CGEIT Governance OF Enterprise IT Practice Test 4 — 15 Questions

Question 1

An organization's governance committee decides to stop funding a legacy IT system that is still critical for a specific department. What should be done?

Accepted Answer

Conduct an impact analysis and develop a migration strategy.. When funding is withdrawn from a system that remains critical to a department, the governance-driven response is to assess the business and operational impact and plan a controlled transition rather than abruptly terminating service. An impact analysis identifies dependencies, data retention needs, and continuity risks, while a migration strategy provides a governed path to a replacement or alternative. This preserves business continuity while respecting the committee's funding decision.

Answer

Decommission it immediately to save money.

Answer

Force the department to find their own funding.

Answer

Ignore the committee's decision and keep paying.

Question 2

Which TWO documents are essential for establishing governance oversight?

Accepted Answer

Governance policy. A governance policy is essential because it formally defines the rules, decision rights, and accountability mechanisms that direct and constrain how the organization is managed, which is the foundation of governance oversight. A committee charter is equally essential because it establishes the governing body's mandate, membership, authority, and reporting responsibilities, giving oversight its operational structure. Together these two documents create both the 'what' (policy) and the 'who/how' (charter) of governance. The server maintenance schedule, vendor contact list, and IT ticket log are operational artifacts that support day-to-day IT service delivery and administration, but they do not establish governance authority, decision rights, or oversight accountability.

Answer

Server maintenance schedule

Answer

Vendor contact list

Answer

IT ticket log

Question 3

Which THREE components are critical for an IT governance system to be effective?

Accepted Answer

Defined processes. An effective IT governance system requires defined processes (A) because repeatable, documented procedures for decision-making, risk management, and resource allocation ensure consistency and accountability across the organization. Organizational structures (D) are also critical, as they establish clear roles, responsibilities, and decision rights (e.g., steering committees, CIO, board oversight) that determine who makes and enforces IT decisions. Information flows (E) are essential because governance depends on timely, accurate reporting and communication of performance metrics, risks, and compliance data to the right stakeholders. Options B and C are incorrect because unlimited breakroom coffee and the latest gaming console are workplace perks or entertainment items, not components of an IT governance framework.

Answer

Unlimited breakroom coffee

Answer

The latest gaming console

Question 4

Which TWO items are commonly included in an IT Governance Policy?

Accepted Answer

Scope of governance. Option A (Scope of governance) is correct because an IT Governance Policy must define its boundaries — which business units, systems, processes, and geographies the governance framework applies to — so that accountability and decision rights are unambiguous. Option D (Roles and responsibilities) is correct because governance policies must specify who owns decisions and oversight, such as the IT steering committee, CIO, business unit leaders, and data owners, mapping authority for approvals, risk acceptance, and policy exceptions. The unmarked options do not belong: network IP addresses (B) and server rack layout (C) are operational/technical configuration details found in network and data center documentation, not governance policy, and a daily task list (E) is an operational work artifact rather than a governance-level statement of scope, authority, and accountability.

Answer

Network IP addresses

Answer

Server rack layout

Answer

Daily task list

Question 5

Which TWO mechanisms are used by governance to monitor performance?

Accepted Answer

Independent internal audit. Governance monitors performance through independent internal audit (C), which provides objective, periodic assurance that processes, controls, and performance targets are being met, and through periodic performance reporting (D), which delivers regular metrics and KPIs to governance bodies so they can track progress against objectives and make informed decisions. These two mechanisms are formal, repeatable governance instruments that create accountability and oversight. By contrast, a hardware inventory scan (A) is an operational asset-management activity, daily stand-up meetings (B) are tactical team coordination events rather than governance-level monitoring, and office security badge logs (E) are physical access-control records unrelated to performance monitoring.

Answer

Hardware inventory scan

Answer

Daily stand-up meetings

Answer

Office security badge logs

Question 6

Which TWO are common challenges in IT governance implementation?

Accepted Answer

Cultural resistance. Cultural resistance (A) is a common IT governance challenge because governance introduces new decision rights, policies, and accountability structures that clash with entrenched organizational habits, departmental autonomy, and informal power centers, making adoption slow and contentious. Lack of executive support (E) is equally critical because IT governance requires authority to enforce standards, allocate resources, and resolve cross-functional conflicts; without active sponsorship from senior leadership, governance bodies like steering committees lose legitimacy and compliance erodes. By contrast, insufficient desk space (B), slow elevator speed (C), and unreliable office internet (D) are physical facilities or infrastructure issues that do not pertain to establishing governance frameworks, decision-making processes, or stakeholder alignment.

Answer

Insufficient desk space

Answer

Slow elevator speed

Answer

Unreliable office internet

Question 7

Which TWO metrics are used to measure strategic alignment?

Accepted Answer

Percentage of projects aligned with business strategy. Strategic alignment measures how well IT initiatives support business goals, so option C (Percentage of projects aligned with business strategy) is correct because it directly quantifies the proportion of IT projects that map to the organization's strategic objectives. Option E (Business value realized from IT investments) is also correct because it captures the tangible outcomes and value that IT spending delivers in support of business strategy, a core dimension of alignment. The remaining options are operational or HR/financial metrics rather than strategic alignment indicators: A (Number of server reboots) reflects infrastructure reliability, B (Average salary of IT staff) is a compensation measure, and D (Number of printers repaired) is a help-desk/asset maintenance statistic, none of which assess whether IT is aligned with business strategy.

Answer

Number of server reboots

Answer

Average salary of IT staff

Answer

Number of printers repaired

Question 8

Which TWO stakeholders are essential for successful IT governance?

Accepted Answer

Executive Management. Executive Management (C) is essential because IT governance requires top leadership to set strategic direction, approve IT policies, allocate budgets, and ensure IT investments align with business objectives and risk appetite. The Board of Directors (D) is also essential because it provides ultimate oversight and accountability, ensuring that IT governance frameworks, risk management, and compliance obligations are met at the highest organizational level. Together, these two stakeholders supply the authority, strategic alignment, and oversight that define successful IT governance. Local IT repair technicians (A) perform operational support tasks rather than governance-level decision-making, delivery drivers (B) are unrelated to IT governance, and external janitorial staff (E) have no governance role, so none of these belong.

Answer

Local IT repair technicians

Answer

Delivery drivers

Answer

External janitorial staff

Question 9

Which THREE types of risks should IT governance oversee?

Accepted Answer

Operational risks. IT governance should oversee operational risks (A) because they cover failures in day-to-day IT services, processes, and infrastructure that can disrupt business continuity, and governance ensures controls, SLAs, and incident management are in place. Compliance risks (D) must be governed because IT must satisfy legal, regulatory, and contractual requirements such as GDPR, HIPAA, SOX, or PCI DSS, and governance ensures policies, audits, and evidence of adherence exist. Strategic risks (E) belong under governance because IT investments, architecture, and digital transformation decisions must align with business objectives and be managed against risks that could prevent achieving those goals. The unmarked options do not belong: office plant death (B) is a trivial facilities matter, and a printer paper jam (C) is a routine operational incident handled by end-user support, not a governance-level risk category.

Answer

Risk of office plant death

Answer

Risk of printer paper jam

Question 10

Which TWO items are considered 'Governance enablers' in COBIT?

Accepted Answer

Organizational structures. In COBIT, governance enablers are the factors that influence how governance and management objectives are achieved, and they are grouped into categories such as principles/policies/frameworks, processes, organizational structures, culture/ethics/behavior, information, services/infrastructure/applications, people/skills/competencies, and so on. Option D, organizational structures, is correct because COBIT explicitly identifies organizational structures as a governance enabler category, defining where decision rights and accountability for governance activities reside. Option E, processes, is correct because processes are another recognized COBIT enabler category, describing the organized sets of practices and activities that achieve governance and management objectives. Options A, B, and C are incorrect because personal employee cars, office air conditioning, and breakroom snacks are physical workplace amenities, not COBIT governance enabler categories.

Answer

Personal employee cars

Answer

Office air conditioning

Answer

Breakroom snacks

Question 11

Which TWO are common IT governance structures?

Accepted Answer

Architecture Review Board. An Architecture Review Board (A) is a recognized IT governance structure because it provides formal oversight and decision-making authority over architecture standards, technology choices, and design compliance across projects. An IT Steering Committee (E) is also a standard governance body, typically composed of senior business and IT leaders who prioritize IT investments, align IT strategy with business goals, and approve major initiatives. The Coffee and Donut Club (B) is a social group with no governance authority, decision rights, or accountability for IT outcomes. A Software testing team (C) is an operational delivery function focused on quality assurance, not on setting or enforcing governance policy. Help desk support (D) is a service management/operations function that resolves user incidents, not a governance structure that directs IT strategy or standards.

Answer

Coffee and Donut Club

Answer

Software testing team

Answer

Help desk support

Question 12

Which THREE items are required for an effective IT investment governance process?

Accepted Answer

Project prioritization process. A project prioritization process (A) is required because governance must rank competing IT investments against strategic objectives and resource constraints so that funding flows to the highest-value initiatives. A formal business case review (D) is required because each proposed investment must be justified with costs, benefits, risks, and alignment before approval, providing the documented basis for the go/no-go decision. Post-implementation value tracking (E) is required because governance is a closed loop: after delivery, actual benefits, costs, and outcomes must be measured against the business case to confirm value realization and inform future decisions. The remaining options do not belong: employee birthday party planning (B) and office chair selection (C) are routine administrative or facilities matters, not IT investment governance controls, and neither addresses prioritization, justification, or value realization of IT spending.

Answer

Employee birthday party planning

Answer

Office chair selection

Question 13

During a strategic alignment review, the governance committee identifies that IT investments are not delivering expected value. What is the most effective first step for the committee?

Accepted Answer

Conduct a portfolio review to map current IT investments to strategic business objectives. When IT investments are not delivering expected value, the governance committee's most effective first step is to conduct a portfolio review that maps current investments to strategic business objectives. This diagnostic step reveals which investments are misaligned, duplicative, or underperforming, providing the evidence needed for subsequent decisions such as reallocation, cancellation, or remediation.

Answer

Cancel all current IT projects and restart with new priorities

Answer

Outsource the IT portfolio management function to a third-party consultant

Answer

Reduce the IT budget by 20% to increase efficiency metrics

Question 14

A newly appointed CIO is establishing an IT governance framework. Which approach best ensures that IT governance activities are integrated into existing business decision-making processes?

Accepted Answer

Embedding IT governance roles and responsibilities into existing business management functions. Embedding IT governance roles and responsibilities into existing business management functions ensures governance is not a parallel silo but part of how the business already makes decisions. This approach leverages existing decision-making forums, reporting lines, and accountability structures, which is the most effective way to integrate IT governance into business processes per COBIT and ISO/IEC 38500.

Answer

Requiring all IT decisions to be signed off by the board of directors

Answer

Implementing an IT-only governance framework based strictly on COBIT 2019

Answer

Creating a separate IT governance committee with independent reporting lines

Question 15

Which document is primary evidence that the board of directors is fulfilling its oversight responsibility for IT governance?

Accepted Answer

The minutes of board meetings documenting IT strategy review and approval. Board oversight of IT governance is evidenced by formal records showing the board reviewed and approved IT strategy. Board meeting minutes documenting IT strategy review and approval are the primary artefact demonstrating that directors exercised their oversight duty. Incident reports, architecture documents, and license lists are management-level artefacts, not evidence of board governance.

Answer

An IT incident report detailing recent system downtime

Answer

A technical architecture document describing the enterprise network

Answer

A list of software licenses purchased by the IT department