CGEIT Practice Test 8 — 10 Questions

Question 1

A multinational corporation is struggling with IT strategic alignment. The board wants to ensure IT investments directly correlate to business value. Which metric should the governance committee prioritize?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Percentage of IT initiatives that directly contribute to documented business strategy goals.. The board's concern is strategic alignment — ensuring IT investments directly correlate to business value. The metric that most directly measures this is the percentage of IT initiatives that contribute to documented business strategy goals. This metric ties IT portfolio composition to strategic intent, which is the essence of alignment. Other metrics measure efficiency or operational performance but not alignment itself.

Answer

Total cost of ownership (TCO) of IT assets.

Answer

System uptime and availability percentages.

Answer

IT project delivery on time and within budget.

Question 2

Which THREE metrics are commonly used to measure the success of an IT investment?

Accepted Answer

Customer satisfaction or Net Promoter Score (NPS).. Customer satisfaction or Net Promoter Score (NPS) (B) is a standard success metric because it captures the perceived value and user adoption of the IT investment, which ultimately drives retention and business outcomes. Return on Investment (ROI) (C) is correct because it directly compares the financial gains from the investment against its costs, expressing profitability as a percentage. Net Present Value (NPV) (D) is also correct because it discounts future cash flows to present value, showing whether the investment adds economic value after accounting for the time value of money. In contrast, total cost of software development (A) is only an input cost, not a measure of success, and the number of hours the development team worked (E) is an effort or productivity input rather than an outcome-based success metric.

Answer

Total cost of software development.

Answer

The number of hours the development team worked.

Question 3

Which document outlines the authority and responsibilities of the IT governance committee?

Accepted Answer

The committee charter.. The committee charter is the formal document that establishes the IT governance committee, defines its purpose, and explicitly outlines its authority, responsibilities, and scope of decision-making. It serves as the foundational governance instrument that empowers the committee to act on behalf of the board or executive management. Without a charter, the committee lacks formal standing and its mandate may be unclear or contested.

Answer

The annual financial report.

Answer

The IT project plan.

Answer

The employee handbook.

Question 4

Which role is typically responsible for the final acceptance of IT risks at the enterprise level?

Accepted Answer

The Chief Information Officer (CIO) or the Board.. Final acceptance of enterprise-level IT risk is a governance responsibility that rests with executive leadership and the board, typically represented by the CIO or the board itself, because they have the authority to commit resources and accept consequences on behalf of the organization. Risk acceptance at the enterprise level cannot be delegated to operational or technical roles. This aligns with COBIT's principle that risk appetite and tolerance are set and owned at the governance layer.

Answer

The Network Engineer.

Answer

The external auditor.

Answer

The IT Security Manager.

Question 5

An organization is considering a 'cloud-first' policy. What should be the primary governance focus when allocating resources?

Accepted Answer

Establishing a cloud center of excellence (CCoE) to govern adoption and best practices. When adopting a cloud-first policy, the primary governance focus should be establishing a cloud center of excellence (CCoE) to govern adoption, define best practices, and ensure consistent decision-making across the organization. A CCoE provides the guardrails, standards, and expertise needed to allocate resources effectively while managing risk, cost, and compliance across cloud initiatives.

Answer

Selecting the cloud vendor with the lowest price

Answer

Training all IT staff on a single cloud platform

Answer

Mandating the migration of all legacy systems regardless of suitability

Question 6

Which THREE of the following represent effective ways to integrate IT risk into the organizational culture?

Accepted Answer

Regular risk management training for all staff.. Option A is correct because regular risk management training for all staff builds awareness and embeds risk thinking into daily decision-making, which is a core mechanism for shaping organizational culture. Option C is correct because linking performance bonuses to risk management outcomes aligns individual incentives with risk-aware behavior, reinforcing the desired culture through measurable accountability. Option D is correct because executive sponsorship of risk management initiatives signals top-down commitment, sets the tone at the top, and legitimizes risk management as a shared organizational value. Options B and E do not belong: changing the corporate logo is a cosmetic branding action with no bearing on risk culture, and reducing IT staff is a headcount decision that neither integrates risk into culture nor necessarily improves risk management.

Answer

Changing the corporate logo.

Answer

Reducing the number of IT staff.

Question 7

What is the relationship between 'IT Risk' and 'Enterprise Risk'?

Accepted Answer

IT risk is a subset of enterprise risk and must be managed together.. IT risk is a subset of enterprise risk because technology-related threats and opportunities are one category within the broader set of risks that affect the entire organization. Managing them together ensures that IT risk is assessed in the context of business objectives, risk appetite, and overall enterprise risk posture rather than in isolation.

Answer

They are exactly the same thing.

Answer

Enterprise risk is a subset of IT risk.

Answer

IT risk is entirely separate from enterprise risk.

Question 8

What is the most effective way to ensure that IT risk management is integrated with enterprise risk management (ERM)?

Accepted Answer

Aligning the IT risk taxonomy and reporting thresholds with the corporate ERM framework.. Aligning the IT risk taxonomy and reporting thresholds with the corporate ERM framework ensures that IT risks are expressed in the same language, measured on the same scales, and escalated using the same criteria as other enterprise risks. This integration allows the board and executive management to view IT risk alongside financial, operational, and strategic risks, enabling consistent prioritization and decision-making. It is the most effective way to embed IT risk into ERM without disrupting organizational structures.

Answer

Moving the IT risk management function under the responsibility of the Chief Financial Officer.

Answer

Requiring IT to report risks directly to the Chief Risk Officer on a weekly basis.

Answer

Mandating that IT uses the same risk assessment software as the finance department.

Question 9

Which THREE of the following are elements of a strong IT resource governance policy?

Accepted Answer

Defined KPIs and metrics to measure the effectiveness of resource usage. Option C is correct because a strong IT resource governance policy must include defined KPIs and metrics, such as utilization rates, cost-per-workload, or service availability targets, so that resource usage can be objectively measured, reported, and continuously improved. Option D is correct because standardized processes for requesting, approving, and allocating resources establish a repeatable, auditable workflow that prevents ad hoc provisioning, enforces budget and capacity controls, and ensures resources are assigned consistently across the organization. Option E is correct because clearly defined roles, responsibilities, and decision-making authorities (for example, distinguishing resource owners, approvers, and accountable executives via a RACI model) ensure accountability and prevent gaps or conflicts in governance. Option A does not belong because individual employee salaries are confidential HR/payroll data, not a governance element, and including them would create privacy and compliance risks. Option B does not belong because listing vendor passwords is a serious security anti-pattern; credentials must be managed through a secrets vault or privileged access management system, never documented in a policy.

Answer

A list of all individual employee salaries

Answer

A list of all vendor passwords

Question 10

Why should IT projects include a 'disbenefit' analysis in their business case?

Accepted Answer

To provide a transparent and realistic view of the project's impact.. A disbenefit analysis documents the negative consequences a project may create — cost overruns, productivity dips during transition, regulatory exposure, or cannibalised revenue — so decision-makers see a balanced, realistic picture rather than a one-sided optimistic case. This transparency supports sound investment decisions and realistic benefit forecasting. Option C captures that purpose.

Answer

To increase the project budget.

Answer

To reduce the amount of documentation required.

Answer

To satisfy the software vendor's requirements.