CGEIT Practice Test 6 — 10 Questions

Question 1

An organization experiences a high frequency of minor IT incidents. What is the most effective governance action to ensure this does not result in a significant enterprise risk?

Accepted Answer

Implementing a root cause analysis (RCA) program to identify systemic patterns across recurring incidents.. The most effective governance action is to implement a root cause analysis (RCA) program to identify systemic patterns across recurring incidents. This addresses the underlying causes rather than symptoms, preventing minor incidents from accumulating into a significant enterprise risk. Governance focuses on systemic improvement, not just operational fixes.

Answer

Updating the incident management policy to mandate shorter SLA targets.

Answer

Increasing the budget for incident response staff.

Answer

Requiring all incidents to be reported directly to the board of directors.

Question 2

A company is conducting a risk analysis. Which of the following is an example of an 'inherent risk'?

Accepted Answer

The risk that exists in the absence of any controls.. Inherent risk is defined as the level of risk that exists before any controls, mitigations, or countermeasures are applied. It represents the raw exposure of an asset or process to a given threat. Option A correctly captures this by describing risk 'in the absence of any controls.' This baseline is used in risk analysis to determine how much risk treatment is actually reducing exposure.

Answer

The risk remaining after all security patches are installed.

Answer

The risk that is accepted by the board of directors.

Answer

The risk that has been mitigated by insurance.

Question 3

When planning for the retirement of legacy systems, which factor is most critical for resource optimization?

Accepted Answer

Detailed mapping of interdependencies and data flows with current systems. When retiring legacy systems, the most critical factor for resource optimization is a detailed mapping of interdependencies and data flows between the legacy system and current systems. Without this map, retirement can break integrations, orphan data, or trigger unplanned remediation work that consumes more resources than the retirement saves. Understanding dependencies enables sequenced decommissioning and accurate resource forecasting.

Answer

The initial cost of implementing the system

Answer

The amount of documentation available for the system

Answer

The age of the hardware

Question 4

A telecommunications provider has completed a risk assessment for a new 5G network slicing service. The CGEIT practitioner must ensure the results are used to optimize risk. Which action best demonstrates that risk assessment outputs are driving resource allocation decisions?

Accepted Answer

Prioritizing security investment for the highest-rated slicing risks and adjusting the service launch plan to remediate them before go-live.. Risk optimization means assessment outputs change where money, time, and attention go. Prioritizing investment toward the highest-rated network slicing risks and making remediation a condition of launch converts analysis into concrete allocation and sequencing decisions. Archiving, counting, or equalizing budgets do not alter resource flows in response to risk severity, so they fail to demonstrate optimization.

Answer

Assigning every identified risk an equal remediation budget to avoid perceived favoritism among business units.

Answer

Presenting the total number of identified risks to the executive committee as a measure of assessment thoroughness.

Answer

Filing the assessment in the project repository so it is available for future audits.

Question 5

To effectively integrate risk management into enterprise governance, which THREE activities should be conducted?

Accepted Answer

Defining the enterprise risk appetite in quantitative or qualitative terms.. Option A is correct because defining the enterprise risk appetite in quantitative or qualitative terms establishes the boundaries and thresholds against which all risk decisions are made, which is foundational for embedding risk management into governance. Option B is correct because establishing clear accountability for risk ownership at the executive level ensures that risk decisions are tied to strategic objectives and that someone with authority is answerable for outcomes, a core governance principle. Option D is correct because integrating risk reporting into the existing enterprise performance management process embeds risk into the same metrics, reviews, and decision cycles used to steer the business, making risk management continuous rather than a separate exercise. Option C is not correct because standardizing the CMDB structure is an IT service management configuration task, not a governance-level risk management activity. Option E is not correct because outsourcing the primary data center to a tier-one cloud provider is a specific sourcing decision that may address some risks but does not itself integrate risk management into enterprise governance.

Answer

Standardizing the IT configuration management database (CMDB) structure.

Answer

Outsourcing the primary data center to a tier-one cloud provider.

Question 6

When implementing a resource governance policy, which action is most critical to success?

Accepted Answer

Securing executive sponsorship and driving organizational buy-in. Executive sponsorship and organizational buy-in are the most critical success factors because resource governance policies require authority to enforce trade-offs, resolve conflicts, and change behavior across silos. Without top-level sponsorship, even well-designed policies lack the mandate to be adopted and sustained.

Answer

Hiring a dedicated resource governance manager

Answer

Automating all policy enforcement mechanisms

Answer

Creating a 500-page policy document covering every scenario

Question 7

Which TWO of the following are considered key elements of a robust Benefits Realization Plan (BRP)?

Accepted Answer

Clear identification of benefits and their owners.. Option D is correct because a robust Benefits Realization Plan must explicitly identify each intended benefit and assign a named benefit owner who is accountable for its delivery and tracking, ensuring benefits are actively managed rather than assumed. Option E is correct because the BRP requires defined metrics with baseline performance measurements so that benefit delivery can be quantified and compared against the pre-project state, enabling objective realization tracking. Options A, B, and C do not belong: vendor licensing terms, a project team contact list, and technical architectural diagrams are project or solution artifacts that support delivery but do not constitute the benefit identification, ownership, measurement, and baselining elements that define a BRP.

Answer

Detailed software vendor licensing terms.

Answer

Project team contact list.

Answer

Technical architectural diagrams.

Question 8

An enterprise is facing significant shadow IT growth. What is the best governance action to optimize resources?

Accepted Answer

Implement a cloud access security broker (CASB) to provide secure, governed alternatives. Shadow IT grows because central IT is perceived as too slow or too restrictive, so business units procure their own cloud services. The best governance action is to implement a CASB that provides secure, governed alternatives — this addresses the root cause by giving business units a fast, compliant path to the services they want while restoring visibility and policy enforcement. A CASB brokers access, discovers unsanctioned cloud usage, and applies data protection controls, converting shadow IT into managed IT.

Answer

Audit all business units and penalize those using shadow IT

Answer

Restrict all unauthorized cloud service access via the firewall

Answer

Mandate that all IT needs be submitted via the central IT ticketing system

Question 9

Which of the following is an example of an 'indirect' benefit?

Accepted Answer

Improved employee morale and productivity due to better UI.. Improved employee morale and productivity due to a better UI is an indirect benefit because it is a secondary, often intangible outcome that flows from the system rather than being a directly measurable financial return. Indirect benefits are harder to quantify but still contribute to organizational value.

Answer

Increased revenue from new digital sales channels.

Answer

Decrease in server hardware acquisition costs.

Answer

Reduction in annual software maintenance costs.

Question 10

A global retailer's board has approved a risk appetite statement that permits a maximum acceptable annual loss from e-commerce fraud of $2 million. Six months into the fiscal year, the CISO reports cumulative fraud losses of $1.9 million, and the fraud team projects an additional $600,000 in losses before year-end if no action is taken. The CISO proposes deploying an AI-based fraud detection tool costing $400,000 annually. What should the CGEIT practitioner recommend FIRST?

Accepted Answer

Escalate the projected risk appetite breach to the board with a risk analysis and recommended response options.. A projected breach of the board-approved risk appetite triggers a governance obligation to escalate with a thorough risk analysis and response options. The board must decide whether to accept, mitigate, transfer, or avoid the risk. Approving a specific tool or adjusting the appetite without board involvement bypasses governance and could lead to misalignment with strategic objectives.

Answer

Instruct the fraud team to increase manual review of transactions to reduce losses below the threshold.

Answer

Approve the AI-based fraud detection tool because the projected losses exceed the risk appetite threshold.

Answer

Revise the risk appetite statement to allow a higher fraud loss limit so the enterprise remains within tolerance.