CGEIT Governance OF Enterprise IT — 30 Questions

Question 1

An organization is failing to achieve the expected ROI on IT investments. Which governance mechanism is most likely missing?

Accepted Answer

An IT Steering Committee focused on value realization.. An IT Steering Committee focused on value realization is the governance mechanism that bridges IT investment decisions and business outcomes, ensuring each investment is tracked against expected benefits. Without this oversight body, investments proceed without accountability for ROI, which is exactly the symptom described. COBIT's EDM (Evaluate, Direct, Monitor) domain and the APO06 (Manage Budget and Costs) / BAI02 (Manage Requirements Definition) practices place value-realization accountability with such a committee.

Answer

Regular penetration testing.

Answer

A robust incident management process.

Answer

Standardized server configurations.

Question 2

Which TWO roles are typically involved in the IT Steering Committee?

Accepted Answer

Chief Information Officer (CIO). The Chief Information Officer (CIO) is correct because the CIO is the senior executive responsible for the organization's IT strategy, governance, and alignment of technology investments with business objectives, making them a core member of the IT Steering Committee. The Chief Financial Officer (CFO) is also correct because the committee typically requires financial oversight to approve IT budgets, funding, and cost-benefit decisions for major IT initiatives, so the CFO's participation is standard. Security Support Staff do not belong because they are operational/technical personnel who report into governance rather than set strategic direction. External Custodial Services are facilities vendors with no role in IT governance. Junior Software Developers are hands-on implementation staff and are far too junior to sit on a strategic steering committee.

Answer

Security Support Staff

Answer

External Custodial Services

Answer

Junior Software Developer

Question 3

Which THREE factors should be considered when tailoring a COBIT 2019 governance system?

Accepted Answer

Adoption strategy. In COBIT 2019, governance systems are tailored using a set of design factors, and the three correct options here are all recognized design factors. A, Adoption strategy, is a design factor because how the enterprise chooses to adopt and roll out the governance system (for example, a phased, big-bang, or incremental approach) directly shapes the tailoring of the framework. B, Enterprise size, is a design factor since the scale, complexity, and resources of the organization determine how much of COBIT is applied and at what level of formality. E, Threat landscape, is a design factor because the risk environment and the types of threats the enterprise faces influence the focus and rigor of governance and management objectives. The unmarked options C (office paint color) and D (employee cafeteria menu) are irrelevant environmental or facility details that have no bearing on governance system design or tailoring.

Answer

Office paint color

Answer

Employee cafeteria menu

Question 4

Which THREE principles are central to COBIT 2019 governance?

Accepted Answer

Dynamic governance system. In COBIT 2019, the governance system is built on several design and principles, three of which are reflected here. Option B (Dynamic governance system) is correct because COBIT 2019 explicitly lists a dynamic governance system as one of its governance system principles, meaning the governance framework must adapt to changes in the enterprise's strategy, technology, and risk environment. Option D (Meeting stakeholder needs) is correct because COBIT 2019's governance principles begin with providing stakeholder value, which requires identifying and balancing stakeholder needs as the foundation for governance objectives. Option E (Holistic approach) is correct because COBIT 2019 uses a holistic approach, integrating governance components such as processes, organizational structures, culture, information, services, and people across the whole enterprise. Option A (Maximizing individual developer freedom) is not a COBIT 2019 governance principle, as COBIT emphasizes enterprise-wide alignment and control rather than unrestrained individual autonomy. Option C (Outsourcing everything) is also incorrect because COBIT 2019 does not prescribe wholesale outsourcing; it addresses sourcing decisions as part of governance and management of IT resources, not as a central principle.

Answer

Maximizing individual developer freedom

Answer

Outsourcing everything

Question 5

Which THREE of the following are primary domains of IT governance according to standard frameworks?

Accepted Answer

Risk management. According to standard IT governance frameworks such as COBIT and the IT Governance Institute's five domains, Risk management (A) is a primary domain because governance must ensure that enterprise IT risks are identified, assessed, mitigated, and monitored within the organization's risk appetite. Value delivery (B) is also a primary domain, as governance must ensure that IT investments deliver promised benefits against agreed strategy and objectives. Strategic alignment (D) is a primary domain because governance must link IT plans, investments, and priorities directly to enterprise business strategy and goals. The other options do not belong: Hardware procurement automation (C) is a tactical operational process, not a governance domain, and Helpdesk ticket resolution speed (E) is an IT service management performance metric rather than a governance domain.

Answer

Hardware procurement automation

Answer

Helpdesk ticket resolution speed

Question 6

A financial services firm has a mature IT governance framework, but recent audits revealed that IT risk decisions are often made without considering the enterprise's overall risk appetite. The board wants to ensure that IT risk management is fully integrated with enterprise risk management (ERM). Which of the following actions should the CIO take FIRST to address this gap?

Accepted Answer

Establish a formal process to align IT risk tolerance with the enterprise risk appetite.. The audit finding shows IT risk decisions are made in isolation from the enterprise risk appetite. The most direct and foundational action is to establish a formal process that translates the enterprise risk appetite into IT risk tolerance, ensuring that IT risk management operates within the board's defined boundaries. This integrates IT risk with ERM and addresses the root cause, whereas other actions are either too narrow or misdirected.

Answer

Increase the frequency of IT risk assessments to quarterly.

Answer

Delegate all IT risk decisions to the enterprise risk management committee.

Answer

Update the IT risk register to include all enterprise risks.

Question 7

The enterprise is reviewing its IT governance structure. Which THREE of the following are primary responsibilities of the Board of Directors regarding IT governance?

Accepted Answer

Directing the strategic alignment of IT with business goals.. Option B is correct because the Board of Directors is responsible for directing the strategic alignment of IT with business goals, ensuring that IT initiatives support and enable the organization's overall strategy rather than operating in isolation. Option C is correct because overseeing the enterprise risk management framework falls under the Board's governance duties, including identifying, assessing, and mitigating IT-related risks that could impact the organization. Option E is correct because ensuring value delivery from IT investments is a core governance responsibility, where the Board confirms that IT expenditures generate expected business benefits and optimal returns. Options A and D are incorrect because defining technical server cluster configurations and managing daily helpdesk ticket queues are operational, hands-on tasks performed by IT staff, not strategic governance responsibilities of the Board of Directors.

Answer

Defining the technical configuration of server clusters.

Answer

Managing the daily IT helpdesk ticket queue.

Question 8

A newly appointed CIO is integrating COBIT 2019 into the existing governance framework. Which action best ensures that the governance system is dynamic?

Accepted Answer

Customizing the governance system based on the enterprise's unique design factors.. COBIT 2019 explicitly defines a governance system as dynamic when it is tailored to the enterprise's context through design factors (enterprise goals, risk profile, threat landscape, compliance requirements, IT role, sourcing model, etc.). Customizing based on these factors is the prescribed method for achieving a fit-for-purpose, adaptable governance system. This aligns with the COBIT principle 'Tailored to Enterprise Needs' and the design-factor-driven approach in the COBIT 2019 Design Guide.

Answer

Focusing solely on the 'Ensure Governance Framework Setting and Maintenance' objective.

Answer

Implementing all 40 governance and management objectives immediately.

Answer

Adopting the framework exactly as published in the COBIT core publication.

Question 9

Which THREE factors should the board of directors consider when establishing IT governance oversight mechanisms?

Accepted Answer

Regulatory and compliance requirements.. Option A (Regulatory and compliance requirements) is correct because IT governance oversight must ensure the organization meets legal, statutory, and industry obligations such as GDPR, HIPAA, SOX, or PCI DSS, which directly shape governance structures, controls, and reporting to the board. Option B (Alignment of IT initiatives with business strategy) is correct because a core purpose of IT governance is to ensure technology investments and initiatives support and enable the enterprise's strategic objectives, typically through frameworks like COBIT that link IT goals to business goals. Option C (Enterprise risk appetite) is correct because the board must define and monitor how much IT-related risk the organization is willing to accept, guiding decisions on security, resilience, and investment priorities. Option D (Daily network uptime statistics) is not appropriate for board-level governance oversight, as it is an operational metric handled by IT management, not a strategic governance factor. Option E (Detailed software configuration standards) is also operational and tactical, belonging to IT operations and technical teams rather than the board's governance responsibilities.

Answer

Daily network uptime statistics.

Answer

Detailed software configuration standards.

Question 10

In the context of IT governance, what is the primary responsibility of the board of directors?

Accepted Answer

Providing strategic direction and monitoring governance performance.. The board of directors owns governance, not management. Its primary responsibility is to provide strategic direction, set risk appetite, and monitor whether governance is achieving enterprise objectives — including IT. This aligns with the COBIT 2019 governance domain EDM (Evaluate, Direct, Monitor), which is explicitly a board-level accountability. Operational and tactical activities are delegated to management.

Answer

Managing the procurement of software and hardware.

Answer

Developing IT policies and procedures.

Answer

Day-to-day management of IT operations.

Question 11

A multinational corporation is struggling with IT strategic alignment. The board wants to ensure IT investments directly correlate to business value. Which metric should the governance committee prioritize?

Accepted Answer

Percentage of IT initiatives that directly contribute to documented business strategy goals.. The board's concern is strategic alignment — ensuring IT investments directly correlate to business value. The metric that most directly measures this is the percentage of IT initiatives that contribute to documented business strategy goals. This metric ties IT portfolio composition to strategic intent, which is the essence of alignment. Other metrics measure efficiency or operational performance but not alignment itself.

Answer

Total cost of ownership (TCO) of IT assets.

Answer

System uptime and availability percentages.

Answer

IT project delivery on time and within budget.

Question 12

The IT steering committee is evaluating a high-cost digital transformation project. What should the committee prioritize to ensure strategic alignment?

Accepted Answer

The business value proposition and contribution to organizational goals.. For a high-cost digital transformation, the IT steering committee's primary governance responsibility is to ensure strategic alignment — that the investment delivers business value and advances organizational goals. Prioritizing the business value proposition and contribution to goals is the essence of strategic alignment.

Answer

The potential for technical debt reduction.

Answer

The specific vendor selection process used for the software purchase.

Answer

Detailed technical architectural specifications.

Question 13

A newly appointed CIO is establishing an IT governance framework. Which approach best ensures that IT governance is integrated into the enterprise's existing management structure?

Accepted Answer

Map IT governance activities to existing business decision-making processes and accountabilities.. Integrating IT governance into the enterprise's existing management structure requires mapping IT governance activities to existing business decision-making processes and accountabilities. This ensures IT governance is not a parallel or isolated structure but is embedded in how the enterprise already makes decisions, allocates resources, and manages risk. Alignment with existing structures drives adoption and avoids duplication.

Answer

Require all IT departments to report directly to the Chief Risk Officer.

Answer

Adopt a proprietary framework developed by a third-party IT consulting firm.

Answer

Implement a parallel IT governance board independent of the executive committee.

Question 14

A large multinational corporation is transitioning to COBIT 2019. The governance board needs to prioritize governance objectives. Which action should the IT governance lead take first?

Accepted Answer

Conduct a design factors assessment.. COBIT 2019 requires the governance system to be tailored to the enterprise's context, and that tailoring begins with a design factors assessment. Design factors (enterprise strategy, goals, risk profile, IT-related issues, threat landscape, compliance requirements, role of IT, sourcing model, IT adoption strategy, enterprise size, and technology adoption) determine which of the 40 governance and management objectives are relevant and how they should be prioritized. Only after this assessment can the governance board meaningfully prioritize objectives.

Answer

Implement the IT Balanced Scorecard.

Answer

Adopt all 40 governance objectives immediately.

Answer

Draft new board-level IT policies.

Question 15

What is the primary purpose of an IT governance framework?

Accepted Answer

To provide a structured approach for achieving IT value and managing risk.. An IT governance framework provides a structured approach for aligning IT with business objectives, delivering value, and managing risk through defined processes, roles, and decision rights. It is not about automation, uptime guarantees, or cost minimization in isolation, but about ensuring IT enables and protects enterprise goals. This is the core definition reflected in frameworks like COBIT and ISO/IEC 38500.

Answer

To automate IT operations.

Answer

To ensure 100% system uptime.

Answer

To minimize IT costs at all times.

Question 16

A firm is experiencing 'governance drift' where IT initiatives are no longer aligned with corporate strategy. Which action should the governance committee take first?

Accepted Answer

Perform a review of business strategy and IT design factors.. Governance drift means the linkage between IT initiatives and corporate strategy has weakened, so the first step is to re-examine the business strategy and the IT design factors that should drive IT direction. This re-establishes the 'Evaluate' and 'Direct' inputs the governance committee needs before any corrective action. Auditing projects or changing leadership without first re-validating strategy would treat symptoms rather than the root cause.

Answer

Replace the existing CIO.

Answer

Conduct an audit of all current IT projects.

Answer

Increase the IT budget to support more initiatives.

Question 17

A large enterprise is transitioning to a hybrid cloud environment. How should the governance policy be updated to maintain effective oversight?

Accepted Answer

Develop policies addressing shared responsibility and cloud governance controls.. In a hybrid cloud model, governance must be updated to reflect the shared responsibility model, where the cloud provider secures the cloud infrastructure while the enterprise remains accountable for data, identities, and configurations in the cloud. Developing policies that explicitly address shared responsibility and cloud-specific governance controls (e.g., CASB, CSPM, contract SLAs) ensures oversight is maintained across both on-premises and cloud environments. This aligns with CGEIT's focus on aligning IT governance with enterprise strategy and risk.

Answer

Centralize all IT infrastructure back to on-premises.

Answer

Shift all responsibility for security to the cloud provider.

Answer

Eliminate the need for internal IT policies.

Question 18

Which document is essential for formalizing the relationship and expectations between IT and the business units?

Accepted Answer

Service Level Agreement (SLA).. A Service Level Agreement (SLA) is the formal document that defines the services IT will deliver, the expected performance levels, responsibilities of both parties, and remedies for non-performance. It is the primary instrument for codifying the relationship and mutual expectations between IT and business units. While other documents set direction or authorize work, the SLA operationalizes the IT-business relationship.

Answer

Governance Policy Statement.

Answer

Project Charter.

Answer

IT Strategic Plan.

Question 19

An organization is evaluating its governance structure against the COBIT 2019 framework. Where should the authority for IT governance decisions reside?

Accepted Answer

The IT Steering Committee.. In COBIT 2019, IT governance decision-making authority should reside with a governance body that represents both business and IT stakeholders — typically the IT Steering Committee. This committee provides oversight, prioritizes IT investments, and ensures alignment between IT and business strategy. It operates under the board's delegated authority and is the appropriate locus for governance decisions.

Answer

The IT Security Manager.

Answer

The Chief Information Officer (CIO).

Answer

The external auditors.

Question 20

Which stakeholder should provide the final approval for the IT governance policy?

Accepted Answer

The Board of Directors.. The Board of Directors holds ultimate accountability for IT governance because it represents shareholder interests and is responsible for overseeing all enterprise resources, including IT. Governance policies establish the decision rights and accountability framework, so final approval must rest with the highest governing authority rather than operational or technology-specific roles. This aligns with COBIT's principle that governance is a board-level responsibility, distinct from management.

Answer

The IT Steering Committee.

Answer

The Chief Technology Officer (CTO).

Answer

The Chief Information Security Officer (CISO).