistent governance or optimise spend holistically. This fragmentation — not provisioning speed or talent — is what undermines governance effectiveness.

Answer

The slower speed of provisioning resources

Answer

The difficulty of finding cloud architects

Answer

The increased cost of data egress fees between clouds

Question 8

A corporation is shifting from a centralized to a decentralized IT structure. How does this affect governance?

Accepted Answer

Governance must define common standards while allowing local decision-making flexibility.. When IT shifts from centralized to decentralized, governance must adapt by defining common enterprise-wide standards (security, data, architecture) while granting business units flexibility for local decisions. This federated model preserves enterprise coherence without stifling local responsiveness. Governance does not disappear — it changes form to balance control and autonomy.

Answer

The board should take over all local IT decisions.

Answer

The governance framework is no longer required.

Answer

Decentralization makes IT governance impossible.

Question 9

Which stakeholder is ultimately accountable for the governance of IT in an enterprise?

Accepted Answer

The Board of Directors. Ultimate accountability for IT governance rests with the Board of Directors (D). In governance frameworks such as COBIT and ISO/IEC 38500, the board is responsible for setting direction, ensuring IT delivers value, optimizing risk, and optimizing resources. While IT steering committees, the CIO, and audit provide oversight and execution, the board holds the ultimate fiduciary accountability to stakeholders for how IT is governed.

Answer

The IT Steering Committee

Answer

The Internal Audit department

Answer

The Chief Information Officer (CIO)

Question 10

A large enterprise is transitioning to a hybrid cloud environment. How should the governance policy be updated to maintain effective oversight?

Accepted Answer

Develop policies addressing shared responsibility and cloud governance controls.. In a hybrid cloud model, governance must be updated to reflect the shared responsibility model, where the cloud provider secures the cloud infrastructure while the enterprise remains accountable for data, identities, and configurations in the cloud. Developing policies that explicitly address shared responsibility and cloud-specific governance controls (e.g., CASB, CSPM, contract SLAs) ensures oversight is maintained across both on-premises and cloud environments. This aligns with CGEIT's focus on aligning IT governance with enterprise strategy and risk.

Answer

Centralize all IT infrastructure back to on-premises.

Answer

Shift all responsibility for security to the cloud provider.

Answer

Eliminate the need for internal IT policies.

Question 11

An organization is updating its IT governance policies. Which element must be included to ensure policy enforcement?

Accepted Answer

Defined roles, responsibilities, and accountability mechanisms. To ensure policy enforcement, an IT governance policy must include defined roles, responsibilities, and accountability mechanisms (B). Policies without assigned ownership and consequences are unenforceable; defining who is responsible for compliance, who monitors it, and what happens when it is violated is what turns a policy document into an enforceable governance instrument. This aligns with COBIT's emphasis on organizational structures and accountability.

Answer

A copy of the IT department's budget spreadsheet

Answer

A detailed technical configuration guide for all servers

Answer

A list of all software vendor names used by the company

Question 12

What is the primary benefit of asset management within IT resource governance?

Accepted Answer

Providing visibility into the IT inventory for optimization and compliance. Asset management in IT resource governance provides visibility into the IT inventory — hardware, software, licenses, and configurations — enabling optimization (cost, utilization, lifecycle) and compliance (license audits, regulatory requirements). This visibility is the foundation for informed investment, retirement, and risk decisions. Without it, governance cannot know what resources exist or whether they are being used effectively.

Answer

Reducing the need for IT staff

Answer

Ensuring all hardware is painted the same color

Answer

Automating the password reset process

Question 13

A project delivers a new system, but the benefits are not realized due to an outdated manual process that was not updated. Where did the benefits management plan fail?

Accepted Answer

In the business change management and process alignment components.. Benefits realization depends not only on delivering the technology but also on changing the business processes and organizational behaviors that surround it. If an outdated manual process remains in place after the system goes live, the expected benefits cannot materialize — this is a failure of the business change management and process alignment components of the benefits management plan.

Answer

In the software coding standards.

Answer

In the technical design phase.

Answer

In the project budget management.

Question 14

An organization is merging with another company. How should the governance structures be reconciled?

Accepted Answer

Conduct a gap analysis and develop a unified governance framework.. When merging organizations, governance structures should be reconciled through a gap analysis that identifies differences, overlaps, and best practices, followed by development of a unified framework. This ensures the merged entity has a coherent governance model aligned with its new strategy, risk profile, and regulatory obligations. Simply adopting one side's framework or keeping both creates inconsistency and accountability gaps.

Answer

Adopt the framework of the company with more employees.

Answer

Keep both frameworks as they are.

Answer

Abandon both frameworks and start from scratch.

Question 15

What is the primary difference between a Project Manager and a Benefits Owner?

Accepted Answer

The project manager is responsible for the technical output; the benefits owner is responsible for the business outcome.. The project manager owns delivery of the project's defined scope, schedule, and technical outputs within constraints, while the benefits owner is accountable for realizing the intended business outcomes and value after delivery. In CGEIT terms, this separation reflects the distinction between project execution (outputs) and benefits realization (outcomes), which is central to IT governance and value delivery.

Answer

There is no difference between these two roles.

Answer

The project manager is responsible for the company's financial results.

Answer

The benefits owner manages the daily development tasks.

Question 16

An organization adopts a new IT governance policy. Which mechanism best ensures that employees understand and follow the policy?

Accepted Answer

Establishing a formal communication and training plan regarding the policy. Establishing a formal communication and training plan is the most effective mechanism because it proactively ensures that employees are aware of the policy, understand its requirements, and know how to comply. Training and communication are core components of IT governance implementation, as they translate policy intent into actionable behavior. This approach aligns with COBIT's focus on culture, ethics, and behavior, ensuring that governance policies are embedded in the organization. Without such a plan, even the best policy remains unknown or misunderstood.

Answer

Including the policy in the organization's long-term strategic plan

Answer

Threatening immediate termination for any policy deviation

Answer

Encrypting the policy document on the corporate intranet

Question 17

Which TWO stakeholders are essential for successful IT governance?

Accepted Answer

Executive Management. Executive Management (C) is essential because IT governance requires top leadership to set strategic direction, approve IT policies, allocate budgets, and ensure IT investments align with business objectives and risk appetite. The Board of Directors (D) is also essential because it provides ultimate oversight and accountability, ensuring that IT governance frameworks, risk management, and compliance obligations are met at the highest organizational level. Together, these two stakeholders supply the authority, strategic alignment, and oversight that define successful IT governance. Local IT repair technicians (A) perform operational support tasks rather than governance-level decision-making, delivery drivers (B) are unrelated to IT governance, and external janitorial staff (E) have no governance role, so none of these belong.

Answer

Local IT repair technicians

Answer

Delivery drivers

Answer

External janitorial staff

Question 18

A retail company's IT risk register shows that a legacy point-of-sale system has a high likelihood of failure due to unsupported hardware. The CIO wants to replace it, but the CFO argues that the system still works and replacement is too expensive. The CEO asks the CGEIT practitioner to facilitate a decision. Which of the following should be the primary basis for the decision?

Accepted Answer

The alignment of the decision with the enterprise's risk appetite and tolerance levels.. Governance decisions about IT risk should be anchored in the enterprise's risk appetite. When a risk exceeds tolerance, the organization must act to bring it within acceptable levels, even if that requires investment. The CGEIT practitioner facilitates this by ensuring the decision is framed around risk-return alignment rather than cost or technical specifications alone.

Answer

The CFO's cost-benefit analysis showing that replacement is not financially justified.

Answer

The total cost of ownership of the legacy system versus the replacement.

Answer

The technical specifications of the replacement system compared to the legacy system.

Question 19

Which of the following best defines IT Governance?

Accepted Answer

A structure of relationships and processes to direct and control the enterprise.. IT governance is defined as the structure of relationships and processes used to direct and control the enterprise's IT resources toward business objectives. This definition (rooted in COBIT and ITGI) emphasizes direction, control, and accountability rather than operational execution. It encompasses leadership, organizational structures, and processes that ensure IT sustains and extends the enterprise's strategy and objectives.

Answer

Purchasing new software for the company.

Answer

Managing daily IT support tickets.

Answer

Updating antivirus software across the network.

Question 20

When benefits are reported as 'percentage of goal achieved', what is a potential risk?

Accepted Answer

Percentages may hide the underlying absolute values and total costs.. Reporting benefits as a percentage of goal achieved can obscure the absolute magnitude of the benefit and the costs incurred. For example, achieving 100% of a small goal may look successful, but if the total cost was enormous, the net value could be negative. Percentages alone do not reveal whether the benefit is material to the organization or whether the investment was worthwhile.

Answer

Percentages are too difficult for stakeholders to understand.

Answer

Percentages cannot be calculated for IT projects.

Answer

Percentages are always accurate.