CGEIT Risk Optimization — 20 Questions

Question 1

When the board of directors requests a report on the current IT risk posture, which metric is most effective for demonstrating alignment between risk appetite and investment?

Accepted Answer

Total dollar value of IT capital expenditure.. The risk-adjusted return on investment or the coverage of critical business processes by risk mitigation controls provides the board with actionable insight into how risk appetite is being honored.

Answer

Number of open high-severity security patches.

Answer

Average response time for IT service desk tickets.

Answer

Historical count of phishing emails blocked by the email gateway.

Question 2

When reporting IT risk to the board, which of the following provides the most value?

Accepted Answer

A heat map showing the impact of top risks on business value drivers.. Boards need context, trends, and business impact rather than technical metrics.

Answer

A list of all open vulnerabilities categorized by severity.

Answer

The total number of security incidents reported in the last quarter.

Answer

A detailed technical audit report of the firewall configurations.

Question 3

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

To serve as an early warning signal of potential risk events.. KRIs are early warning signs that risk exposure is changing.

Answer

To ensure that all employees have completed security awareness training.

Answer

To provide a detailed log of all security threats blocked by the firewall.

Answer

To measure the success of past risk mitigation strategies.

Question 4

An enterprise is evaluating the trade-off between the cost of risk mitigation and the potential business benefit. Which framework or approach should the practitioner use?

Accepted Answer

Return on Security Investment (ROSI).. Cost-benefit analysis in risk management is fundamental to risk optimization.

Answer

Total Cost of Ownership (TCO) analysis.

Answer

Key Risk Indicator (KRI) dashboarding.

Answer

Business Impact Analysis (BIA).

Question 5

What is the most effective way to ensure that IT risk management is integrated with enterprise risk management (ERM)?

Accepted Answer

Aligning the IT risk taxonomy and reporting thresholds with the corporate ERM framework.. Common language and metrics are required for cross-departmental risk alignment.

Answer

Moving the IT risk management function under the responsibility of the Chief Financial Officer.

Answer

Requiring IT to report risks directly to the Chief Risk Officer on a weekly basis.

Answer

Mandating that IT uses the same risk assessment software as the finance department.

Question 6

An IT project is identified as having a high inherent risk that exceeds the board-approved appetite. The project is critical for competitive advantage. Which approach is most appropriate?

Accepted Answer

Present a business case to the board for formal risk acceptance with compensatory controls.. Governance allows for risk acceptance at the appropriate level if the business value is high.

Answer

Implement excessive controls regardless of project cost.

Answer

Direct the IT team to lower the risk by reducing project scope.

Answer

Cancel the project immediately to maintain compliance.

Question 7

An organization is transitioning to a cloud-based infrastructure. Which governance mechanism is most effective for ensuring that the cloud service provider's risk management practices remain aligned with the enterprise's risk appetite?

Accepted Answer

Embedding ongoing risk assessment requirements into the service provider contract.. Continuous monitoring and contractual requirements are key for third-party risk governance.

Answer

Performing an annual penetration test on the provider's infrastructure.

Answer

Mandating a SOC 2 Type II report review on an annual basis.

Answer

Establishing clear service level agreements (SLAs) with penalty clauses for downtime.

Question 8

During an IT governance board meeting, the CGEIT practitioner notices that the current risk profile deviates significantly from the approved risk appetite. What is the most appropriate next step?

Accepted Answer

Formally report the variance to the board and propose a remediation plan.. Governance requires transparency and corrective action when thresholds are exceeded.

Answer

Update the enterprise risk management policy to include the new risks.

Answer

Instruct the IT department to stop all new projects until the risk is lowered.

Answer

Adjust the risk appetite levels to match the current risk profile.

Question 9

An enterprise is aligning its IT risk appetite with corporate strategic objectives. Which action should the CGEIT-certified practitioner prioritize first?

Accepted Answer

Define the enterprise risk capacity based on strategic objectives.. Aligning risk appetite requires a clear understanding of the enterprise's strategic goals and its capacity to absorb loss.

Answer

Draft the IT risk register for department heads.

Answer

Conduct a technical vulnerability scan of all production servers.

Answer

Implement an automated GRC risk dashboard.

Question 10

When assessing the impact of a risk, what is the best perspective to take?

Accepted Answer

The effect on business objectives and value delivery.. Impact is defined by the loss of business value, not technical downtime.

Answer

The cost of the hardware that needs to be replaced.

Answer

The percentage of the IT budget consumed by the incident.

Answer

The number of hours required to restore the system.

Question 11

A company is using a risk maturity model to improve its IT risk management. What is the main benefit?

Accepted Answer

To establish a baseline and track improvements over time.. Maturity models identify gaps to allow for targeted improvements.

Answer

To automatically reduce the cost of IT security.

Answer

To force all departments to use the same IT tools.

Answer

To determine exactly how many employees are needed in the risk department.

Question 12

Which role is typically responsible for the final acceptance of IT risks at the enterprise level?

Accepted Answer

The Chief Information Officer (CIO) or the Board.. Senior management/Board accountability is required for enterprise risk.

Answer

The Network Engineer.

Answer

The external auditor.

Answer

The IT Security Manager.

Question 13

An enterprise is adopting an agile development methodology. How should the CGEIT-certified practitioner modify the risk governance process?

Accepted Answer

Implement automated security scanning within the CI/CD pipeline.. Governance must adapt to the velocity of agile without sacrificing oversight.

Answer

Require a formal risk assessment for every sprint cycle.

Answer

Remove risk governance requirements until the project reaches the production phase.

Answer

Replace the risk register with a daily stand-up meeting for risk tracking.

Question 14

A company is performing a risk assessment of a new software vendor. Which factor is most relevant for the governance of third-party risk?

Accepted Answer

The nature of the data accessed or processed by the vendor.. Third-party risk management is rooted in understanding the criticality of the service provided.

Answer

The location of the software vendor's headquarters.

Answer

The number of employees working for the software vendor.

Answer

The brand reputation of the software vendor.

Question 15

An organization's risk appetite has been set as 'low' for data breaches. A new project introduces a moderate risk of a breach. What is the most appropriate governance action?

Accepted Answer

Implement additional security controls to bring the residual risk within the 'low' appetite.. If a project exceeds appetite, controls must be enhanced or the project must be modified.

Answer

Accept the risk because the project is strategically important.

Answer

Lower the 'low' appetite threshold to 'moderate'.

Answer

Document the risk in the risk register and ignore it for now.

Question 16

The board of directors requests a summary of the current IT risk posture. Which documentation should the practitioner use as the primary source?

Accepted Answer

The latest enterprise risk register.. The enterprise risk register provides the consolidated view required by the board.

Answer

The system administrator's patch management reports.

Answer

The IT department's operational incident logs.

Answer

The annual budget allocation for IT security.

Question 17

An enterprise is facing a high-impact risk that cannot be fully mitigated. The board decides to transfer this risk. Which of the following is the best implementation of risk transfer?

Accepted Answer

Purchasing comprehensive cyber-insurance to cover potential financial losses.. Risk transfer is about moving financial liability, not operational responsibility.

Answer

Moving all data to a public cloud provider.

Answer

Outsourcing the entire IT department to a third-party managed service provider.

Answer

Signing an indemnity clause in a software license agreement.

Question 18

Why is it important to define risk appetite before developing a risk response plan?

Accepted Answer

To provide a threshold for determining which risks require action.. Appetite acts as the boundary for decision-making.

Answer

To simplify the budget process for IT.

Answer

To automatically approve all low-impact risks.

Answer

Because the government requires it by law.

Question 19

A company is conducting a risk analysis. Which of the following is an example of an 'inherent risk'?

Accepted Answer

The risk that exists in the absence of any controls.. Inherent risk is the risk level before any controls are applied.

Answer

The risk remaining after all security patches are installed.

Answer

The risk that is accepted by the board of directors.

Answer

The risk that has been mitigated by insurance.

Question 20

Which of the following is a key component of an effective IT risk management policy?

Accepted Answer

Roles and responsibilities for risk ownership.. A policy must define roles, responsibilities, and the framework for action.

Answer

The specific model of routers used in the network.

Answer

The salary structure for IT staff.

Answer

A detailed list of all system passwords.