CGEIT Risk Optimization — 20 Questions

Question 1

An enterprise is adopting an agile development methodology. How should the CGEIT-certified practitioner modify the risk governance process?

Accepted Answer

Implement automated security scanning within the CI/CD pipeline.. In agile environments, risk governance should be embedded into the delivery pipeline rather than bolted on as a separate gate. Implementing automated security scanning within the CI/CD pipeline shifts risk detection left, provides continuous assurance, and preserves agile velocity while maintaining governance oversight. This is the recommended adaptation of risk governance for agile and DevOps.

Answer

Require a formal risk assessment for every sprint cycle.

Answer

Remove risk governance requirements until the project reaches the production phase.

Answer

Replace the risk register with a daily stand-up meeting for risk tracking.

Question 2

When a risk event occurs, what is the first step in the incident response process from a governance perspective?

Accepted Answer

Contain the threat to prevent further business impact.. From a governance perspective, the first step when a risk event occurs is to contain the threat to prevent further business impact (B). Governance prioritizes protecting the enterprise's ability to deliver value and meet obligations, so containment — stopping the spread or escalation of the incident — comes before investigation, communication, or root cause analysis. This aligns with incident response frameworks where containment is the immediate priority after detection and initial assessment.

Answer

Draft a press release.

Answer

Identify the person responsible for the incident.

Answer

Perform a root cause analysis.

Question 3

Which THREE of the following are key inputs for defining the IT risk appetite?

Accepted Answer

The enterprise's strategic objectives.. Option A is correct because the enterprise's strategic objectives determine how much risk the organization is willing to accept in pursuit of its goals; risk appetite must be aligned with strategy so that IT risk-taking supports rather than undermines business outcomes. Option B is correct because the current technical debt of IT systems directly affects the organization's capacity and willingness to absorb risk—high technical debt reduces resilience and typically lowers the acceptable level of IT risk. Option E is correct because stakeholder risk tolerance levels reflect the attitudes of executives, the board, and other key parties toward uncertainty, and these attitudes shape the boundaries of the IT risk appetite. Options C and D are incorrect because the brand of coffee in the breakroom and the number of printers in the office are trivial operational details with no bearing on strategic risk appetite or stakeholder tolerance.

Answer

The specific brand of coffee in the breakroom.

Answer

The number of printers in the office.

Question 4

When the board of directors requests a report on the current IT risk posture, which metric is most effective for demonstrating alignment between risk appetite and investment?

Accepted Answer

Total dollar value of IT capital expenditure.. The risk-adjusted return on investment or the coverage of critical business processes by risk mitigation controls provides the board with actionable insight into how risk appetite is being honored.

Answer

Number of open high-severity security patches.

Answer

Average response time for IT service desk tickets.

Answer

Historical count of phishing emails blocked by the email gateway.

Question 5

When reporting IT risk to the board, which of the following provides the most value?

Accepted Answer

A heat map showing the impact of top risks on business value drivers.. A heat map that maps top IT risks to business value drivers gives the board a prioritized, business-aligned view of risk — exactly what governance bodies need to make informed decisions about where to invest mitigation effort. It translates technical risk into impact on revenue, reputation, compliance, and strategic objectives, which is the language of the board. Raw vulnerability lists or incident counts lack this business context and do not support strategic prioritization.

Answer

A list of all open vulnerabilities categorized by severity.

Answer

The total number of security incidents reported in the last quarter.

Answer

A detailed technical audit report of the firewall configurations.

Question 6

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

To serve as an early warning signal of potential risk events.. A Key Risk Indicator is a forward-looking metric designed to signal rising risk exposure before an event occurs, enabling proactive management. Its purpose is early warning — tracking conditions that precede risk events so governance can intervene. The other options describe training compliance, operational logs, or backward-looking performance measurement, none of which is the primary purpose of a KRI.

Answer

To ensure that all employees have completed security awareness training.

Answer

To provide a detailed log of all security threats blocked by the firewall.

Answer

To measure the success of past risk mitigation strategies.

Question 7

An enterprise is evaluating the trade-off between the cost of risk mitigation and the potential business benefit. Which framework or approach should the practitioner use?

Accepted Answer

Return on Security Investment (ROSI).. Return on Security Investment (ROSI) is the framework specifically designed to quantify the financial trade-off between the cost of risk mitigation and the potential business benefit. It calculates the expected monetary loss avoided by a control relative to the cost of implementing that control, expressed as a percentage or ratio. This directly answers the question of whether a mitigation investment is economically justified.

Answer

Total Cost of Ownership (TCO) analysis.

Answer

Key Risk Indicator (KRI) dashboarding.

Answer

Business Impact Analysis (BIA).

Question 8

What is the most effective way to ensure that IT risk management is integrated with enterprise risk management (ERM)?

Accepted Answer

Aligning the IT risk taxonomy and reporting thresholds with the corporate ERM framework.. Aligning the IT risk taxonomy and reporting thresholds with the corporate ERM framework ensures that IT risks are expressed in the same language, measured on the same scales, and escalated using the same criteria as other enterprise risks. This integration allows the board and executive management to view IT risk alongside financial, operational, and strategic risks, enabling consistent prioritization and decision-making. It is the most effective way to embed IT risk into ERM without disrupting organizational structures.

Answer

Moving the IT risk management function under the responsibility of the Chief Financial Officer.

Answer

Requiring IT to report risks directly to the Chief Risk Officer on a weekly basis.

Answer

Mandating that IT uses the same risk assessment software as the finance department.

Question 9

An IT project is identified as having a high inherent risk that exceeds the board-approved appetite. The project is critical for competitive advantage. Which approach is most appropriate?

Accepted Answer

Present a business case to the board for formal risk acceptance with compensatory controls.. When a project's inherent risk exceeds board-approved appetite but the project is critical for competitive advantage, the appropriate governance action is to present a business case to the board for formal risk acceptance with compensatory controls. The board owns risk appetite and can authorize an exception with mitigating measures, preserving both strategic value and governance accountability.

Answer

Implement excessive controls regardless of project cost.

Answer

Direct the IT team to lower the risk by reducing project scope.

Answer

Cancel the project immediately to maintain compliance.

Question 10

An organization is transitioning to a cloud-based infrastructure. Which governance mechanism is most effective for ensuring that the cloud service provider's risk management practices remain aligned with the enterprise's risk appetite?

Accepted Answer

Embedding ongoing risk assessment requirements into the service provider contract.. Embedding ongoing risk assessment requirements directly into the service provider contract creates a binding, enforceable governance mechanism that requires the CSP to continuously demonstrate alignment with the enterprise's risk appetite—not just once a year. Contracts are the primary governance lever in outsourced/cloud relationships because they translate risk appetite into measurable obligations, audit rights, and remediation timelines. This ensures alignment persists as the provider's environment, subprocessors, and threat landscape change.

Answer

Performing an annual penetration test on the provider's infrastructure.

Answer

Mandating a SOC 2 Type II report review on an annual basis.

Answer

Establishing clear service level agreements (SLAs) with penalty clauses for downtime.

Question 11

During an IT governance board meeting, the CGEIT practitioner notices that the current risk profile deviates significantly from the approved risk appetite. What is the most appropriate next step?

Accepted Answer

Formally report the variance to the board and propose a remediation plan.. When the actual risk profile deviates significantly from the board-approved risk appetite, the governance practitioner's duty is to escalate the variance to the board and propose a remediation plan. The board owns risk appetite, so only the board can decide whether to accept, mitigate, or transfer the excess risk. Reporting with a proposed plan preserves governance accountability and gives the board actionable options.

Answer

Update the enterprise risk management policy to include the new risks.

Answer

Instruct the IT department to stop all new projects until the risk is lowered.

Answer

Adjust the risk appetite levels to match the current risk profile.

Question 12

An enterprise is aligning its IT risk appetite with corporate strategic objectives. Which action should the CGEIT-certified practitioner prioritize first?

Accepted Answer

Define the enterprise risk capacity based on strategic objectives.. Aligning IT risk appetite with corporate strategic objectives begins with defining the enterprise risk capacity—the maximum amount of risk the organization can bear—based on its strategic objectives, financial strength, and regulatory constraints. This sets the boundary within which risk appetite is defined. Only after capacity is understood can the practitioner define risk appetite, tolerance levels, and then proceed to risk identification, assessment, and treatment. Therefore, defining enterprise risk capacity is the first priority.

Answer

Draft the IT risk register for department heads.

Answer

Conduct a technical vulnerability scan of all production servers.

Answer

Implement an automated GRC risk dashboard.

Question 13

When assessing the impact of a risk, what is the best perspective to take?

Accepted Answer

The effect on business objectives and value delivery.. Risk impact should be assessed from the perspective of the effect on business objectives and value delivery, because enterprise risk management exists to protect and enable value creation. Technical metrics such as hardware cost or restore time are inputs, but the governing question is how the risk affects the organization's ability to achieve its strategic and operational goals. This business-centric view ensures risk treatment is prioritized by materiality to the business.

Answer

The cost of the hardware that needs to be replaced.

Answer

The percentage of the IT budget consumed by the incident.

Answer

The number of hours required to restore the system.

Question 14

A company is using a risk maturity model to improve its IT risk management. What is the main benefit?

Accepted Answer

To establish a baseline and track improvements over time.. A risk maturity model provides a structured framework to assess the current state of IT risk management capabilities, establish a baseline, and track progress over time toward higher maturity levels. Its primary benefit is enabling measurable, continuous improvement rather than prescribing specific tools or headcount. This makes it a governance and improvement instrument.

Answer

To automatically reduce the cost of IT security.

Answer

To force all departments to use the same IT tools.

Answer

To determine exactly how many employees are needed in the risk department.

Question 15

Which role is typically responsible for the final acceptance of IT risks at the enterprise level?

Accepted Answer

The Chief Information Officer (CIO) or the Board.. Final acceptance of enterprise-level IT risk is a governance responsibility that rests with executive leadership and the board, typically represented by the CIO or the board itself, because they have the authority to commit resources and accept consequences on behalf of the organization. Risk acceptance at the enterprise level cannot be delegated to operational or technical roles. This aligns with COBIT's principle that risk appetite and tolerance are set and owned at the governance layer.

Answer

The Network Engineer.

Answer

The external auditor.

Answer

The IT Security Manager.

Question 16

A company is performing a risk assessment of a new software vendor. Which factor is most relevant for the governance of third-party risk?

Accepted Answer

The nature of the data accessed or processed by the vendor.. For third-party risk governance, the most relevant factor is the nature of the data the vendor accesses or processes, because this determines the potential impact and regulatory exposure if the vendor is breached. Data sensitivity drives the level of due diligence, contractual controls, and ongoing monitoring required. This is the foundation of risk-based vendor governance.

Answer

The location of the software vendor's headquarters.

Answer

The number of employees working for the software vendor.

Answer

The brand reputation of the software vendor.

Question 17

An organization's risk appetite has been set as 'low' for data breaches. A new project introduces a moderate risk of a breach. What is the most appropriate governance action?

Accepted Answer

Implement additional security controls to bring the residual risk within the 'low' appetite.. The organization has explicitly set a 'low' risk appetite for data breaches, meaning any risk above that threshold is unacceptable without treatment. Since the project introduces a moderate breach risk that exceeds the stated appetite, governance must direct treatment — implementing additional controls to reduce residual risk to within the 'low' appetite. This preserves both the project's value and the board-approved risk posture, which is the core purpose of risk appetite-driven governance.

Answer

Accept the risk because the project is strategically important.

Answer

Lower the 'low' appetite threshold to 'moderate'.

Answer

Document the risk in the risk register and ignore it for now.

Question 18

The board of directors requests a summary of the current IT risk posture. Which documentation should the practitioner use as the primary source?

Accepted Answer

The latest enterprise risk register.. The enterprise risk register is the centralized, authoritative record of identified risks, their likelihood, impact, owners, and mitigation status across the organization. It is the primary source for summarizing IT risk posture to the board because it aggregates risk data at the enterprise level and aligns with governance reporting requirements.

Answer

The system administrator's patch management reports.

Answer

The IT department's operational incident logs.

Answer

The annual budget allocation for IT security.

Question 19

An enterprise is facing a high-impact risk that cannot be fully mitigated. The board decides to transfer this risk. Which of the following is the best implementation of risk transfer?

Accepted Answer

Purchasing comprehensive cyber-insurance to cover potential financial losses.. Risk transfer involves shifting the financial impact of a risk to a third party, typically through insurance or contractual agreements. Purchasing comprehensive cyber-insurance is the clearest implementation because it explicitly transfers the financial consequences of a cyber event to the insurer. The other options may reduce or share risk but do not constitute transfer in the strict sense.

Answer

Moving all data to a public cloud provider.

Answer

Outsourcing the entire IT department to a third-party managed service provider.

Answer

Signing an indemnity clause in a software license agreement.

Question 20

Why is it important to define risk appetite before developing a risk response plan?

Accepted Answer

To provide a threshold for determining which risks require action.. Risk appetite defines the amount and type of risk an organization is willing to accept in pursuit of its objectives. Without it, there is no objective threshold for deciding which risks require treatment, which can be accepted, and which must be avoided — making the risk response plan arbitrary. Defining risk appetite first ensures responses are calibrated to the organization's tolerance and strategic goals.

Answer

To simplify the budget process for IT.

Answer

To automatically approve all low-impact risks.

Answer

Because the government requires it by law.