CGEIT Practice Questions 2 — 50 Questions

Question 1

An organization experiences a high frequency of minor IT incidents. What is the most effective governance action to ensure this does not result in a significant enterprise risk?

Accepted Answer

Implementing a root cause analysis (RCA) program to identify systemic patterns across recurring incidents.. The most effective governance action is to implement a root cause analysis (RCA) program to identify systemic patterns across recurring incidents. This addresses the underlying causes rather than symptoms, preventing minor incidents from accumulating into a significant enterprise risk. Governance focuses on systemic improvement, not just operational fixes.

Answer

Updating the incident management policy to mandate shorter SLA targets.

Answer

Increasing the budget for incident response staff.

Answer

Requiring all incidents to be reported directly to the board of directors.

Question 2

A company is conducting a risk analysis. Which of the following is an example of an 'inherent risk'?

Accepted Answer

The risk that exists in the absence of any controls.. Inherent risk is defined as the level of risk that exists before any controls, mitigations, or countermeasures are applied. It represents the raw exposure of an asset or process to a given threat. Option A correctly captures this by describing risk 'in the absence of any controls.' This baseline is used in risk analysis to determine how much risk treatment is actually reducing exposure.

Answer

The risk remaining after all security patches are installed.

Answer

The risk that is accepted by the board of directors.

Answer

The risk that has been mitigated by insurance.

Question 3

When planning for the retirement of legacy systems, which factor is most critical for resource optimization?

Accepted Answer

Detailed mapping of interdependencies and data flows with current systems. When retiring legacy systems, the most critical factor for resource optimization is a detailed mapping of interdependencies and data flows between the legacy system and current systems. Without this map, retirement can break integrations, orphan data, or trigger unplanned remediation work that consumes more resources than the retirement saves. Understanding dependencies enables sequenced decommissioning and accurate resource forecasting.

Answer

The initial cost of implementing the system

Answer

The amount of documentation available for the system

Answer

The age of the hardware

Question 4

A telecommunications provider has completed a risk assessment for a new 5G network slicing service. The CGEIT practitioner must ensure the results are used to optimize risk. Which action best demonstrates that risk assessment outputs are driving resource allocation decisions?

Accepted Answer

Prioritizing security investment for the highest-rated slicing risks and adjusting the service launch plan to remediate them before go-live.. Risk optimization means assessment outputs change where money, time, and attention go. Prioritizing investment toward the highest-rated network slicing risks and making remediation a condition of launch converts analysis into concrete allocation and sequencing decisions. Archiving, counting, or equalizing budgets do not alter resource flows in response to risk severity, so they fail to demonstrate optimization.

Answer

Assigning every identified risk an equal remediation budget to avoid perceived favoritism among business units.

Answer

Presenting the total number of identified risks to the executive committee as a measure of assessment thoroughness.

Answer

Filing the assessment in the project repository so it is available for future audits.

Question 5

To effectively integrate risk management into enterprise governance, which THREE activities should be conducted?

Accepted Answer

Defining the enterprise risk appetite in quantitative or qualitative terms.. Option A is correct because defining the enterprise risk appetite in quantitative or qualitative terms establishes the boundaries and thresholds against which all risk decisions are made, which is foundational for embedding risk management into governance. Option B is correct because establishing clear accountability for risk ownership at the executive level ensures that risk decisions are tied to strategic objectives and that someone with authority is answerable for outcomes, a core governance principle. Option D is correct because integrating risk reporting into the existing enterprise performance management process embeds risk into the same metrics, reviews, and decision cycles used to steer the business, making risk management continuous rather than a separate exercise. Option C is not correct because standardizing the CMDB structure is an IT service management configuration task, not a governance-level risk management activity. Option E is not correct because outsourcing the primary data center to a tier-one cloud provider is a specific sourcing decision that may address some risks but does not itself integrate risk management into enterprise governance.

Answer

Standardizing the IT configuration management database (CMDB) structure.

Answer

Outsourcing the primary data center to a tier-one cloud provider.

Question 6

When implementing a resource governance policy, which action is most critical to success?

Accepted Answer

Securing executive sponsorship and driving organizational buy-in. Executive sponsorship and organizational buy-in are the most critical success factors because resource governance policies require authority to enforce trade-offs, resolve conflicts, and change behavior across silos. Without top-level sponsorship, even well-designed policies lack the mandate to be adopted and sustained.

Answer

Hiring a dedicated resource governance manager

Answer

Automating all policy enforcement mechanisms

Answer

Creating a 500-page policy document covering every scenario

Question 7

Which TWO of the following are considered key elements of a robust Benefits Realization Plan (BRP)?

Accepted Answer

Clear identification of benefits and their owners.. Option D is correct because a robust Benefits Realization Plan must explicitly identify each intended benefit and assign a named benefit owner who is accountable for its delivery and tracking, ensuring benefits are actively managed rather than assumed. Option E is correct because the BRP requires defined metrics with baseline performance measurements so that benefit delivery can be quantified and compared against the pre-project state, enabling objective realization tracking. Options A, B, and C do not belong: vendor licensing terms, a project team contact list, and technical architectural diagrams are project or solution artifacts that support delivery but do not constitute the benefit identification, ownership, measurement, and baselining elements that define a BRP.

Answer

Detailed software vendor licensing terms.

Answer

Project team contact list.

Answer

Technical architectural diagrams.

Question 8

An enterprise is facing significant shadow IT growth. What is the best governance action to optimize resources?

Accepted Answer

Implement a cloud access security broker (CASB) to provide secure, governed alternatives. Shadow IT grows because central IT is perceived as too slow or too restrictive, so business units procure their own cloud services. The best governance action is to implement a CASB that provides secure, governed alternatives — this addresses the root cause by giving business units a fast, compliant path to the services they want while restoring visibility and policy enforcement. A CASB brokers access, discovers unsanctioned cloud usage, and applies data protection controls, converting shadow IT into managed IT.

Answer

Audit all business units and penalize those using shadow IT

Answer

Restrict all unauthorized cloud service access via the firewall

Answer

Mandate that all IT needs be submitted via the central IT ticketing system

Question 9

Which of the following is an example of an 'indirect' benefit?

Accepted Answer

Improved employee morale and productivity due to better UI.. Improved employee morale and productivity due to a better UI is an indirect benefit because it is a secondary, often intangible outcome that flows from the system rather than being a directly measurable financial return. Indirect benefits are harder to quantify but still contribute to organizational value.

Answer

Increased revenue from new digital sales channels.

Answer

Decrease in server hardware acquisition costs.

Answer

Reduction in annual software maintenance costs.

Question 10

A global retailer's board has approved a risk appetite statement that permits a maximum acceptable annual loss from e-commerce fraud of $2 million. Six months into the fiscal year, the CISO reports cumulative fraud losses of $1.9 million, and the fraud team projects an additional $600,000 in losses before year-end if no action is taken. The CISO proposes deploying an AI-based fraud detection tool costing $400,000 annually. What should the CGEIT practitioner recommend FIRST?

Accepted Answer

Escalate the projected risk appetite breach to the board with a risk analysis and recommended response options.. A projected breach of the board-approved risk appetite triggers a governance obligation to escalate with a thorough risk analysis and response options. The board must decide whether to accept, mitigate, transfer, or avoid the risk. Approving a specific tool or adjusting the appetite without board involvement bypasses governance and could lead to misalignment with strategic objectives.

Answer

Instruct the fraud team to increase manual review of transactions to reduce losses below the threshold.

Answer

Approve the AI-based fraud detection tool because the projected losses exceed the risk appetite threshold.

Answer

Revise the risk appetite statement to allow a higher fraud loss limit so the enterprise remains within tolerance.

Question 11

A financial services firm is reviewing its IT resource management practices. The board has asked for assurance that IT resources are being used efficiently and effectively. Which activity BEST provides this assurance?

Accepted Answer

Conducting regular IT resource performance reviews against agreed-upon metrics and reporting results to the board.. Assurance requires objective measurement and reporting. Regular performance reviews against agreed metrics, with results reported to the board, create transparency and accountability. The other options either increase spending without evidence, shift responsibility without oversight, or decentralize control, none of which give the board confidence that resources are used efficiently and effectively.

Answer

Increasing the IT budget to ensure all resource requests can be fulfilled without delay.

Answer

Outsourcing all IT infrastructure management to a third-party provider with a fixed-price contract.

Answer

Allowing each business unit to procure its own IT resources to speed up project delivery.

Question 12

You are the CGEIT practitioner for a global logistics enterprise. During an IT governance committee meeting, the CIO presents a proposal to increase the IT risk appetite for cloud migration to accelerate time-to-market. The CFO objects, noting that the board has not approved a revised risk appetite statement. According to CGEIT governance principles, what should be the immediate next step?

Accepted Answer

Escalate the proposal to the board for approval of a revised IT risk appetite statement.. The board owns the enterprise risk appetite, so any change must be approved by the board. Escalating the proposal ensures proper governance and alignment with strategic goals. Other actions either bypass board authority or misplace decision rights. Maintaining board oversight is critical for effective risk optimization.

Answer

Allow the CIO to proceed since the CFO's objection is not a formal veto.

Answer

Conduct a risk assessment to quantify the impact of the increased appetite before any decision.

Answer

Refer the matter to the IT steering committee for a decision on risk tolerance.

Question 13

An organization is establishing a benefits realization framework. What is the primary purpose of defining key performance indicators (KPIs) at the start of an IT investment?

Accepted Answer

To provide a baseline for measuring the achievement of expected business outcomes.. KPIs defined at the start of an IT investment establish a baseline against which the achievement of expected business outcomes can be measured. They translate strategic objectives into quantifiable metrics, enabling ongoing monitoring and post-implementation evaluation. Without early KPIs, benefits realization becomes subjective and difficult to govern.

Answer

To ensure software development complies with vendor licensing requirements.

Answer

To automate the generation of project status reports for stakeholders.

Answer

To allocate budget for ongoing maintenance and support costs.

Question 14

A telecommunications company has a risk appetite that allows for moderate risk-taking to achieve innovation goals. The CGEIT practitioner is reviewing a proposal to adopt a new, unproven 5G technology for a critical network segment. The technology promises significant competitive advantage but has known stability issues. What is the MOST appropriate recommendation?

Accepted Answer

Recommend a phased implementation with enhanced monitoring and a rollback plan, treating the risk as acceptable within the innovation appetite.. Given a moderate risk appetite for innovation, the best recommendation is a phased implementation with enhanced monitoring and a rollback plan. This approach allows the company to pursue competitive advantage while managing stability risks within acceptable limits. It balances risk and reward, consistent with the board's stated tolerance for moderate risk-taking.

Answer

Recommend transferring the risk by outsourcing the network segment to a third party that specializes in 5G.

Answer

Approve full deployment immediately to gain first-mover advantage, accepting the stability risks as within appetite.

Answer

Reject the proposal because unproven technology poses unacceptable risk to critical infrastructure.

Question 15

An organization has decentralized its IT operations, leading to fragmented governance. Which action will best restore governance oversight while retaining operational agility?

Accepted Answer

Implement a federated governance structure with central policy oversight. A federated governance structure keeps central authority over policy, standards, and risk appetite while delegating day-to-day operational decisions to business units, which restores enterprise-wide oversight without sacrificing the agility that decentralization was meant to provide. This is the classic CGEIT answer for balancing control and responsiveness in a decentralized organization.

Answer

Mandate that all business units use the same IT software stack

Answer

Standardize all IT purchasing processes across the enterprise

Answer

Centralize all IT functions and reporting lines under the CIO

Question 16

A multinational corporation is expanding into a new market with significant regulatory uncertainty. The CGEIT practitioner is tasked with ensuring that the risk management process remains effective despite rapidly changing regulations. Which of the following approaches is MOST appropriate?

Accepted Answer

Establish a dynamic risk monitoring process that includes regulatory horizon scanning and triggers for reassessment.. In a rapidly changing regulatory environment, a dynamic risk monitoring process with horizon scanning and reassessment triggers is most appropriate. It enables early detection of changes and timely risk response, keeping the risk management process effective and aligned with governance objectives. Static or passive approaches fail to address the velocity of regulatory change.

Answer

Transfer all regulatory compliance risks to a third-party legal firm through contractual agreements.

Answer

Adopt a wait-and-see approach until regulations are finalized to avoid unnecessary risk mitigation costs.

Answer

Conduct a one-time comprehensive risk assessment before market entry and update it annually.

Question 17

A multinational corporation is standardizing its IT asset management practices. The CIO wants to ensure that all hardware and software assets are tracked, maintained, and disposed of in accordance with legal and regulatory requirements. Which governance mechanism should be established to achieve this?

Accepted Answer

A formal IT asset management policy that defines roles, responsibilities, and procedures for the entire asset lifecycle.. Establishing a formal IT asset management policy is the correct governance mechanism. It sets the rules, assigns responsibilities, and defines the lifecycle processes to ensure all assets are handled in compliance with legal and regulatory requirements. Tools and audits support the policy but do not replace it as the primary governance instrument.

Answer

A configuration management database (CMDB) that records all IT assets and their relationships.

Answer

An automated discovery tool that scans the network for connected devices and software.

Answer

A yearly internal audit of IT asset records conducted by the finance department.

Question 18

Which stakeholder should provide the final approval for the IT governance policy?

Accepted Answer

The Board of Directors.. The Board of Directors holds ultimate accountability for IT governance because it represents shareholder interests and is responsible for overseeing all enterprise resources, including IT. Governance policies establish the decision rights and accountability framework, so final approval must rest with the highest governing authority rather than operational or technology-specific roles. This aligns with COBIT's principle that governance is a board-level responsibility, distinct from management.

Answer

The IT Steering Committee.

Answer

The Chief Technology Officer (CTO).

Answer

The Chief Information Security Officer (CISO).

Question 19

What is the primary objective of a 'Benefits Management Plan'?

Accepted Answer

To define the responsibilities, metrics, and timeline for achieving expected benefits.. A Benefits Management Plan defines how expected benefits from an investment will be realized, measured, and owned over time. It specifies benefit owners, success metrics, baselines, and the timeline for realization, ensuring benefits are actively managed rather than assumed. This distinguishes it from project plans that focus on deliverables and schedules.

Answer

To list the server hardware requirements.

Answer

To secure the budget from the finance team.

Answer

To document the project schedule.

Question 20

A company is planning a digital transformation. What governance action is necessary to ensure the transformation supports business strategy?

Accepted Answer

Establish a governance structure that includes business unit leaders in transformation decision-making. Digital transformation succeeds only when business strategy drives technology decisions, so the necessary governance action is to establish a governance structure that includes business unit leaders in transformation decision-making (B). This ensures the transformation is aligned to business outcomes, not driven solely by IT or by vendor offerings. Governance structures with cross-functional representation provide the oversight and prioritization mechanism that keeps transformation efforts tied to strategic objectives.

Answer

Outsource the entire transformation to an external systems integrator

Answer

Focus primarily on reducing IT costs to fund the project

Answer

Select the latest cloud-based ERP software before defining business requirements