CGEIT Practice Test 7 — 10 Questions

Question 1

A financial services firm is reviewing its IT resource management practices. The board has asked for assurance that IT resources are being used efficiently and effectively. Which activity BEST provides this assurance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conducting regular IT resource performance reviews against agreed-upon metrics and reporting results to the board.. Assurance requires objective measurement and reporting. Regular performance reviews against agreed metrics, with results reported to the board, create transparency and accountability. The other options either increase spending without evidence, shift responsibility without oversight, or decentralize control, none of which give the board confidence that resources are used efficiently and effectively.

Answer

Increasing the IT budget to ensure all resource requests can be fulfilled without delay.

Answer

Outsourcing all IT infrastructure management to a third-party provider with a fixed-price contract.

Answer

Allowing each business unit to procure its own IT resources to speed up project delivery.

Question 2

You are the CGEIT practitioner for a global logistics enterprise. During an IT governance committee meeting, the CIO presents a proposal to increase the IT risk appetite for cloud migration to accelerate time-to-market. The CFO objects, noting that the board has not approved a revised risk appetite statement. According to CGEIT governance principles, what should be the immediate next step?

Accepted Answer

Escalate the proposal to the board for approval of a revised IT risk appetite statement.. The board owns the enterprise risk appetite, so any change must be approved by the board. Escalating the proposal ensures proper governance and alignment with strategic goals. Other actions either bypass board authority or misplace decision rights. Maintaining board oversight is critical for effective risk optimization.

Answer

Allow the CIO to proceed since the CFO's objection is not a formal veto.

Answer

Conduct a risk assessment to quantify the impact of the increased appetite before any decision.

Answer

Refer the matter to the IT steering committee for a decision on risk tolerance.

Question 3

An organization is establishing a benefits realization framework. What is the primary purpose of defining key performance indicators (KPIs) at the start of an IT investment?

Accepted Answer

To provide a baseline for measuring the achievement of expected business outcomes.. KPIs defined at the start of an IT investment establish a baseline against which the achievement of expected business outcomes can be measured. They translate strategic objectives into quantifiable metrics, enabling ongoing monitoring and post-implementation evaluation. Without early KPIs, benefits realization becomes subjective and difficult to govern.

Answer

To ensure software development complies with vendor licensing requirements.

Answer

To automate the generation of project status reports for stakeholders.

Answer

To allocate budget for ongoing maintenance and support costs.

Question 4

A telecommunications company has a risk appetite that allows for moderate risk-taking to achieve innovation goals. The CGEIT practitioner is reviewing a proposal to adopt a new, unproven 5G technology for a critical network segment. The technology promises significant competitive advantage but has known stability issues. What is the MOST appropriate recommendation?

Accepted Answer

Recommend a phased implementation with enhanced monitoring and a rollback plan, treating the risk as acceptable within the innovation appetite.. Given a moderate risk appetite for innovation, the best recommendation is a phased implementation with enhanced monitoring and a rollback plan. This approach allows the company to pursue competitive advantage while managing stability risks within acceptable limits. It balances risk and reward, consistent with the board's stated tolerance for moderate risk-taking.

Answer

Recommend transferring the risk by outsourcing the network segment to a third party that specializes in 5G.

Answer

Approve full deployment immediately to gain first-mover advantage, accepting the stability risks as within appetite.

Answer

Reject the proposal because unproven technology poses unacceptable risk to critical infrastructure.

Question 5

An organization has decentralized its IT operations, leading to fragmented governance. Which action will best restore governance oversight while retaining operational agility?

Accepted Answer

Implement a federated governance structure with central policy oversight. A federated governance structure keeps central authority over policy, standards, and risk appetite while delegating day-to-day operational decisions to business units, which restores enterprise-wide oversight without sacrificing the agility that decentralization was meant to provide. This is the classic CGEIT answer for balancing control and responsiveness in a decentralized organization.

Answer

Mandate that all business units use the same IT software stack

Answer

Standardize all IT purchasing processes across the enterprise

Answer

Centralize all IT functions and reporting lines under the CIO

Question 6

A multinational corporation is expanding into a new market with significant regulatory uncertainty. The CGEIT practitioner is tasked with ensuring that the risk management process remains effective despite rapidly changing regulations. Which of the following approaches is MOST appropriate?

Accepted Answer

Establish a dynamic risk monitoring process that includes regulatory horizon scanning and triggers for reassessment.. In a rapidly changing regulatory environment, a dynamic risk monitoring process with horizon scanning and reassessment triggers is most appropriate. It enables early detection of changes and timely risk response, keeping the risk management process effective and aligned with governance objectives. Static or passive approaches fail to address the velocity of regulatory change.

Answer

Transfer all regulatory compliance risks to a third-party legal firm through contractual agreements.

Answer

Adopt a wait-and-see approach until regulations are finalized to avoid unnecessary risk mitigation costs.

Answer

Conduct a one-time comprehensive risk assessment before market entry and update it annually.

Question 7

A multinational corporation is standardizing its IT asset management practices. The CIO wants to ensure that all hardware and software assets are tracked, maintained, and disposed of in accordance with legal and regulatory requirements. Which governance mechanism should be established to achieve this?

Accepted Answer

A formal IT asset management policy that defines roles, responsibilities, and procedures for the entire asset lifecycle.. Establishing a formal IT asset management policy is the correct governance mechanism. It sets the rules, assigns responsibilities, and defines the lifecycle processes to ensure all assets are handled in compliance with legal and regulatory requirements. Tools and audits support the policy but do not replace it as the primary governance instrument.

Answer

A configuration management database (CMDB) that records all IT assets and their relationships.

Answer

An automated discovery tool that scans the network for connected devices and software.

Answer

A yearly internal audit of IT asset records conducted by the finance department.

Question 8

Which stakeholder should provide the final approval for the IT governance policy?

Accepted Answer

The Board of Directors.. The Board of Directors holds ultimate accountability for IT governance because it represents shareholder interests and is responsible for overseeing all enterprise resources, including IT. Governance policies establish the decision rights and accountability framework, so final approval must rest with the highest governing authority rather than operational or technology-specific roles. This aligns with COBIT's principle that governance is a board-level responsibility, distinct from management.

Answer

The IT Steering Committee.

Answer

The Chief Technology Officer (CTO).

Answer

The Chief Information Security Officer (CISO).

Question 9

What is the primary objective of a 'Benefits Management Plan'?

Accepted Answer

To define the responsibilities, metrics, and timeline for achieving expected benefits.. A Benefits Management Plan defines how expected benefits from an investment will be realized, measured, and owned over time. It specifies benefit owners, success metrics, baselines, and the timeline for realization, ensuring benefits are actively managed rather than assumed. This distinguishes it from project plans that focus on deliverables and schedules.

Answer

To list the server hardware requirements.

Answer

To secure the budget from the finance team.

Answer

To document the project schedule.

Question 10

A company is planning a digital transformation. What governance action is necessary to ensure the transformation supports business strategy?

Accepted Answer

Establish a governance structure that includes business unit leaders in transformation decision-making. Digital transformation succeeds only when business strategy drives technology decisions, so the necessary governance action is to establish a governance structure that includes business unit leaders in transformation decision-making (B). This ensures the transformation is aligned to business outcomes, not driven solely by IT or by vendor offerings. Governance structures with cross-functional representation provide the oversight and prioritization mechanism that keeps transformation efforts tied to strategic objectives.

Answer

Outsource the entire transformation to an external systems integrator

Answer

Focus primarily on reducing IT costs to fund the project

Answer

Select the latest cloud-based ERP software before defining business requirements