CGEIT Governance OF Enterprise IT Practice Test 5 — 15 Questions

Question 1

An enterprise is transitioning to a hybrid cloud environment. Which governance mechanism is most critical to ensure compliance with data sovereignty regulations?

Accepted Answer

Implementing a robust data classification policy and control framework. A robust data classification policy and control framework is most critical because data sovereignty compliance depends on knowing what data exists, where it resides, and how it is protected across hybrid cloud environments. Classification drives the controls that ensure data is stored and processed in permitted jurisdictions.

Answer

Automated provisioning of infrastructure using Infrastructure as Code (IaC)

Answer

Establishing a service level agreement (SLA) with the cloud provider

Answer

Increasing the frequency of penetration testing on cloud endpoints

Question 2

A company is experiencing friction between IT and business units regarding project priorities. What governance structure should be strengthened to resolve this?

Accepted Answer

The IT Steering Committee. The IT Steering Committee is the governance body that brings business and IT leadership together to prioritize projects, resolve competing demands, and ensure IT investments align with enterprise strategy. Friction over project priorities is precisely the mandate of this committee, which has the authority to arbitrate between business units and IT. Strengthening it — through clearer terms of reference, decision rights, and representation — directly addresses the root cause.

Answer

The IT Change Advisory Board (CAB)

Answer

The Security Operations Center (SOC)

Answer

The IT Infrastructure Architecture board

Question 3

An organization has decentralized its IT operations, leading to fragmented governance. Which action will best restore governance oversight while retaining operational agility?

Accepted Answer

Implement a federated governance structure with central policy oversight. A federated governance structure keeps central authority over policy, standards, and risk appetite while delegating day-to-day operational decisions to business units, which restores enterprise-wide oversight without sacrificing the agility that decentralization was meant to provide. This is the classic CGEIT answer for balancing control and responsiveness in a decentralized organization.

Answer

Mandate that all business units use the same IT software stack

Answer

Standardize all IT purchasing processes across the enterprise

Answer

Centralize all IT functions and reporting lines under the CIO

Question 4

What is the primary role of the IT governance framework in an enterprise?

Accepted Answer

To align IT strategy with business strategy and deliver value. The primary role of an IT governance framework is to align IT strategy with business strategy and ensure IT delivers value while managing risk and optimizing resources. This alignment is the core purpose defined by ISO/IEC 38500 and COBIT, ensuring IT investments support business objectives rather than operating as a separate technical function.

Answer

To serve as a technical manual for system administration

Answer

To automate all IT monitoring and reporting

Answer

To replace the need for IT management

Question 5

Which metric is the most effective indicator of IT governance success?

Accepted Answer

Degree of alignment between IT investments and business value realized. IT governance exists to ensure IT delivers value aligned with business strategy, so the most effective success indicator is the degree to which IT investments align with and produce realized business value. This metric directly measures the governance objective of value delivery and strategic alignment, which COBIT and ISO/IEC 38500 both identify as the primary governance outcomes. Operational metrics like cost, schedule, or patch counts are inputs or enablers, not indicators of governance success.

Answer

Total cost of IT hardware and software maintenance

Answer

Number of IT projects completed on time

Answer

Number of IT security patches applied per month

Question 6

An organization adopts a new IT governance policy. Which mechanism best ensures that employees understand and follow the policy?

Accepted Answer

Establishing a formal communication and training plan regarding the policy. Establishing a formal communication and training plan is the most effective mechanism because it proactively ensures that employees are aware of the policy, understand its requirements, and know how to comply. Training and communication are core components of IT governance implementation, as they translate policy intent into actionable behavior. This approach aligns with COBIT's focus on culture, ethics, and behavior, ensuring that governance policies are embedded in the organization. Without such a plan, even the best policy remains unknown or misunderstood.

Answer

Including the policy in the organization's long-term strategic plan

Answer

Threatening immediate termination for any policy deviation

Answer

Encrypting the policy document on the corporate intranet

Question 7

Which action should the governance body take if a major IT risk is identified that exceeds the enterprise's risk appetite?

Accepted Answer

Formally communicate the risk to the board and propose a risk treatment plan. When a major IT risk exceeds the enterprise's risk appetite, the governance body must escalate it formally to the board and propose a risk treatment plan (mitigate, transfer, avoid, or accept with justification). This fulfills the governance body's oversight duty and ensures informed decision-making at the highest level. Simply ignoring or redefining risk appetite to fit the situation undermines the integrity of the risk management framework.

Answer

Wait for the risk to manifest before taking action

Answer

Re-evaluate the definition of risk appetite to match the current state

Answer

Request the IT department to simply delete the system causing the risk

Answer

Ignore the risk if it helps achieve a short-term profit target

Question 8

A company is planning a digital transformation. What governance action is necessary to ensure the transformation supports business strategy?

Accepted Answer

Establish a governance structure that includes business unit leaders in transformation decision-making. Digital transformation succeeds only when business strategy drives technology decisions, so the necessary governance action is to establish a governance structure that includes business unit leaders in transformation decision-making (B). This ensures the transformation is aligned to business outcomes, not driven solely by IT or by vendor offerings. Governance structures with cross-functional representation provide the oversight and prioritization mechanism that keeps transformation efforts tied to strategic objectives.

Answer

Outsource the entire transformation to an external systems integrator

Answer

Focus primarily on reducing IT costs to fund the project

Answer

Select the latest cloud-based ERP software before defining business requirements

Question 9

Which of the following best describes 'strategic alignment' in IT governance?

Accepted Answer

Ensuring IT plans and business plans are synchronized. Strategic alignment in IT governance means that IT strategy, plans, and investments are directly derived from and continuously synchronized with the organization's business strategy and objectives. Option D captures this bidirectional linkage — IT enables business goals while business priorities shape IT direction. This is a core principle in frameworks like COBIT (BAI01, APO02) and is a primary focus area of CGEIT. Without this alignment, IT becomes a cost center rather than a value enabler.

Answer

Requiring IT staff to wear uniforms

Answer

Purchasing the most advanced technology available

Answer

Ensuring the data center is located in a seismically safe area

Question 10

Which stakeholder is ultimately accountable for the governance of IT in an enterprise?

Accepted Answer

The Board of Directors. Ultimate accountability for IT governance rests with the Board of Directors (D). In governance frameworks such as COBIT and ISO/IEC 38500, the board is responsible for setting direction, ensuring IT delivers value, optimizing risk, and optimizing resources. While IT steering committees, the CIO, and audit provide oversight and execution, the board holds the ultimate fiduciary accountability to stakeholders for how IT is governed.

Answer

The IT Steering Committee

Answer

The Internal Audit department

Answer

The Chief Information Officer (CIO)

Question 11

An organization is updating its IT governance policies. Which element must be included to ensure policy enforcement?

Accepted Answer

Defined roles, responsibilities, and accountability mechanisms. To ensure policy enforcement, an IT governance policy must include defined roles, responsibilities, and accountability mechanisms (B). Policies without assigned ownership and consequences are unenforceable; defining who is responsible for compliance, who monitors it, and what happens when it is violated is what turns a policy document into an enforceable governance instrument. This aligns with COBIT's emphasis on organizational structures and accountability.

Answer

A copy of the IT department's budget spreadsheet

Answer

A detailed technical configuration guide for all servers

Answer

A list of all software vendor names used by the company

Question 12

A governance review reveals that IT decision-making is too slow to support rapid market changes. What should be done?

Accepted Answer

Delegate specific decision-making authorities to lower levels based on defined thresholds. When governance slows decision-making, the correct remedy is to redesign decision rights, not to remove oversight or centralise further. Delegating specific authorities to lower levels with defined thresholds (e.g., spend limits, risk tiers) preserves accountability while enabling speed. This is a core principle of effective governance design — matching decision latency to the pace of the business.

Answer

Require the board of directors to approve every IT change

Answer

Remove all governance oversight requirements to speed up decisions

Answer

Stop all development until the governance process is redesigned

Question 13

Which of the following is an example of an 'IT governance structure'?

Accepted Answer

An IT steering committee. An IT steering committee is a classic example of an IT governance structure — a formal body with defined membership, charter, and decision rights that oversees IT strategy, prioritization, and alignment with business objectives. Governance structures are the organizational mechanisms (committees, councils, roles) that enable direction-setting and accountability, not the operational artifacts or projects themselves.

Answer

A daily backup job schedule

Answer

A database management system (DBMS) upgrade project

Answer

A list of helpdesk tickets for the week

Question 14

Which TWO of the following are key inputs for defining the IT governance strategy?

Accepted Answer

The enterprise's risk appetite. Option C is correct because the enterprise's risk appetite is a fundamental governance input: it determines how much risk the organization is willing to accept, which directly shapes IT governance policies, control objectives, and investment priorities (e.g., how strictly to enforce security controls or how much redundancy to fund). Option D is correct because the overall business strategy defines the organization's goals, markets, and value drivers, and IT governance must align IT decisions, resources, and performance measures with those business objectives to deliver value. The unmarked options do not belong: A (number of IT employees) and B (current server capacity) are operational resource metrics rather than strategic governance inputs, and E (vendor names of installed software) is an inventory detail, not a driver of governance direction.

Answer

The number of employees in the IT department

Answer

The IT department's current server capacity

Answer

The vendor names of all installed software

Question 15

What is the primary objective of 'IT resource management' as part of IT governance?

Accepted Answer

To optimize the allocation and use of IT resources to support the business. IT resource management within IT governance exists to ensure that IT assets — people, infrastructure, applications, and budgets — are allocated and used in a way that maximizes business value and aligns with strategic objectives. It is about optimization and alignment, not cost minimization or headcount reduction. The primary objective is therefore to optimize allocation and use of IT resources to support the business.

Answer

To ensure IT staff are working 40 hours per week

Answer

To eliminate the need for IT staff through automation

Answer

To buy the cheapest available technology