CGEIT Risk Optimization Practice Test 2 — 15 Questions

Question 1

A company is performing a risk assessment of a new software vendor. Which factor is most relevant for the governance of third-party risk?

Accepted Answer

The nature of the data accessed or processed by the vendor.. For third-party risk governance, the most relevant factor is the nature of the data the vendor accesses or processes, because this determines the potential impact and regulatory exposure if the vendor is breached. Data sensitivity drives the level of due diligence, contractual controls, and ongoing monitoring required. This is the foundation of risk-based vendor governance.

Answer

The location of the software vendor's headquarters.

Answer

The number of employees working for the software vendor.

Answer

The brand reputation of the software vendor.

Question 2

An organization's risk appetite has been set as 'low' for data breaches. A new project introduces a moderate risk of a breach. What is the most appropriate governance action?

Accepted Answer

Implement additional security controls to bring the residual risk within the 'low' appetite.. The organization has explicitly set a 'low' risk appetite for data breaches, meaning any risk above that threshold is unacceptable without treatment. Since the project introduces a moderate breach risk that exceeds the stated appetite, governance must direct treatment — implementing additional controls to reduce residual risk to within the 'low' appetite. This preserves both the project's value and the board-approved risk posture, which is the core purpose of risk appetite-driven governance.

Answer

Accept the risk because the project is strategically important.

Answer

Lower the 'low' appetite threshold to 'moderate'.

Answer

Document the risk in the risk register and ignore it for now.

Question 3

The board of directors requests a summary of the current IT risk posture. Which documentation should the practitioner use as the primary source?

Accepted Answer

The latest enterprise risk register.. The enterprise risk register is the centralized, authoritative record of identified risks, their likelihood, impact, owners, and mitigation status across the organization. It is the primary source for summarizing IT risk posture to the board because it aggregates risk data at the enterprise level and aligns with governance reporting requirements.

Answer

The system administrator's patch management reports.

Answer

The IT department's operational incident logs.

Answer

The annual budget allocation for IT security.

Question 4

An enterprise is facing a high-impact risk that cannot be fully mitigated. The board decides to transfer this risk. Which of the following is the best implementation of risk transfer?

Accepted Answer

Purchasing comprehensive cyber-insurance to cover potential financial losses.. Risk transfer involves shifting the financial impact of a risk to a third party, typically through insurance or contractual agreements. Purchasing comprehensive cyber-insurance is the clearest implementation because it explicitly transfers the financial consequences of a cyber event to the insurer. The other options may reduce or share risk but do not constitute transfer in the strict sense.

Answer

Moving all data to a public cloud provider.

Answer

Outsourcing the entire IT department to a third-party managed service provider.

Answer

Signing an indemnity clause in a software license agreement.

Question 5

Why is it important to define risk appetite before developing a risk response plan?

Accepted Answer

To provide a threshold for determining which risks require action.. Risk appetite defines the amount and type of risk an organization is willing to accept in pursuit of its objectives. Without it, there is no objective threshold for deciding which risks require treatment, which can be accepted, and which must be avoided — making the risk response plan arbitrary. Defining risk appetite first ensures responses are calibrated to the organization's tolerance and strategic goals.

Answer

To simplify the budget process for IT.

Answer

To automatically approve all low-impact risks.

Answer

Because the government requires it by law.

Question 6

A company is conducting a risk analysis. Which of the following is an example of an 'inherent risk'?

Accepted Answer

The risk that exists in the absence of any controls.. Inherent risk is defined as the level of risk that exists before any controls, mitigations, or countermeasures are applied. It represents the raw exposure of an asset or process to a given threat. Option A correctly captures this by describing risk 'in the absence of any controls.' This baseline is used in risk analysis to determine how much risk treatment is actually reducing exposure.

Answer

The risk remaining after all security patches are installed.

Answer

The risk that is accepted by the board of directors.

Answer

The risk that has been mitigated by insurance.

Question 7

Which of the following is a key component of an effective IT risk management policy?

Accepted Answer

Roles and responsibilities for risk ownership.. An effective IT risk management policy must define who owns which risks so that accountability is unambiguous across the enterprise. Assigning roles and responsibilities for risk ownership ensures each identified risk has a named accountable party who monitors, treats, and reports on it, which is the foundational governance element of the policy. Without clear ownership, risk treatment decisions stall and no one is answerable to executive management or the board.

Answer

The specific model of routers used in the network.

Answer

The salary structure for IT staff.

Answer

A detailed list of all system passwords.

Question 8

An IT project is failing to deliver promised business value. What is the most likely governance failure?

Accepted Answer

Inadequate alignment between IT risk management and business value objectives.. When an IT project fails to deliver promised business value, the most likely governance failure is inadequate alignment between IT risk management and business value objectives. Governance exists to ensure IT investments are directed toward and deliver expected business outcomes; a disconnect between risk management and value objectives means the project was not properly governed from a benefits-realization perspective.

Answer

The IT team was not using the latest programming language.

Answer

The IT budget was slightly over the projected amount.

Answer

The project manager lacked a certification.

Question 9

A company is establishing an IT Risk Committee. Which group should have the most significant representation?

Accepted Answer

Key business process owners and senior IT leadership.. An IT Risk Committee exists to ensure that technology risk is governed in the context of business objectives, so its membership must include the owners of business processes that depend on IT and the senior IT leaders who operate and secure those systems. This pairing ensures risk decisions reflect both business impact and technical reality, which is the essence of CGEIT's governance mandate.

Answer

The local IT vendors.

Answer

The human resources department.

Answer

The junior IT support staff.

Question 10

An IT audit reveals that risk mitigation activities are being performed, but they are not being tracked. What is the governance risk?

Accepted Answer

There is no evidence to demonstrate that risks are being effectively managed.. The core governance risk when mitigation activities are performed but not tracked is the absence of an audit trail and evidence that risks are actually being managed. Without tracking, the board and auditors cannot verify that controls are effective, that residual risk is within appetite, or that resources are being used appropriately. This breaks the accountability and monitoring components of the risk management framework.

Answer

The hardware will become obsolete faster.

Answer

The IT department will be overstaffed.

Answer

The budget will be spent on unnecessary tools.

Question 11

An enterprise is adopting a 'Risk-Based Approach' to IT governance. How should this impact the IT budget allocation?

Accepted Answer

Budget is prioritized for areas with the highest risk exposure.. A risk-based approach to IT governance directs resources toward the areas of greatest potential loss or impact. Since budget is a finite governance lever, allocating it to the highest risk exposures ensures that mitigation spending is proportional to the likelihood and business impact of each risk. This aligns IT investment with enterprise risk appetite and maximizes the return on every dollar spent on controls.

Answer

Budget is focused entirely on upgrading legacy systems.

Answer

Budget is minimized to save costs across the board.

Answer

Budget is distributed equally across all IT departments.

Question 12

What is the relationship between 'IT Risk' and 'Enterprise Risk'?

Accepted Answer

IT risk is a subset of enterprise risk and must be managed together.. IT risk is a subset of enterprise risk because technology-related threats and opportunities are one category within the broader set of risks that affect the entire organization. Managing them together ensures that IT risk is assessed in the context of business objectives, risk appetite, and overall enterprise risk posture rather than in isolation.

Answer

They are exactly the same thing.

Answer

Enterprise risk is a subset of IT risk.

Answer

IT risk is entirely separate from enterprise risk.

Question 13

Which metric is most useful for reporting the effectiveness of IT risk management to the board?

Accepted Answer

The trend of residual risk levels compared to risk appetite.. The most useful board-level metric is the trend of residual risk levels compared to the organization's risk appetite, because it directly shows whether the enterprise is operating within its stated tolerance and whether risk treatment is effective over time. Boards need this forward-looking, aggregated view to make governance decisions. Operational metrics like ticket counts or spam blocked do not convey enterprise risk posture.

Answer

The number of help desk tickets closed.

Answer

The number of emails blocked by the spam filter.

Answer

The total volume of data stored on the servers.

Question 14

During a merger, the IT risk governance team identifies incompatible security standards. What is the correct approach?

Accepted Answer

Develop a harmonized set of standards that addresses the risks of the combined entity.. During a merger, incompatible security standards must be reconciled into a single harmonized framework that reflects the risk profile of the combined entity. This ensures consistent control coverage, avoids gaps and overlaps, and supports unified governance and reporting. Harmonization also enables the merged organization to operate under one risk appetite and one set of compliance obligations.

Answer

Allow each department to continue using their own standards.

Answer

Hire an external firm to manage the integration.

Answer

Force the smaller company to immediately adopt the larger company's standards.

Question 15

Which TWO of the following are examples of risk mitigation?

Accepted Answer

Implementing regular system backups.. Option B is correct because implementing regular system backups is a classic risk mitigation control: it reduces the impact of data loss or ransomware by allowing restoration, thereby lowering the risk to an acceptable level rather than eliminating or transferring it. Option C is correct because installing a firewall is a preventive technical control that reduces the likelihood of unauthorized network access and attacks, which is the essence of mitigation. Option A is not mitigation but risk avoidance, since the activity (cloud computing) is eliminated entirely. Option D is risk transference, as the financial consequences are shifted to an insurer. Option E is risk acceptance, because the organization chooses to tolerate the minor outage without applying controls.

Answer

Avoiding the use of cloud computing entirely.

Answer

Purchasing cyber-insurance.

Answer

Accepting the risk of a minor system outage.