CGEIT Risk Optimization Practice Test 2 — 15 Questions

Question 1

The board of directors requests a summary of the current IT risk posture. Which documentation should the practitioner use as the primary source?

Accepted Answer

The latest enterprise risk register.. The enterprise risk register provides the consolidated view required by the board.

Answer

The system administrator's patch management reports.

Answer

The IT department's operational incident logs.

Answer

The annual budget allocation for IT security.

Question 2

An enterprise is facing a high-impact risk that cannot be fully mitigated. The board decides to transfer this risk. Which of the following is the best implementation of risk transfer?

Accepted Answer

Purchasing comprehensive cyber-insurance to cover potential financial losses.. Risk transfer is about moving financial liability, not operational responsibility.

Answer

Moving all data to a public cloud provider.

Answer

Outsourcing the entire IT department to a third-party managed service provider.

Answer

Signing an indemnity clause in a software license agreement.

Question 3

Why is it important to define risk appetite before developing a risk response plan?

Accepted Answer

To provide a threshold for determining which risks require action.. Appetite acts as the boundary for decision-making.

Answer

To simplify the budget process for IT.

Answer

To automatically approve all low-impact risks.

Answer

Because the government requires it by law.

Question 4

A company is conducting a risk analysis. Which of the following is an example of an 'inherent risk'?

Accepted Answer

The risk that exists in the absence of any controls.. Inherent risk is the risk level before any controls are applied.

Answer

The risk remaining after all security patches are installed.

Answer

The risk that is accepted by the board of directors.

Answer

The risk that has been mitigated by insurance.

Question 5

Which of the following is a key component of an effective IT risk management policy?

Accepted Answer

Roles and responsibilities for risk ownership.. A policy must define roles, responsibilities, and the framework for action.

Answer

The specific model of routers used in the network.

Answer

The salary structure for IT staff.

Answer

A detailed list of all system passwords.

Question 6

An IT project is failing to deliver promised business value. What is the most likely governance failure?

Accepted Answer

Inadequate alignment between IT risk management and business value objectives.. Value delivery is directly linked to effective risk and performance management.

Answer

The IT team was not using the latest programming language.

Answer

The IT budget was slightly over the projected amount.

Answer

The project manager lacked a certification.

Question 7

A company is establishing an IT Risk Committee. Which group should have the most significant representation?

Accepted Answer

Key business process owners and senior IT leadership.. Governance requires representation from the business, not just IT.

Answer

The local IT vendors.

Answer

The human resources department.

Answer

The junior IT support staff.

Question 8

An IT audit reveals that risk mitigation activities are being performed, but they are not being tracked. What is the governance risk?

Accepted Answer

There is no evidence to demonstrate that risks are being effectively managed.. Lack of tracking prevents verification and accountability.

Answer

The hardware will become obsolete faster.

Answer

The IT department will be overstaffed.

Answer

The budget will be spent on unnecessary tools.

Question 9

An enterprise is adopting a 'Risk-Based Approach' to IT governance. How should this impact the IT budget allocation?

Accepted Answer

Budget is prioritized for areas with the highest risk exposure.. Resources should be prioritized where the most significant risks exist.

Answer

Budget is focused entirely on upgrading legacy systems.

Answer

Budget is minimized to save costs across the board.

Answer

Budget is distributed equally across all IT departments.

Question 10

When a risk event occurs, what is the first step in the incident response process from a governance perspective?

Accepted Answer

Contain the threat to prevent further business impact.. The first step is to contain the issue and notify the appropriate parties.

Answer

Draft a press release.

Answer

Identify the person responsible for the incident.

Answer

Perform a root cause analysis.

Question 11

What is the relationship between 'IT Risk' and 'Enterprise Risk'?

Accepted Answer

IT risk is a subset of enterprise risk and must be managed together.. IT risk is a subset of enterprise risk.

Answer

They are exactly the same thing.

Answer

Enterprise risk is a subset of IT risk.

Answer

IT risk is entirely separate from enterprise risk.

Question 12

Which metric is most useful for reporting the effectiveness of IT risk management to the board?

Accepted Answer

The trend of residual risk levels compared to risk appetite.. The board needs to see the trend of risk exposure over time.

Answer

The number of help desk tickets closed.

Answer

The number of emails blocked by the spam filter.

Answer

The total volume of data stored on the servers.

Question 13

During a merger, the IT risk governance team identifies incompatible security standards. What is the correct approach?

Accepted Answer

Develop a harmonized set of standards that addresses the risks of the combined entity.. A unified standard must be established to manage risk consistently.

Answer

Allow each department to continue using their own standards.

Answer

Hire an external firm to manage the integration.

Answer

Force the smaller company to immediately adopt the larger company's standards.

Question 14

Which TWO of the following are examples of risk mitigation?

Accepted Answer

Implementing regular system backups.. Mitigation involves taking action to reduce the likelihood or impact of a risk.

Answer

Avoiding the use of cloud computing entirely.

Answer

Purchasing cyber-insurance.

Answer

Accepting the risk of a minor system outage.

Question 15

Which TWO of the following are primary objectives of IT risk governance?

Accepted Answer

Ensuring risk management processes deliver value.. Governance focuses on ensuring risk management aligns with strategy and business value.

Answer

Fixing broken computer keyboards.

Answer

Increasing the IT budget by 20% annually.

Answer

Writing code for the software developers.