CGEIT Quick Quiz — 10 Questions

Question 1

A dashboard shows that an IT project has achieved 90% of its technical deliverables, but only 20% of its anticipated benefits. What is the most appropriate management action?

Accepted Answer

Review the benefits realization plan to assess organizational change progress.. When technical deliverables are nearly complete but benefits realization is far behind, the gap typically lies in organizational change management, adoption, or process readiness rather than technical execution. The most appropriate management action is to review the benefits realization plan to diagnose why the anticipated benefits are not materializing and to address change management, training, or process issues.

Answer

Reduce the budget for the remainder of the project.

Answer

Accelerate the technical project completion to reach 100%.

Answer

Lower the benefit targets to match the current progress.

Question 2

A project is expected to deliver cost savings through automation. Which metric is the best indicator of this benefit?

Accepted Answer

The reduction in manual labor hours per transaction.. The reduction in manual labor hours per transaction directly measures the cost savings from automation, as labor hours are a primary cost driver. This metric quantifies the efficiency gain and translates directly into financial savings. It is a tangible, outcome-oriented indicator of the benefit.

Answer

The number of users trained on the new system.

Answer

The number of systems upgraded.

Answer

The total budget spent on software licenses.

Question 3

A multinational bank's board has approved an enterprise risk appetite that explicitly prohibits any single IT system outage exceeding four hours. The CIO reports that the core banking platform has experienced three outages of six hours each in the past quarter. Which action should the IT governance committee take FIRST?

Accepted Answer

Direct the CIO to present a remediation plan with timelines and interim risk mitigation controls at the next governance meeting.. A breach of the board-approved risk appetite requires the governance committee to act immediately by holding management accountable. Directing the CIO to deliver a remediation plan with timelines and interim controls restores oversight, keeps governance in its proper strategic role, and creates a traceable mechanism for monitoring until performance realigns with the stated tolerance.

Answer

Revise the enterprise risk appetite to permit six-hour outages so the platform is compliant.

Answer

Escalate the issue to the internal audit function and await its findings before taking any action.

Answer

Instruct the infrastructure team to immediately replace the core banking platform vendor.

Question 4

A government agency's IT governance committee is finalizing its governance framework. A dispute arises over who should approve exceptions to the enterprise architecture standards when a business unit needs a rapid technology deployment. Which principle should guide the committee's decision on where to place exception approval authority?

Accepted Answer

Exceptions should be approved by a designated architecture authority with defined criteria and time limits.. Exception authority should sit with a designated architecture authority operating under explicit criteria, documented rationale, and time limits, which preserves both agility and control. Self-approval by requesters, case-by-case governance committee review, and external auditor approval all misplace authority, creating conflicts, bottlenecks, or independence breaches. ISACA CGEIT guidance supports delegated decision rights bounded by criteria and escalation for material impacts.

Answer

Exceptions should be approved by the external auditor to provide independent validation of each case.

Answer

Exceptions should be approved by the requesting business unit's project manager to preserve agility.

Answer

Exceptions should be approved by the IT governance committee for every deployment to ensure consistency.

Question 5

A global retail enterprise has completed an IT-enabled supply chain transformation projected to reduce inventory carrying costs by 12%. Eighteen months after go-live, finance reports only a 4% reduction. The CIO wants to understand whether the shortfall stems from the business case assumptions or from how the capability is being used. Which action should the CIO take FIRST?

Accepted Answer

Compare actual benefit measurements against the baseline assumptions and trace the variance to specific benefit drivers and owners.. The disciplined benefits realization response to a variance is measurement against the agreed baseline followed by root-cause tracing to drivers and owners. Only after that diagnosis can the organization decide whether to correct execution, revise assumptions, or escalate. Rebaselining, premature failure declarations, and arbitrary target increases all bypass the evidence needed for sound governance decisions.

Answer

Commission a post-implementation review that re-forecasts the remaining benefits and adjusts the original business case baseline.

Answer

Direct the supply chain function to increase inventory reduction targets for the next fiscal year to recover the shortfall.

Answer

Escalate to the audit committee that the transformation has failed to deliver and recommend writing off the remaining benefits.

Question 6

An enterprise's data center lease expires in 18 months. The CIO must present a resource strategy to the board covering compute, storage and network capacity for a workload portfolio with stable legacy systems and highly variable digital channels. Which approach BEST aligns IT resource governance with business demand uncertainty?

Accepted Answer

Adopt a hybrid model that keeps stable legacy workloads on controlled infrastructure and uses elastic cloud services for variable digital channels, governed by a demand forecasting and capacity review process.. Matching infrastructure commitment to workload demand profiles, with stable systems on controlled platforms and variable channels on elastic services, optimizes resource use under uncertainty. Adding demand forecasting and recurring capacity review turns the decision into a governed, revisable process rather than a one-time bet, which is what the board needs before a lease expiry.

Answer

Commit to a full private cloud refresh sized for current peak demand across all workloads.

Answer

Migrate all workloads to public cloud immediately to eliminate the data center lease decision.

Answer

Extend the lease on a month-to-month basis and defer the capacity strategy until demand patterns become clearer.

Question 7

In the context of the COBIT 2019 framework, what does 'Governance' mean?

Accepted Answer

Evaluation, direction, and monitoring of enterprise activities.. In COBIT 2019, governance is defined as the set of activities that ensure enterprise objectives are achieved by evaluating stakeholder needs, setting direction through prioritization and decision-making, and monitoring performance and compliance. This is captured in the governance framework's core model of Evaluate, Direct, and Monitor (EDM), which sits above the management objectives. Therefore, 'evaluation, direction, and monitoring of enterprise activities' is the precise COBIT definition.

Answer

Execution of technical tasks.

Answer

Managing the budget of the IT department.

Answer

Developing software applications.

Question 8

A pharmaceutical company relies on a legacy laboratory information management system that cannot be patched and is essential for regulatory submissions. The CGEIT practitioner is updating the risk register and must select the most appropriate risk response for the confirmed inability to remediate. Which response should be documented?

Accepted Answer

Risk acceptance with documented compensating controls, executive approval, and a scheduled replacement roadmap.. Because the legacy system is essential and cannot be patched, avoidance and mitigation are infeasible, and transfer alone leaves operational and regulatory exposure unmanaged. Deliberate acceptance with compensating controls, executive approval, and a replacement roadmap keeps the residual risk visible, governed, and bounded while the business continues to meet its regulatory obligations.

Answer

Risk transfer by purchasing cyber insurance and removing the system from the risk register.

Answer

Risk avoidance by decommissioning the system immediately and halting regulatory submissions.

Answer

Risk mitigation by applying an unsupported third-party patch to the legacy system without vendor validation.

Question 9

An organization is struggling with high IT operational costs. Which governance practice is most likely to reduce these costs?

Accepted Answer

Standardizing hardware and software platforms across the enterprise. Standardizing hardware and software platforms across the enterprise reduces operational cost by shrinking the variety of systems that must be patched, licensed, supported, and staffed. Fewer platforms mean lower licensing complexity, simplified training, consolidated support contracts, and reduced integration overhead. This is a foundational IT governance cost-optimization practice rooted in portfolio and architecture management.

Answer

Increasing the frequency of vendor contract renegotiations

Answer

Outsourcing all IT infrastructure management

Answer

Eliminating the IT governance committee

Question 10

A firm identifies that its IT governance framework is too burdensome for its agile, small-team structure. What is the most appropriate governance action?

Accepted Answer

Tailor the governance system by adjusting design factors.. COBIT 2019 explicitly supports tailoring the governance system by adjusting design factors — enterprise size, goals, risk profile, and culture — so the framework fits the organization rather than forcing the organization to fit the framework. For a small, agile firm, tailoring means scaling down process rigor, reducing documentation, and focusing on the governance objectives that matter most. This is the most appropriate action because it preserves governance intent while removing unnecessary burden.

Answer

Standardize all processes across the company.

Answer

Ignore the framework until the company grows.

Answer

Appoint more auditors to monitor compliance.