CGEIT Multiple Select — 20 Questions

Question 1

A healthcare provider is evaluating its IT resource sourcing strategy. The CIO wants to ensure that the strategy supports both cost efficiency and compliance with patient data regulations. Which TWO of the following governance actions are MOST important to include in the sourcing strategy? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establish a regular review process to monitor vendor performance against both cost and compliance metrics.. A sourcing strategy that supports cost efficiency and compliance must include rigorous vendor evaluation before contracting and continuous monitoring after. These actions ensure that vendors meet regulatory requirements and cost targets throughout the relationship. The other options either impose unnecessary technical constraints, bypass governance, or concentrate risk without addressing compliance.

Answer

Outsource all IT functions to a single vendor to achieve economies of scale.

Answer

Delegate all sourcing decisions to the procurement department to expedite contracting.

Answer

Require all vendors to use the same technology stack as the healthcare provider to simplify integration.

Question 2

Which TWO of the following factors should influence the frequency of risk reporting to the board?

Accepted Answer

The current risk posture and volatility of the environment.. Option B is correct because the frequency of risk reporting should be driven by the organization's current risk posture and the volatility of its environment — when risk levels are elevated or the threat landscape is changing rapidly, the board needs more frequent updates to maintain effective oversight. Option E is correct because risks that are significant to business objectives (for example, those threatening critical services, regulatory compliance, or strategic goals) warrant more frequent reporting than low-impact risks, since the board's primary governance role is to protect the achievement of those objectives. The remaining options do not belong: the size of the IT office building (A) is a physical facility detail with no bearing on governance reporting cadence, the number of years board members have served (C) is a tenure consideration unrelated to risk materiality or volatility, and the color of the report cover page (D) is a cosmetic formatting choice with no impact on reporting frequency.

Answer

The size of the IT office building.

Answer

The number of years the board members have served.

Answer

The color of the risk report cover page.

Question 3

Which THREE activities are required when managing the 'Benefits Lifecycle'?

Accepted Answer

Tracking the realization of benefits after implementation.. The Benefits Lifecycle requires identifying and quantifying potential benefits (E) so that expected value is defined, measurable, and agreed before delivery begins. It also requires ensuring project deliverables align with business requirements (C), because benefits can only be realized if the outputs actually satisfy the intended business outcomes. Finally, it requires tracking the realization of benefits after implementation (B), since benefits management continues post-delivery to verify that the forecast value is actually achieved. Options A and D do not belong: reducing stakeholder numbers is not a benefits lifecycle activity, and updating source code documentation is a technical maintenance task unrelated to benefits management.

Answer

Reducing the number of project stakeholders.

Answer

Updating the project's source code documentation.

Question 4

Which TWO factors are essential for a successful benefits realization culture?

Accepted Answer

A focus on learning from both successes and failures.. Option A is correct because a benefits realization culture depends on continuous learning: organizations must systematically capture lessons from both successful and failed initiatives and feed them back into portfolio and program decisions, which is a core principle in frameworks such as Managing Successful Programmes (MSP) and the Benefits Realization Management (BRM) discipline. Option C is correct because clear accountability for benefit achievement ensures that named owners are responsible for defining, tracking, and reporting benefits through the benefits register and benefits realization plan, preventing benefits from being orphaned after project delivery. The remaining options do not belong: requiring all employees to learn programming (B) is a skills mandate unrelated to benefits realization, frequent updates to the technical architecture (D) is an IT maintenance activity rather than a cultural factor, and reducing the number of board meetings (E) would weaken governance and oversight of benefits rather than strengthen a benefits realization culture.

Answer

Requiring all employees to learn programming.

Answer

Frequent updates to the technical architecture.

Answer

Reducing the number of board meetings.

Question 5

A manufacturing firm's CIO is establishing benefits ownership for a portfolio of IT-enabled change programs. The steering committee wants to ensure each benefit has clear accountability so that realization can be tracked and intervened upon. Which TWO of the following are essential components of effective benefits ownership? (Choose two.)

Accepted Answer

A named business owner who is accountable for the outcome and has authority over the processes that generate the benefit.. Effective benefits ownership requires an accountable business owner with authority over the process that generates the benefit, plus an agreed measure with baseline and target. Together these create a clear contract for delivery and a basis for intervention. Tracking by the PMO, custody by finance, or executive reporting are supporting mechanisms but do not themselves establish ownership or make the benefit measurable.

Answer

Assignment of benefit tracking to the project management office for the duration of the program.

Answer

A commitment from the CIO to report benefit status directly to the board each quarter.

Answer

A benefits register maintained exclusively by the finance department to ensure consistency of valuation.

Question 6

Which TWO stakeholders are essential for successful IT governance?

Accepted Answer

Executive Management. Executive Management (C) is essential because IT governance requires top leadership to set strategic direction, approve IT policies, allocate budgets, and ensure IT investments align with business objectives and risk appetite. The Board of Directors (D) is also essential because it provides ultimate oversight and accountability, ensuring that IT governance frameworks, risk management, and compliance obligations are met at the highest organizational level. Together, these two stakeholders supply the authority, strategic alignment, and oversight that define successful IT governance. Local IT repair technicians (A) perform operational support tasks rather than governance-level decision-making, delivery drivers (B) are unrelated to IT governance, and external janitorial staff (E) have no governance role, so none of these belong.

Answer

Local IT repair technicians

Answer

Delivery drivers

Answer

External janitorial staff

Question 7

To effectively integrate risk management into enterprise governance, which THREE activities should be conducted?

Accepted Answer

Defining the enterprise risk appetite in quantitative or qualitative terms.. Option A is correct because defining the enterprise risk appetite in quantitative or qualitative terms establishes the boundaries and thresholds against which all risk decisions are made, which is foundational for embedding risk management into governance. Option B is correct because establishing clear accountability for risk ownership at the executive level ensures that risk decisions are tied to strategic objectives and that someone with authority is answerable for outcomes, a core governance principle. Option D is correct because integrating risk reporting into the existing enterprise performance management process embeds risk into the same metrics, reviews, and decision cycles used to steer the business, making risk management continuous rather than a separate exercise. Option C is not correct because standardizing the CMDB structure is an IT service management configuration task, not a governance-level risk management activity. Option E is not correct because outsourcing the primary data center to a tier-one cloud provider is a specific sourcing decision that may address some risks but does not itself integrate risk management into enterprise governance.

Answer

Standardizing the IT configuration management database (CMDB) structure.

Answer

Outsourcing the primary data center to a tier-one cloud provider.

Question 8

Which TWO of the following are considered key elements of a robust Benefits Realization Plan (BRP)?

Accepted Answer

Clear identification of benefits and their owners.. Option D is correct because a robust Benefits Realization Plan must explicitly identify each intended benefit and assign a named benefit owner who is accountable for its delivery and tracking, ensuring benefits are actively managed rather than assumed. Option E is correct because the BRP requires defined metrics with baseline performance measurements so that benefit delivery can be quantified and compared against the pre-project state, enabling objective realization tracking. Options A, B, and C do not belong: vendor licensing terms, a project team contact list, and technical architectural diagrams are project or solution artifacts that support delivery but do not constitute the benefit identification, ownership, measurement, and baselining elements that define a BRP.

Answer

Detailed software vendor licensing terms.

Answer

Project team contact list.

Answer

Technical architectural diagrams.

Question 9

Which THREE metrics are commonly used to measure the success of an IT investment?

Accepted Answer

Customer satisfaction or Net Promoter Score (NPS).. Customer satisfaction or Net Promoter Score (NPS) (B) is a standard success metric because it captures the perceived value and user adoption of the IT investment, which ultimately drives retention and business outcomes. Return on Investment (ROI) (C) is correct because it directly compares the financial gains from the investment against its costs, expressing profitability as a percentage. Net Present Value (NPV) (D) is also correct because it discounts future cash flows to present value, showing whether the investment adds economic value after accounting for the time value of money. In contrast, total cost of software development (A) is only an input cost, not a measure of success, and the number of hours the development team worked (E) is an effort or productivity input rather than an outcome-based success metric.

Answer

Total cost of software development.

Answer

The number of hours the development team worked.

Question 10

Which THREE of the following represent effective ways to integrate IT risk into the organizational culture?

Accepted Answer

Regular risk management training for all staff.. Option A is correct because regular risk management training for all staff builds awareness and embeds risk thinking into daily decision-making, which is a core mechanism for shaping organizational culture. Option C is correct because linking performance bonuses to risk management outcomes aligns individual incentives with risk-aware behavior, reinforcing the desired culture through measurable accountability. Option D is correct because executive sponsorship of risk management initiatives signals top-down commitment, sets the tone at the top, and legitimizes risk management as a shared organizational value. Options B and E do not belong: changing the corporate logo is a cosmetic branding action with no bearing on risk culture, and reducing IT staff is a headcount decision that neither integrates risk into culture nor necessarily improves risk management.

Answer

Changing the corporate logo.

Answer

Reducing the number of IT staff.

Question 11

Which THREE of the following are elements of a strong IT resource governance policy?

Accepted Answer

Defined KPIs and metrics to measure the effectiveness of resource usage. Option C is correct because a strong IT resource governance policy must include defined KPIs and metrics, such as utilization rates, cost-per-workload, or service availability targets, so that resource usage can be objectively measured, reported, and continuously improved. Option D is correct because standardized processes for requesting, approving, and allocating resources establish a repeatable, auditable workflow that prevents ad hoc provisioning, enforces budget and capacity controls, and ensures resources are assigned consistently across the organization. Option E is correct because clearly defined roles, responsibilities, and decision-making authorities (for example, distinguishing resource owners, approvers, and accountable executives via a RACI model) ensure accountability and prevent gaps or conflicts in governance. Option A does not belong because individual employee salaries are confidential HR/payroll data, not a governance element, and including them would create privacy and compliance risks. Option B does not belong because listing vendor passwords is a serious security anti-pattern; credentials must be managed through a secrets vault or privileged access management system, never documented in a policy.

Answer

A list of all individual employee salaries

Answer

A list of all vendor passwords

Question 12

Which THREE of the following are essential elements of an IT risk governance policy?

Accepted Answer

Procedures for reporting and escalating risks. Option A is correct because an IT risk governance policy must define how risks are reported and escalated through the organization, ensuring timely visibility to appropriate management levels and enabling consistent response. Option C is correct because the policy must establish the enterprise's risk appetite and tolerance levels, which set the boundaries for acceptable risk and guide decision-making on risk treatment. Option E is correct because clear roles and responsibilities for risk ownership are essential to assign accountability for identifying, assessing, and managing risks across the organization. Option B is not correct because the physical location of backup tapes is an operational or asset-management detail, not a governance policy element. Option D is not correct because a list of software vendors is an inventory artifact rather than a governance principle.

Answer

The physical location of all backup tapes

Answer

A list of all software vendors currently in use

Question 13

Which THREE of the following are key aspects of workforce planning in IT?

Accepted Answer

Implementing retention strategies for key talent. Workforce planning in IT focuses on ensuring the organization has the right skills, in the right roles, at the right time, so option A (implementing retention strategies for key talent) is correct because keeping scarce, high-value IT skills such as cloud architects or cybersecurity specialists reduces knowledge loss, recruitment cost, and project risk. Option B (developing training and professional development programs) is correct because closing skill gaps through upskilling and reskilling in areas like DevOps, data analytics, or AI directly addresses forecasted competency shortages. Option D (identifying current and future competency requirements) is correct because it is the foundational step of workforce planning: comparing the existing skills inventory against projected demand from business and technology roadmaps. Option C (selecting the IT department's holiday party venue) is incorrect because it is an event-planning or facilities task with no bearing on staffing supply, demand, or skills. Option E (mandatory office attendance policies) is incorrect because it is a workplace-arrangement or HR policy decision, not a workforce planning activity concerned with competency supply and demand.

Answer

Selecting the IT department's holiday party venue

Answer

Mandatory office attendance policies

Question 14

Which TWO of the following are effective strategies for optimizing workforce resources?

Accepted Answer

Using a flexible resource model for non-core, variable IT activities. Option B is correct because a flexible resource model (e.g., leveraging contractors, managed service providers, or on-demand staffing) lets an organization scale capacity up or down for non-core, variable IT activities, avoiding the cost of idle full-time employees while maintaining service levels. Option E is correct because cross-training builds a broader skill base, enabling staff to cover multiple roles, improving utilization, reducing single points of failure, and increasing scheduling flexibility without adding headcount. Option A is not a workforce optimization strategy; reducing performance reviews weakens feedback, development, and accountability rather than improving resource efficiency. Option C is incorrect because mandating five days in the office removes flexibility and can reduce retention and productivity, and it does not optimize resource allocation. Option D is incorrect because adding management layers increases overhead, slows decision-making, and consumes resources rather than optimizing them.

Answer

Reducing the frequency of staff performance reviews

Answer

Requiring all staff to work in the office five days a week

Answer

Increasing the number of layers in the management hierarchy

Question 15

Which TWO are common IT governance structures?

Accepted Answer

Architecture Review Board. An Architecture Review Board (A) is a recognized IT governance structure because it provides formal oversight and decision-making authority over architecture standards, technology choices, and design compliance across projects. An IT Steering Committee (E) is also a standard governance body, typically composed of senior business and IT leaders who prioritize IT investments, align IT strategy with business goals, and approve major initiatives. The Coffee and Donut Club (B) is a social group with no governance authority, decision rights, or accountability for IT outcomes. A Software testing team (C) is an operational delivery function focused on quality assurance, not on setting or enforcing governance policy. Help desk support (D) is a service management/operations function that resolves user incidents, not a governance structure that directs IT strategy or standards.

Answer

Coffee and Donut Club

Answer

Software testing team

Answer

Help desk support

Question 16

A global insurer is expanding its use of cloud-hosted underwriting platforms. The CIO proposes a single enterprise risk register entry for 'cloud provider outage,' with quarterly review by the IT steering committee. The board risk committee has asked the CGEIT practitioner to strengthen the integration of IT risk with enterprise risk management. Which TWO actions best align the IT risk taxonomy and reporting with the enterprise risk framework? (Choose two.)

Accepted Answer

Define IT risk appetite thresholds in business terms such as maximum tolerable downtime for underwriting services and incorporate them into the enterprise risk appetite statement.. Integrating IT risk with enterprise risk management requires a shared taxonomy and appetite expressed in business terms. Mapping cloud outage scenarios to the enterprise taxonomy lets the board see technology exposure within operational resilience, while defining thresholds such as maximum tolerable downtime embeds IT risk into the enterprise risk appetite statement. Together these actions align reporting, prioritization, and governance oversight across the organization.

Answer

Delegate all cloud risk decisions to the third-party provider's risk team and accept their residual risk assessment as the enterprise view.

Answer

Increase the frequency of vulnerability scans on the underwriting platform and report the raw scan counts directly to the board risk committee.

Answer

Consolidate all cloud contracts under a single procurement owner to reduce the number of vendor relationships managed by IT.

Question 17

A hospital's IT governance committee is reviewing its IT resource management practices. The committee wants to ensure that IT resources are effectively governed to support clinical and administrative needs. Which TWO of the following are key components of an effective IT resource governance framework? (Choose two.)

Accepted Answer

Clearly defined roles and responsibilities for IT resource management, including ownership and stewardship.. The two key components are clearly defined roles and responsibilities and continuous monitoring and reporting. These provide the accountability and data-driven oversight necessary for effective IT resource governance. They ensure that resources are managed with clear ownership and that performance and utilization are regularly assessed to support informed decision-making and alignment with organizational objectives.

Answer

An annual external audit of all IT resource expenditures to ensure cost minimization.

Answer

A decentralized approach where each department independently manages its own IT resources without central coordination.

Answer

A policy that mandates the use of a single vendor for all IT hardware and software to simplify management.

Question 18

A retail enterprise's IT steering committee is reviewing how application portfolio resources should be governed. The portfolio has grown to over 400 applications, many with overlapping functionality and unclear ownership. The committee wants to establish a repeatable governance process for rationalizing the portfolio. Which TWO of the following actions are MOST effective for this purpose? (Choose two.)

Accepted Answer

Mandate that all new application acquisitions follow a standardized business case and architecture review process. Effective application portfolio governance rests on two pillars: visibility and prevention. An inventory with capability mapping and ownership provides the visibility needed to make rationalization decisions, while a standardized intake process prevents new duplication from accumulating. Together they form a repeatable, evidence-based cycle. Delegation, arbitrary targets, and wholesale replacement each fail to establish sustainable governance over application resources.

Answer

Set a fixed target of retiring 25% of applications within twelve months to create urgency for the rationalization effort

Answer

Migrate the entire portfolio to a single vendor's SaaS platform to eliminate integration and ownership complexity

Answer

Delegate all application retirement decisions to individual business unit leaders to accelerate the rationalization process

Question 19

A global retailer is implementing a new enterprise resource planning (ERP) system. The CGEIT practitioner is tasked with ensuring that risk optimization is embedded throughout the project lifecycle. Which TWO of the following actions are most critical to achieve this? (Choose two.)

Accepted Answer

Establish a risk register that is reviewed at key project milestones.. Embedding risk optimization in the ERP project lifecycle requires continuous risk assessment and a dynamic risk register reviewed at milestones. These actions ensure risks are managed proactively. Assigning all risk to one person, conducting a one-time assessment, or delegating decisions to the vendor are ineffective and misaligned with governance.

Answer

Conduct a single comprehensive risk assessment at the project's initiation.

Answer

Assign risk ownership to the project manager for all identified risks.

Answer

Delegate all risk decisions to the ERP vendor to leverage their expertise.

Question 20

A hospital's board has established a risk appetite that prioritizes patient safety over cost efficiency. The CGEIT practitioner is reviewing IT investment proposals and must ensure they align with this risk appetite. Which TWO of the following actions best demonstrate alignment with the board's risk appetite? (Choose two.)

Accepted Answer

Prioritize funding for a redundant electronic health record (EHR) system to minimize downtime risk, even though it increases costs.. The board's risk appetite prioritizes patient safety over cost efficiency. Therefore, investments that increase costs but reduce patient safety risks—such as redundant EHR systems and clinical decision support tools—are aligned. Actions that cut costs by deferring security patching, outsourcing to low-cost providers, or reducing backup testing increase patient safety risks and thus misalign with the stated appetite.

Answer

Outsource the management of patient monitoring systems to a low-cost provider to reduce expenses and free up internal resources.

Answer

Defer security patching on medical devices to avoid disrupting clinical workflows, as patient safety takes precedence.

Answer

Reduce the frequency of backup testing for clinical databases to save on operational costs, since backups are rarely needed.