CGEIT Governance OF Enterprise IT Practice Test 2 — 15 Questions

Question 1

A firm is experiencing 'governance drift' where IT initiatives are no longer aligned with corporate strategy. Which action should the governance committee take first?

Accepted Answer

Perform a review of business strategy and IT design factors.. Governance drift means the linkage between IT initiatives and corporate strategy has weakened, so the first step is to re-examine the business strategy and the IT design factors that should drive IT direction. This re-establishes the 'Evaluate' and 'Direct' inputs the governance committee needs before any corrective action. Auditing projects or changing leadership without first re-validating strategy would treat symptoms rather than the root cause.

Answer

Replace the existing CIO.

Answer

Conduct an audit of all current IT projects.

Answer

Increase the IT budget to support more initiatives.

Question 2

A large enterprise is transitioning to a hybrid cloud environment. How should the governance policy be updated to maintain effective oversight?

Accepted Answer

Develop policies addressing shared responsibility and cloud governance controls.. In a hybrid cloud model, governance must be updated to reflect the shared responsibility model, where the cloud provider secures the cloud infrastructure while the enterprise remains accountable for data, identities, and configurations in the cloud. Developing policies that explicitly address shared responsibility and cloud-specific governance controls (e.g., CASB, CSPM, contract SLAs) ensures oversight is maintained across both on-premises and cloud environments. This aligns with CGEIT's focus on aligning IT governance with enterprise strategy and risk.

Answer

Centralize all IT infrastructure back to on-premises.

Answer

Shift all responsibility for security to the cloud provider.

Answer

Eliminate the need for internal IT policies.

Question 3

Which document is essential for formalizing the relationship and expectations between IT and the business units?

Accepted Answer

Service Level Agreement (SLA).. A Service Level Agreement (SLA) is the formal document that defines the services IT will deliver, the expected performance levels, responsibilities of both parties, and remedies for non-performance. It is the primary instrument for codifying the relationship and mutual expectations between IT and business units. While other documents set direction or authorize work, the SLA operationalizes the IT-business relationship.

Answer

Governance Policy Statement.

Answer

Project Charter.

Answer

IT Strategic Plan.

Question 4

An organization is evaluating its governance structure against the COBIT 2019 framework. Where should the authority for IT governance decisions reside?

Accepted Answer

The IT Steering Committee.. In COBIT 2019, IT governance decision-making authority should reside with a governance body that represents both business and IT stakeholders — typically the IT Steering Committee. This committee provides oversight, prioritizes IT investments, and ensures alignment between IT and business strategy. It operates under the board's delegated authority and is the appropriate locus for governance decisions.

Answer

The IT Security Manager.

Answer

The Chief Information Officer (CIO).

Answer

The external auditors.

Question 5

Which stakeholder should provide the final approval for the IT governance policy?

Accepted Answer

The Board of Directors.. The Board of Directors holds ultimate accountability for IT governance because it represents shareholder interests and is responsible for overseeing all enterprise resources, including IT. Governance policies establish the decision rights and accountability framework, so final approval must rest with the highest governing authority rather than operational or technology-specific roles. This aligns with COBIT's principle that governance is a board-level responsibility, distinct from management.

Answer

The IT Steering Committee.

Answer

The Chief Technology Officer (CTO).

Answer

The Chief Information Security Officer (CISO).

Question 6

A firm identifies that its IT governance framework is too burdensome for its agile, small-team structure. What is the most appropriate governance action?

Accepted Answer

Tailor the governance system by adjusting design factors.. COBIT 2019 explicitly supports tailoring the governance system by adjusting design factors — enterprise size, goals, risk profile, and culture — so the framework fits the organization rather than forcing the organization to fit the framework. For a small, agile firm, tailoring means scaling down process rigor, reducing documentation, and focusing on the governance objectives that matter most. This is the most appropriate action because it preserves governance intent while removing unnecessary burden.

Answer

Standardize all processes across the company.

Answer

Ignore the framework until the company grows.

Answer

Appoint more auditors to monitor compliance.

Question 7

What is the primary indicator that IT strategic alignment is successful?

Accepted Answer

Business goals are met through the effective use of IT.. IT strategic alignment is successful when IT investments and capabilities directly enable the organization to achieve its business goals. The ultimate measure is not internal IT efficiency metrics but whether IT has contributed to business outcomes such as revenue growth, market share, or customer satisfaction. This is the essence of alignment — IT serving business strategy.

Answer

IT cost as a percentage of revenue is minimized.

Answer

The IT department is fully staffed.

Answer

IT projects are completed on time.

Question 8

When establishing an IT governance committee, what is a key requirement for its effectiveness?

Accepted Answer

It must include representation from both business and IT.. A key requirement for an effective IT governance committee is representation from both business and IT, ensuring that decisions balance business value with technical feasibility and risk. This cross-functional composition aligns IT priorities with enterprise objectives and prevents governance from becoming an IT-only exercise. It reflects COBIT and ISO/IEC 38500 principles of stakeholder involvement and business-IT alignment.

Answer

It must be composed only of technical experts.

Answer

It must be chaired by the CIO.

Answer

It must meet at least once a week.

Question 9

A company is integrating a new AI technology. How should the governance structure oversee this risk?

Accepted Answer

Update governance policies and risk thresholds for new technology.. Integrating new AI technology introduces novel risks (bias, opacity, data misuse) that existing governance may not address, so the governance structure must update policies and risk thresholds to cover these emerging risks. This ensures oversight remains relevant and that AI use aligns with organizational risk appetite and regulatory expectations. Proactive policy evolution is the hallmark of effective IT governance.

Answer

Mandate that no new AI technology is used.

Answer

Allow the IT team to proceed without oversight.

Answer

Focus solely on the cost of the technology.

Question 10

Which role is generally responsible for implementing the governance policies defined by the board?

Accepted Answer

Executive Management.. Executive Management is responsible for implementing governance policies defined by the board because they translate strategic direction into operational plans, allocate resources, and oversee execution across the organization. In governance frameworks like COBIT, the board sets direction and monitors, while management plans, builds, runs, and monitors activities. This separation ensures accountability and operational feasibility.

Answer

Internal Audit.

Answer

The Board of Directors.

Answer

The IT support team.

Question 11

How should IT governance ensure that IT-related risks are identified and managed?

Accepted Answer

By incorporating risk management into the enterprise's IT governance policy.. IT governance ensures risk identification and management by embedding risk management into the enterprise's IT governance policy, making it a systematic and repeatable part of decision-making. This integrates risk appetite, assessment, and treatment into the governance framework rather than treating risk as an ad hoc activity. It aligns with COBIT's EDM03 (Ensured Risk Optimization) and ISO/IEC 38500 principles.

Answer

By eliminating IT risk entirely.

Answer

By outsourcing all IT operations to a third party.

Answer

By performing all risk assessments at the board level.

Question 12

A company's IT governance structure is being challenged because IT costs are inconsistent. What is the most appropriate governance step to take?

Accepted Answer

Review and align IT investment prioritization with business outcomes.. Reviewing and aligning IT investment prioritization with business outcomes ensures that IT spending is driven by strategic value rather than inconsistent or arbitrary factors. This governance step addresses the root cause of inconsistent costs by establishing a transparent, business-aligned process for funding IT initiatives. It is a core COBIT governance activity (Evaluate, Direct, Monitor) that ensures IT costs are justified by expected benefits.

Answer

Arbitrarily cap all IT spending.

Answer

Increase the IT department's headcount.

Answer

Switch to a cloud-only model.

Question 13

Which factor most significantly influences the design of an IT governance system?

Accepted Answer

The organization's strategy and business goals.. An IT governance system exists to ensure IT enables and extends the organization's strategy, so its design must be driven by the organization's strategy and business goals. COBIT 2019 explicitly lists enterprise strategy as a design factor that shapes governance objectives, components, and performance metrics. Without this anchor, governance becomes a generic control framework rather than a value-enabling system.

Answer

The specific software vendors used.

Answer

The current IT hardware lifecycle.

Answer

The number of employees in the IT department.

Question 14

An organization wants to improve its IT governance maturity. What is the most important first step?

Accepted Answer

Assessing the current state of governance maturity.. The most important first step in improving IT governance maturity is to assess the current state of governance maturity. This establishes a baseline, identifies gaps, and informs the development of a targeted improvement plan. Without this assessment, any subsequent actions—such as tool acquisition or framework implementation—lack direction and may not address the actual weaknesses. COBIT and other governance frameworks emphasize the need to understand the 'as-is' state before defining the 'to-be' state.

Answer

Buying an expensive IT governance tool.

Answer

Implementing all COBIT objectives at once.

Answer

Changing the IT leadership team.

Question 15

Which of the following best defines IT Governance?

Accepted Answer

A structure of relationships and processes to direct and control the enterprise.. IT governance is defined as the structure of relationships and processes used to direct and control the enterprise's IT resources toward business objectives. This definition (rooted in COBIT and ITGI) emphasizes direction, control, and accountability rather than operational execution. It encompasses leadership, organizational structures, and processes that ensure IT sustains and extends the enterprise's strategy and objectives.

Answer

Purchasing new software for the company.

Answer

Managing daily IT support tickets.

Answer

Updating antivirus software across the network.