CGEIT Practice Test 9 — 10 Questions

Question 1

What is the primary purpose of a Post-Implementation Review (PIR) in the context of benefits realization?

Accepted Answer

To verify if the expected benefits have been achieved and identify lessons learned.. The primary purpose of a Post-Implementation Review (PIR) in benefits realization is to verify whether the expected benefits have been achieved and to identify lessons learned for future projects. It compares actual outcomes against the business case and benefits realization plan, providing accountability and continuous improvement. This review is typically conducted after the project has been operational for a period, allowing benefits to materialize.

Answer

To ensure the system meets all security standards.

Answer

To finalize the payment for external contractors.

Answer

To evaluate the performance of the project manager.

Question 2

Which THREE of the following are essential elements of an IT risk governance policy?

Accepted Answer

Procedures for reporting and escalating risks. Option A is correct because an IT risk governance policy must define how risks are reported and escalated through the organization, ensuring timely visibility to appropriate management levels and enabling consistent response. Option C is correct because the policy must establish the enterprise's risk appetite and tolerance levels, which set the boundaries for acceptable risk and guide decision-making on risk treatment. Option E is correct because clear roles and responsibilities for risk ownership are essential to assign accountability for identifying, assessing, and managing risks across the organization. Option B is not correct because the physical location of backup tapes is an operational or asset-management detail, not a governance policy element. Option D is not correct because a list of software vendors is an inventory artifact rather than a governance principle.

Answer

The physical location of all backup tapes

Answer

A list of all software vendors currently in use

Question 3

A large multinational corporation is transitioning to COBIT 2019. The governance board needs to prioritize governance objectives. Which action should the IT governance lead take first?

Accepted Answer

Conduct a design factors assessment.. COBIT 2019 requires the governance system to be tailored to the enterprise's context, and that tailoring begins with a design factors assessment. Design factors (enterprise strategy, goals, risk profile, IT-related issues, threat landscape, compliance requirements, role of IT, sourcing model, IT adoption strategy, enterprise size, and technology adoption) determine which of the 40 governance and management objectives are relevant and how they should be prioritized. Only after this assessment can the governance board meaningfully prioritize objectives.

Answer

Implement the IT Balanced Scorecard.

Answer

Adopt all 40 governance objectives immediately.

Answer

Draft new board-level IT policies.

Question 4

Which THREE of the following are key aspects of workforce planning in IT?

Accepted Answer

Implementing retention strategies for key talent. Workforce planning in IT focuses on ensuring the organization has the right skills, in the right roles, at the right time, so option A (implementing retention strategies for key talent) is correct because keeping scarce, high-value IT skills such as cloud architects or cybersecurity specialists reduces knowledge loss, recruitment cost, and project risk. Option B (developing training and professional development programs) is correct because closing skill gaps through upskilling and reskilling in areas like DevOps, data analytics, or AI directly addresses forecasted competency shortages. Option D (identifying current and future competency requirements) is correct because it is the foundational step of workforce planning: comparing the existing skills inventory against projected demand from business and technology roadmaps. Option C (selecting the IT department's holiday party venue) is incorrect because it is an event-planning or facilities task with no bearing on staffing supply, demand, or skills. Option E (mandatory office attendance policies) is incorrect because it is a workplace-arrangement or HR policy decision, not a workforce planning activity concerned with competency supply and demand.

Answer

Selecting the IT department's holiday party venue

Answer

Mandatory office attendance policies

Question 5

Which TWO of the following are effective strategies for optimizing workforce resources?

Accepted Answer

Using a flexible resource model for non-core, variable IT activities. Option B is correct because a flexible resource model (e.g., leveraging contractors, managed service providers, or on-demand staffing) lets an organization scale capacity up or down for non-core, variable IT activities, avoiding the cost of idle full-time employees while maintaining service levels. Option E is correct because cross-training builds a broader skill base, enabling staff to cover multiple roles, improving utilization, reducing single points of failure, and increasing scheduling flexibility without adding headcount. Option A is not a workforce optimization strategy; reducing performance reviews weakens feedback, development, and accountability rather than improving resource efficiency. Option C is incorrect because mandating five days in the office removes flexibility and can reduce retention and productivity, and it does not optimize resource allocation. Option D is incorrect because adding management layers increases overhead, slows decision-making, and consumes resources rather than optimizing them.

Answer

Reducing the frequency of staff performance reviews

Answer

Requiring all staff to work in the office five days a week

Answer

Increasing the number of layers in the management hierarchy

Question 6

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

To serve as an early warning signal of potential risk events.. A Key Risk Indicator is a forward-looking metric designed to signal rising risk exposure before an event occurs, enabling proactive management. Its purpose is early warning — tracking conditions that precede risk events so governance can intervene. The other options describe training compliance, operational logs, or backward-looking performance measurement, none of which is the primary purpose of a KRI.

Answer

To ensure that all employees have completed security awareness training.

Answer

To provide a detailed log of all security threats blocked by the firewall.

Answer

To measure the success of past risk mitigation strategies.

Question 7

A firm is experiencing 'IT resource starvation' in key strategic projects due to excessive operational support requirements. What is the appropriate governance response?

Accepted Answer

Conduct a portfolio review to rebalance resource allocation from 'keep-the-lights-on' activities to strategic initiatives. IT resource starvation in strategic projects caused by operational overload is a portfolio governance problem, not a staffing or budgeting problem. The appropriate response is a portfolio review to rebalance investment and resource allocation — reducing 'keep-the-lights-on' operational spend and redirecting capacity to strategic initiatives aligned with business objectives. This is a core CGEIT governance responsibility: ensuring IT resources are optimized against enterprise strategy.

Answer

Force strategic projects to operate with lower performance requirements

Answer

Require all IT staff to work overtime to complete projects

Answer

Increase the overall IT budget to hire more staff

Question 8

What is the most effective way to communicate benefit realization status to stakeholders?

Accepted Answer

Use a visual dashboard that maps metrics to business objectives.. A visual dashboard that maps metrics directly to business objectives gives stakeholders continuous, role-relevant visibility into whether benefits are being realized. It translates technical and financial data into business language, enabling timely intervention when metrics drift from targets. This aligns with CGEIT's emphasis on value delivery and stakeholder communication.

Answer

Hold a meeting only when the project fails.

Answer

Wait until the project is finished to report anything.

Answer

Send a 50-page technical document every month.

Question 9

An enterprise is adopting a 'Benefits-led' approach to IT governance. Which artifact is the most critical for documenting the causal link between IT-enabled outcomes and organizational strategy?

Accepted Answer

The Benefits Dependency Map (BDM).. A Benefits Dependency Map (BDM) is the artifact specifically designed to document the causal chain from IT enablers through business changes to business benefits and strategic objectives. It visually links each IT-enabled outcome to the organizational strategy it supports, making it the most critical document in a benefits-led governance approach.

Answer

The Project Charter.

Answer

The Balanced Scorecard (BSC).

Answer

The IT Strategy document.

Question 10

Which TWO are common IT governance structures?

Accepted Answer

Architecture Review Board. An Architecture Review Board (A) is a recognized IT governance structure because it provides formal oversight and decision-making authority over architecture standards, technology choices, and design compliance across projects. An IT Steering Committee (E) is also a standard governance body, typically composed of senior business and IT leaders who prioritize IT investments, align IT strategy with business goals, and approve major initiatives. The Coffee and Donut Club (B) is a social group with no governance authority, decision rights, or accountability for IT outcomes. A Software testing team (C) is an operational delivery function focused on quality assurance, not on setting or enforcing governance policy. Help desk support (D) is a service management/operations function that resolves user incidents, not a governance structure that directs IT strategy or standards.

Answer

Coffee and Donut Club

Answer

Software testing team

Answer

Help desk support