CGEIT Timed Hard Questions — 25 Difficult Questions

Question 1

An enterprise's data center lease expires in 18 months. The CIO must present a resource strategy to the board covering compute, storage and network capacity for a workload portfolio with stable legacy systems and highly variable digital channels. Which approach BEST aligns IT resource governance with business demand uncertainty?

15 minute time limit — choose an answer to begin.

Accepted Answer

Adopt a hybrid model that keeps stable legacy workloads on controlled infrastructure and uses elastic cloud services for variable digital channels, governed by a demand forecasting and capacity review process.. Matching infrastructure commitment to workload demand profiles, with stable systems on controlled platforms and variable channels on elastic services, optimizes resource use under uncertainty. Adding demand forecasting and recurring capacity review turns the decision into a governed, revisable process rather than a one-time bet, which is what the board needs before a lease expiry.

Answer

Commit to a full private cloud refresh sized for current peak demand across all workloads.

Answer

Migrate all workloads to public cloud immediately to eliminate the data center lease decision.

Answer

Extend the lease on a month-to-month basis and defer the capacity strategy until demand patterns become clearer.

Question 2

A pharmaceutical company relies on a legacy laboratory information management system that cannot be patched and is essential for regulatory submissions. The CGEIT practitioner is updating the risk register and must select the most appropriate risk response for the confirmed inability to remediate. Which response should be documented?

Accepted Answer

Risk acceptance with documented compensating controls, executive approval, and a scheduled replacement roadmap.. Because the legacy system is essential and cannot be patched, avoidance and mitigation are infeasible, and transfer alone leaves operational and regulatory exposure unmanaged. Deliberate acceptance with compensating controls, executive approval, and a replacement roadmap keeps the residual risk visible, governed, and bounded while the business continues to meet its regulatory obligations.

Answer

Risk transfer by purchasing cyber insurance and removing the system from the risk register.

Answer

Risk avoidance by decommissioning the system immediately and halting regulatory submissions.

Answer

Risk mitigation by applying an unsupported third-party patch to the legacy system without vendor validation.

Question 3

A financial services firm has a mature IT governance framework, but recent audits revealed that IT risk decisions are often made without considering the enterprise's overall risk appetite. The board wants to ensure that IT risk management is fully integrated with enterprise risk management (ERM). Which of the following actions should the CIO take FIRST to address this gap?

Accepted Answer

Establish a formal process to align IT risk tolerance with the enterprise risk appetite.. The audit finding shows IT risk decisions are made in isolation from the enterprise risk appetite. The most direct and foundational action is to establish a formal process that translates the enterprise risk appetite into IT risk tolerance, ensuring that IT risk management operates within the board's defined boundaries. This integrates IT risk with ERM and addresses the root cause, whereas other actions are either too narrow or misdirected.

Answer

Increase the frequency of IT risk assessments to quarterly.

Answer

Delegate all IT risk decisions to the enterprise risk management committee.

Answer

Update the IT risk register to include all enterprise risks.

Question 4

A firm identifies that its IT governance framework is too burdensome for its agile, small-team structure. What is the most appropriate governance action?

Accepted Answer

Tailor the governance system by adjusting design factors.. COBIT 2019 explicitly supports tailoring the governance system by adjusting design factors — enterprise size, goals, risk profile, and culture — so the framework fits the organization rather than forcing the organization to fit the framework. For a small, agile firm, tailoring means scaling down process rigor, reducing documentation, and focusing on the governance objectives that matter most. This is the most appropriate action because it preserves governance intent while removing unnecessary burden.

Answer

Standardize all processes across the company.

Answer

Ignore the framework until the company grows.

Answer

Appoint more auditors to monitor compliance.

Question 5

A financial services company is evaluating its IT resource allocation for the upcoming fiscal year. The CIO presents a plan that allocates 85% of the IT budget to maintaining existing infrastructure and only 15% to new strategic initiatives. The board has mandated a digital transformation agenda. Which governance action should the IT steering committee take?

Accepted Answer

Direct the CIO to develop a revised IT investment portfolio that gradually shifts resources towards strategic initiatives while maintaining essential operations.. The IT steering committee should direct the CIO to create a revised investment portfolio that gradually shifts resources toward strategic initiatives. This balances the need for digital transformation with the necessity of maintaining critical operations, ensuring governance oversight and strategic alignment without introducing undue operational risk.

Answer

Approve the budget as presented to ensure operational stability.

Answer

Escalate the decision to the board of directors for a final ruling on the budget.

Answer

Reject the budget and demand an immediate increase in the strategic allocation to 50%.

Question 6

Which TWO of the following factors should influence the frequency of risk reporting to the board?

Accepted Answer

The current risk posture and volatility of the environment.. Option B is correct because the frequency of risk reporting should be driven by the organization's current risk posture and the volatility of its environment — when risk levels are elevated or the threat landscape is changing rapidly, the board needs more frequent updates to maintain effective oversight. Option E is correct because risks that are significant to business objectives (for example, those threatening critical services, regulatory compliance, or strategic goals) warrant more frequent reporting than low-impact risks, since the board's primary governance role is to protect the achievement of those objectives. The remaining options do not belong: the size of the IT office building (A) is a physical facility detail with no bearing on governance reporting cadence, the number of years board members have served (C) is a tenure consideration unrelated to risk materiality or volatility, and the color of the report cover page (D) is a cosmetic formatting choice with no impact on reporting frequency.

Answer

The size of the IT office building.

Answer

The number of years the board members have served.

Answer

The color of the risk report cover page.

Question 7

Which THREE activities are required when managing the 'Benefits Lifecycle'?

Accepted Answer

Tracking the realization of benefits after implementation.. The Benefits Lifecycle requires identifying and quantifying potential benefits (E) so that expected value is defined, measurable, and agreed before delivery begins. It also requires ensuring project deliverables align with business requirements (C), because benefits can only be realized if the outputs actually satisfy the intended business outcomes. Finally, it requires tracking the realization of benefits after implementation (B), since benefits management continues post-delivery to verify that the forecast value is actually achieved. Options A and D do not belong: reducing stakeholder numbers is not a benefits lifecycle activity, and updating source code documentation is a technical maintenance task unrelated to benefits management.

Answer

Reducing the number of project stakeholders.

Answer

Updating the project's source code documentation.

Question 8

A healthcare provider's IT organization relies heavily on a small group of specialists who maintain a legacy clinical records interface. The specialists are approaching retirement, and documentation is sparse. The governance committee is asked to address this human resource risk. Which action BEST aligns with IT resource governance objectives?

Accepted Answer

Commission a knowledge transfer program that documents the interface, cross-trains additional staff, and sets a succession timeline. Human capital is a core IT resource, and concentrated knowledge in a few individuals is a governance risk to service continuity. A knowledge transfer program that documents the interface, cross-trains staff, and establishes a succession timeline reduces that concentration and builds durable capability. Retention bonuses, replacement projects, and contract staffing each leave the fundamental single-point-of-failure exposure in place.

Answer

Engage a staffing agency to provide contract specialists who can step in if any of the current specialists leave

Answer

Approve a retention bonus program to keep the specialists employed for as long as possible

Answer

Initiate a project to replace the legacy interface with a modern platform, eliminating the need for the specialists' skills

Question 9

An organization's governance committee decides to stop funding a legacy IT system that is still critical for a specific department. What should be done?

Accepted Answer

Conduct an impact analysis and develop a migration strategy.. When funding is withdrawn from a system that remains critical to a department, the governance-driven response is to assess the business and operational impact and plan a controlled transition rather than abruptly terminating service. An impact analysis identifies dependencies, data retention needs, and continuity risks, while a migration strategy provides a governed path to a replacement or alternative. This preserves business continuity while respecting the committee's funding decision.

Answer

Decommission it immediately to save money.

Answer

Force the department to find their own funding.

Answer

Ignore the committee's decision and keep paying.

Question 10

When assessing the feasibility of a project, why is it necessary to evaluate the 'risk of benefit realization'?

Accepted Answer

To determine if the expected value can realistically be achieved under current conditions.. Evaluating the risk of benefit realization determines whether the projected business value can actually be delivered given current organizational, technical, and market conditions. It separates optimistic benefit forecasts from achievable outcomes by factoring in uncertainty, dependencies, and constraints. This assessment directly informs investment decisions and whether the business case is defensible.

Answer

To ensure the project follows the vendor's best practices.

Answer

To ensure the technical project has no bugs.

Answer

To reduce the number of stakeholders involved.

Question 11

A governance review reveals that IT decision-making is too slow to support rapid market changes. What should be done?

Accepted Answer

Delegate specific decision-making authorities to lower levels based on defined thresholds. When governance slows decision-making, the correct remedy is to redesign decision rights, not to remove oversight or centralise further. Delegating specific authorities to lower levels with defined thresholds (e.g., spend limits, risk tiers) preserves accountability while enabling speed. This is a core principle of effective governance design — matching decision latency to the pace of the business.

Answer

Require the board of directors to approve every IT change

Answer

Remove all governance oversight requirements to speed up decisions

Answer

Stop all development until the governance process is redesigned

Question 12

An organization's risk appetite has been set as 'low' for data breaches. A new project introduces a moderate risk of a breach. What is the most appropriate governance action?

Accepted Answer

Implement additional security controls to bring the residual risk within the 'low' appetite.. The organization has explicitly set a 'low' risk appetite for data breaches, meaning any risk above that threshold is unacceptable without treatment. Since the project introduces a moderate breach risk that exceeds the stated appetite, governance must direct treatment — implementing additional controls to reduce residual risk to within the 'low' appetite. This preserves both the project's value and the board-approved risk posture, which is the core purpose of risk appetite-driven governance.

Answer

Accept the risk because the project is strategically important.

Answer

Lower the 'low' appetite threshold to 'moderate'.

Answer

Document the risk in the risk register and ignore it for now.

Question 13

An organization adopts a multi-cloud strategy. Which governance challenge is most significant regarding resource optimization?

Accepted Answer

The lack of consistent visibility, policy enforcement, and cost management across platforms. In a multi-cloud environment, the dominant governance challenge for resource optimisation is the fragmentation of visibility, policy, and cost control across providers. Each cloud has its own management console, IAM model, tagging conventions, and billing structure, making it difficult to enforce consistent governance or optimise spend holistically. This fragmentation — not provisioning speed or talent — is what undermines governance effectiveness.

Answer

The slower speed of provisioning resources

Answer

The difficulty of finding cloud architects

Answer

The increased cost of data egress fees between clouds

Question 14

A corporation is shifting from a centralized to a decentralized IT structure. How does this affect governance?

Accepted Answer

Governance must define common standards while allowing local decision-making flexibility.. When IT shifts from centralized to decentralized, governance must adapt by defining common enterprise-wide standards (security, data, architecture) while granting business units flexibility for local decisions. This federated model preserves enterprise coherence without stifling local responsiveness. Governance does not disappear — it changes form to balance control and autonomy.

Answer

The board should take over all local IT decisions.

Answer

The governance framework is no longer required.

Answer

Decentralization makes IT governance impossible.

Question 15

A project delivers a new system, but the benefits are not realized due to an outdated manual process that was not updated. Where did the benefits management plan fail?

Accepted Answer

In the business change management and process alignment components.. Benefits realization depends not only on delivering the technology but also on changing the business processes and organizational behaviors that surround it. If an outdated manual process remains in place after the system goes live, the expected benefits cannot materialize — this is a failure of the business change management and process alignment components of the benefits management plan.

Answer

In the software coding standards.

Answer

In the technical design phase.

Answer

In the project budget management.

Question 16

An organization is merging with another company. How should the governance structures be reconciled?

Accepted Answer

Conduct a gap analysis and develop a unified governance framework.. When merging organizations, governance structures should be reconciled through a gap analysis that identifies differences, overlaps, and best practices, followed by development of a unified framework. This ensures the merged entity has a coherent governance model aligned with its new strategy, risk profile, and regulatory obligations. Simply adopting one side's framework or keeping both creates inconsistency and accountability gaps.

Answer

Adopt the framework of the company with more employees.

Answer

Keep both frameworks as they are.

Answer

Abandon both frameworks and start from scratch.

Question 17

An organization experiences a high frequency of minor IT incidents. What is the most effective governance action to ensure this does not result in a significant enterprise risk?

Accepted Answer

Implementing a root cause analysis (RCA) program to identify systemic patterns across recurring incidents.. The most effective governance action is to implement a root cause analysis (RCA) program to identify systemic patterns across recurring incidents. This addresses the underlying causes rather than symptoms, preventing minor incidents from accumulating into a significant enterprise risk. Governance focuses on systemic improvement, not just operational fixes.

Answer

Updating the incident management policy to mandate shorter SLA targets.

Answer

Increasing the budget for incident response staff.

Answer

Requiring all incidents to be reported directly to the board of directors.

Question 18

When planning for the retirement of legacy systems, which factor is most critical for resource optimization?

Accepted Answer

Detailed mapping of interdependencies and data flows with current systems. When retiring legacy systems, the most critical factor for resource optimization is a detailed mapping of interdependencies and data flows between the legacy system and current systems. Without this map, retirement can break integrations, orphan data, or trigger unplanned remediation work that consumes more resources than the retirement saves. Understanding dependencies enables sequenced decommissioning and accurate resource forecasting.

Answer

The initial cost of implementing the system

Answer

The amount of documentation available for the system

Answer

The age of the hardware

Question 19

When implementing a resource governance policy, which action is most critical to success?

Accepted Answer

Securing executive sponsorship and driving organizational buy-in. Executive sponsorship and organizational buy-in are the most critical success factors because resource governance policies require authority to enforce trade-offs, resolve conflicts, and change behavior across silos. Without top-level sponsorship, even well-designed policies lack the mandate to be adopted and sustained.

Answer

Hiring a dedicated resource governance manager

Answer

Automating all policy enforcement mechanisms

Answer

Creating a 500-page policy document covering every scenario

Question 20

Which of the following is an example of an 'indirect' benefit?

Accepted Answer

Improved employee morale and productivity due to better UI.. Improved employee morale and productivity due to a better UI is an indirect benefit because it is a secondary, often intangible outcome that flows from the system rather than being a directly measurable financial return. Indirect benefits are harder to quantify but still contribute to organizational value.

Answer

Increased revenue from new digital sales channels.

Answer

Decrease in server hardware acquisition costs.

Answer

Reduction in annual software maintenance costs.