CGEIT Practice Questions 1 — 50 Questions

Question 1

A dashboard shows that an IT project has achieved 90% of its technical deliverables, but only 20% of its anticipated benefits. What is the most appropriate management action?

Accepted Answer

Review the benefits realization plan to assess organizational change progress.. When technical deliverables are nearly complete but benefits realization is far behind, the gap typically lies in organizational change management, adoption, or process readiness rather than technical execution. The most appropriate management action is to review the benefits realization plan to diagnose why the anticipated benefits are not materializing and to address change management, training, or process issues.

Answer

Reduce the budget for the remainder of the project.

Answer

Accelerate the technical project completion to reach 100%.

Answer

Lower the benefit targets to match the current progress.

Question 2

A project is expected to deliver cost savings through automation. Which metric is the best indicator of this benefit?

Accepted Answer

The reduction in manual labor hours per transaction.. The reduction in manual labor hours per transaction directly measures the cost savings from automation, as labor hours are a primary cost driver. This metric quantifies the efficiency gain and translates directly into financial savings. It is a tangible, outcome-oriented indicator of the benefit.

Answer

The number of users trained on the new system.

Answer

The number of systems upgraded.

Answer

The total budget spent on software licenses.

Question 3

A multinational bank's board has approved an enterprise risk appetite that explicitly prohibits any single IT system outage exceeding four hours. The CIO reports that the core banking platform has experienced three outages of six hours each in the past quarter. Which action should the IT governance committee take FIRST?

Accepted Answer

Direct the CIO to present a remediation plan with timelines and interim risk mitigation controls at the next governance meeting.. A breach of the board-approved risk appetite requires the governance committee to act immediately by holding management accountable. Directing the CIO to deliver a remediation plan with timelines and interim controls restores oversight, keeps governance in its proper strategic role, and creates a traceable mechanism for monitoring until performance realigns with the stated tolerance.

Answer

Revise the enterprise risk appetite to permit six-hour outages so the platform is compliant.

Answer

Escalate the issue to the internal audit function and await its findings before taking any action.

Answer

Instruct the infrastructure team to immediately replace the core banking platform vendor.

Question 4

A government agency's IT governance committee is finalizing its governance framework. A dispute arises over who should approve exceptions to the enterprise architecture standards when a business unit needs a rapid technology deployment. Which principle should guide the committee's decision on where to place exception approval authority?

Accepted Answer

Exceptions should be approved by a designated architecture authority with defined criteria and time limits.. Exception authority should sit with a designated architecture authority operating under explicit criteria, documented rationale, and time limits, which preserves both agility and control. Self-approval by requesters, case-by-case governance committee review, and external auditor approval all misplace authority, creating conflicts, bottlenecks, or independence breaches. ISACA CGEIT guidance supports delegated decision rights bounded by criteria and escalation for material impacts.

Answer

Exceptions should be approved by the external auditor to provide independent validation of each case.

Answer

Exceptions should be approved by the requesting business unit's project manager to preserve agility.

Answer

Exceptions should be approved by the IT governance committee for every deployment to ensure consistency.

Question 5

A global retail enterprise has completed an IT-enabled supply chain transformation projected to reduce inventory carrying costs by 12%. Eighteen months after go-live, finance reports only a 4% reduction. The CIO wants to understand whether the shortfall stems from the business case assumptions or from how the capability is being used. Which action should the CIO take FIRST?

Accepted Answer

Compare actual benefit measurements against the baseline assumptions and trace the variance to specific benefit drivers and owners.. The disciplined benefits realization response to a variance is measurement against the agreed baseline followed by root-cause tracing to drivers and owners. Only after that diagnosis can the organization decide whether to correct execution, revise assumptions, or escalate. Rebaselining, premature failure declarations, and arbitrary target increases all bypass the evidence needed for sound governance decisions.

Answer

Commission a post-implementation review that re-forecasts the remaining benefits and adjusts the original business case baseline.

Answer

Direct the supply chain function to increase inventory reduction targets for the next fiscal year to recover the shortfall.

Answer

Escalate to the audit committee that the transformation has failed to deliver and recommend writing off the remaining benefits.

Question 6

An enterprise's data center lease expires in 18 months. The CIO must present a resource strategy to the board covering compute, storage and network capacity for a workload portfolio with stable legacy systems and highly variable digital channels. Which approach BEST aligns IT resource governance with business demand uncertainty?

Accepted Answer

Adopt a hybrid model that keeps stable legacy workloads on controlled infrastructure and uses elastic cloud services for variable digital channels, governed by a demand forecasting and capacity review process.. Matching infrastructure commitment to workload demand profiles, with stable systems on controlled platforms and variable channels on elastic services, optimizes resource use under uncertainty. Adding demand forecasting and recurring capacity review turns the decision into a governed, revisable process rather than a one-time bet, which is what the board needs before a lease expiry.

Answer

Commit to a full private cloud refresh sized for current peak demand across all workloads.

Answer

Migrate all workloads to public cloud immediately to eliminate the data center lease decision.

Answer

Extend the lease on a month-to-month basis and defer the capacity strategy until demand patterns become clearer.

Question 7

In the context of the COBIT 2019 framework, what does 'Governance' mean?

Accepted Answer

Evaluation, direction, and monitoring of enterprise activities.. In COBIT 2019, governance is defined as the set of activities that ensure enterprise objectives are achieved by evaluating stakeholder needs, setting direction through prioritization and decision-making, and monitoring performance and compliance. This is captured in the governance framework's core model of Evaluate, Direct, and Monitor (EDM), which sits above the management objectives. Therefore, 'evaluation, direction, and monitoring of enterprise activities' is the precise COBIT definition.

Answer

Execution of technical tasks.

Answer

Managing the budget of the IT department.

Answer

Developing software applications.

Question 8

A pharmaceutical company relies on a legacy laboratory information management system that cannot be patched and is essential for regulatory submissions. The CGEIT practitioner is updating the risk register and must select the most appropriate risk response for the confirmed inability to remediate. Which response should be documented?

Accepted Answer

Risk acceptance with documented compensating controls, executive approval, and a scheduled replacement roadmap.. Because the legacy system is essential and cannot be patched, avoidance and mitigation are infeasible, and transfer alone leaves operational and regulatory exposure unmanaged. Deliberate acceptance with compensating controls, executive approval, and a replacement roadmap keeps the residual risk visible, governed, and bounded while the business continues to meet its regulatory obligations.

Answer

Risk transfer by purchasing cyber insurance and removing the system from the risk register.

Answer

Risk avoidance by decommissioning the system immediately and halting regulatory submissions.

Answer

Risk mitigation by applying an unsupported third-party patch to the legacy system without vendor validation.

Question 9

An organization is struggling with high IT operational costs. Which governance practice is most likely to reduce these costs?

Accepted Answer

Standardizing hardware and software platforms across the enterprise. Standardizing hardware and software platforms across the enterprise reduces operational cost by shrinking the variety of systems that must be patched, licensed, supported, and staffed. Fewer platforms mean lower licensing complexity, simplified training, consolidated support contracts, and reduced integration overhead. This is a foundational IT governance cost-optimization practice rooted in portfolio and architecture management.

Answer

Increasing the frequency of vendor contract renegotiations

Answer

Outsourcing all IT infrastructure management

Answer

Eliminating the IT governance committee

Question 10

A firm identifies that its IT governance framework is too burdensome for its agile, small-team structure. What is the most appropriate governance action?

Accepted Answer

Tailor the governance system by adjusting design factors.. COBIT 2019 explicitly supports tailoring the governance system by adjusting design factors — enterprise size, goals, risk profile, and culture — so the framework fits the organization rather than forcing the organization to fit the framework. For a small, agile firm, tailoring means scaling down process rigor, reducing documentation, and focusing on the governance objectives that matter most. This is the most appropriate action because it preserves governance intent while removing unnecessary burden.

Answer

Standardize all processes across the company.

Answer

Ignore the framework until the company grows.

Answer

Appoint more auditors to monitor compliance.

Question 11

An organization is transitioning from a traditional project-based IT budget to a Value Stream-aligned funding model. Which mechanism is most effective for ensuring that IT investments remain tethered to realized enterprise value?

Accepted Answer

Integrating Value Stream Key Performance Indicators (KPIs) into the portfolio governance cycle.. Value Stream-aligned funding requires governance mechanisms that measure and steer investment by the value delivered through each stream, so embedding Value Stream KPIs into the portfolio governance cycle creates the feedback loop that keeps funding tethered to realized enterprise value. This connects funding decisions to outcome metrics rather than project completion milestones. It is the only option that directly measures value realization and feeds it back into governance.

Answer

Automating the project portfolio management (PPM) approval workflow.

Answer

Implementing a formal Chargeback accounting system.

Answer

Moving to a strict Capital Expenditure (CAPEX) prioritization process.

Question 12

Which document should provide the framework for how IT resources are prioritized and allocated?

Accepted Answer

IT Strategic Plan. The IT Strategic Plan is the governing document that translates enterprise strategy into IT direction, including how IT resources (budget, people, technology) will be prioritized and allocated over the planning horizon. It provides the framework — principles, investment priorities, and capability roadmap — within which budgets and SLAs operate. The other documents are downstream artifacts that execute or constrain specific aspects of that framework.

Answer

Annual IT Operating Budget

Answer

Disaster Recovery Plan

Answer

Service Level Agreement (SLA)

Question 13

What is the primary benefit of categorizing IT investments into a portfolio?

Accepted Answer

To balance the investment mix between innovation, growth, and maintenance.. IT portfolio management categorizes investments so leadership can see the aggregate mix and deliberately balance spending across innovation (transformational), growth (evolutionary), and maintenance (operational) categories. This balance ensures the organization is not over-investing in keeping the lights on while starving future capability, and it aligns IT spend with strategic risk appetite. The primary benefit is therefore portfolio balance, not scheduling, vendor uniformity, or cost cutting.

Answer

To ensure every project is completed at the same time.

Answer

To force all projects to use the same software vendor.

Answer

To reduce the cost of IT staff salaries.

Question 14

A financial services company is evaluating its IT resource allocation for the upcoming fiscal year. The CIO presents a plan that allocates 85% of the IT budget to maintaining existing infrastructure and only 15% to new strategic initiatives. The board has mandated a digital transformation agenda. Which governance action should the IT steering committee take?

Accepted Answer

Direct the CIO to develop a revised IT investment portfolio that gradually shifts resources towards strategic initiatives while maintaining essential operations.. The IT steering committee should direct the CIO to create a revised investment portfolio that gradually shifts resources toward strategic initiatives. This balances the need for digital transformation with the necessity of maintaining critical operations, ensuring governance oversight and strategic alignment without introducing undue operational risk.

Answer

Approve the budget as presented to ensure operational stability.

Answer

Escalate the decision to the board of directors for a final ruling on the budget.

Answer

Reject the budget and demand an immediate increase in the strategic allocation to 50%.

Question 15

Which action should the governance body take if a major IT risk is identified that exceeds the enterprise's risk appetite?

Accepted Answer

Formally communicate the risk to the board and propose a risk treatment plan. When a major IT risk exceeds the enterprise's risk appetite, the governance body must escalate it formally to the board and propose a risk treatment plan (mitigate, transfer, avoid, or accept with justification). This fulfills the governance body's oversight duty and ensures informed decision-making at the highest level. Simply ignoring or redefining risk appetite to fit the situation undermines the integrity of the risk management framework.

Answer

Wait for the risk to manifest before taking action

Answer

Re-evaluate the definition of risk appetite to match the current state

Answer

Request the IT department to simply delete the system causing the risk

Answer

Ignore the risk if it helps achieve a short-term profit target

Question 16

A healthcare provider is evaluating its IT resource sourcing strategy. The CIO wants to ensure that the strategy supports both cost efficiency and compliance with patient data regulations. Which TWO of the following governance actions are MOST important to include in the sourcing strategy? (Choose two.)

Accepted Answer

Establish a regular review process to monitor vendor performance against both cost and compliance metrics.. A sourcing strategy that supports cost efficiency and compliance must include rigorous vendor evaluation before contracting and continuous monitoring after. These actions ensure that vendors meet regulatory requirements and cost targets throughout the relationship. The other options either impose unnecessary technical constraints, bypass governance, or concentrate risk without addressing compliance.

Answer

Outsource all IT functions to a single vendor to achieve economies of scale.

Answer

Delegate all sourcing decisions to the procurement department to expedite contracting.

Answer

Require all vendors to use the same technology stack as the healthcare provider to simplify integration.

Question 17

Which TWO of the following factors should influence the frequency of risk reporting to the board?

Accepted Answer

The current risk posture and volatility of the environment.. Option B is correct because the frequency of risk reporting should be driven by the organization's current risk posture and the volatility of its environment — when risk levels are elevated or the threat landscape is changing rapidly, the board needs more frequent updates to maintain effective oversight. Option E is correct because risks that are significant to business objectives (for example, those threatening critical services, regulatory compliance, or strategic goals) warrant more frequent reporting than low-impact risks, since the board's primary governance role is to protect the achievement of those objectives. The remaining options do not belong: the size of the IT office building (A) is a physical facility detail with no bearing on governance reporting cadence, the number of years board members have served (C) is a tenure consideration unrelated to risk materiality or volatility, and the color of the report cover page (D) is a cosmetic formatting choice with no impact on reporting frequency.

Answer

The size of the IT office building.

Answer

The number of years the board members have served.

Answer

The color of the risk report cover page.

Question 18

A newly appointed CIO is establishing an IT governance framework. Which approach best ensures that IT governance activities are integrated into existing business decision-making processes?

Accepted Answer

Embedding IT governance roles and responsibilities into existing business management functions. Embedding IT governance roles and responsibilities into existing business management functions ensures governance is not a parallel silo but part of how the business already makes decisions. This approach leverages existing decision-making forums, reporting lines, and accountability structures, which is the most effective way to integrate IT governance into business processes per COBIT and ISO/IEC 38500.

Answer

Requiring all IT decisions to be signed off by the board of directors

Answer

Implementing an IT-only governance framework based strictly on COBIT 2019

Answer

Creating a separate IT governance committee with independent reporting lines

Question 19

What is the primary role of the IT governance framework in an enterprise?

Accepted Answer

To align IT strategy with business strategy and deliver value. The primary role of an IT governance framework is to align IT strategy with business strategy and ensure IT delivers value while managing risk and optimizing resources. This alignment is the core purpose defined by ISO/IEC 38500 and COBIT, ensuring IT investments support business objectives rather than operating as a separate technical function.

Answer

To serve as a technical manual for system administration

Answer

To automate all IT monitoring and reporting

Answer

To replace the need for IT management

Question 20

Which THREE activities are required when managing the 'Benefits Lifecycle'?

Accepted Answer

Tracking the realization of benefits after implementation.. The Benefits Lifecycle requires identifying and quantifying potential benefits (E) so that expected value is defined, measurable, and agreed before delivery begins. It also requires ensuring project deliverables align with business requirements (C), because benefits can only be realized if the outputs actually satisfy the intended business outcomes. Finally, it requires tracking the realization of benefits after implementation (B), since benefits management continues post-delivery to verify that the forecast value is actually achieved. Options A and D do not belong: reducing stakeholder numbers is not a benefits lifecycle activity, and updating source code documentation is a technical maintenance task unrelated to benefits management.

Answer

Reducing the number of project stakeholders.

Answer

Updating the project's source code documentation.