CGEIT Risk Optimization Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are primary objectives of IT risk governance?

Accepted Answer

Ensuring risk management processes deliver value.. Option B is correct because a primary objective of IT risk governance is to ensure that risk management processes themselves are effective and deliver value to the organization, meaning they are properly designed, resourced, monitored, and continuously improved rather than being bureaucratic overhead. Option D is correct because IT risk governance must align IT risk decisions and tolerance with the organization's overall business strategy, ensuring that technology risks are managed in a way that supports business objectives and value creation. The unmarked options do not belong: A (fixing broken computer keyboards) is an operational hardware support task, not governance; C (increasing the IT budget by 20% annually) is an arbitrary financial target unrelated to risk governance objectives; and E (writing code for software developers) is a hands-on development activity, not a governance responsibility.

Answer

Fixing broken computer keyboards.

Answer

Increasing the IT budget by 20% annually.

Answer

Writing code for the software developers.

Question 2

Which THREE of the following are essential components of a risk reporting framework?

Accepted Answer

Actionable insights and trends.. A risk reporting framework must deliver actionable insights and trends (A), because raw risk data is only useful when it is analyzed to show direction, emerging issues, and prioritized remediation actions that decision-makers can act on. Clear identification of the target audience (B) is essential because reports must be tailored in content, depth, frequency, and format to the specific stakeholders receiving them, such as executives, the board, or operational teams. Definition of risk appetite thresholds (D) is also required, since reporting must compare actual risk exposure against the organization's approved risk tolerance/appetite so that stakeholders can judge whether risks are within acceptable limits. A comprehensive list of every single IT asset (C) is not an essential component of the reporting framework itself; asset inventory belongs to the risk assessment/identification process, and exhaustive asset lists would overwhelm reports. The source code of the reporting software (E) is irrelevant to the framework's design, as reporting frameworks focus on governance, content, and audience needs rather than software implementation details.

Answer

A comprehensive list of every single IT asset.

Answer

The source code of the reporting software.

Question 3

Which TWO of the following are key elements of a Business Impact Analysis (BIA)?

Accepted Answer

Identification of critical business processes.. Option C is correct because a Business Impact Analysis (BIA) fundamentally begins by identifying the critical business processes and functions whose disruption would most harm the organization, so they can be prioritized for recovery. Option E is correct because the BIA quantifies impact over time by determining the maximum tolerable downtime (MTD), along with related metrics such as the recovery time objective (RTO) and recovery point objective (RPO), which drive continuity and recovery strategies. Options A, B, and D are incorrect because website color schemes, specific server hardware models, and IT staff salaries are not BIA elements; hardware and staffing details belong to later resource and recovery planning, while salary data is a budgeting concern, not an impact analysis of business processes.

Answer

The color scheme of the company website.

Answer

The specific model of server hardware.

Answer

The annual salary of the IT staff.

Question 4

Which THREE of the following are common risk response strategies?

Accepted Answer

Avoid.. Risk response strategies in risk management (as defined in PMBOK and similar frameworks) include Avoid, Transfer, and Accept, making B, C, and E the correct choices. Avoid (B) is right because it involves changing the project plan or scope to eliminate the threat or risk entirely, such as removing a risky feature. Transfer (C) is correct because it shifts the risk's impact and ownership to a third party, typically via insurance, warranties, or outsourcing contracts. Accept (E) is correct because it acknowledges the risk and decides to take no proactive action, either actively (with a contingency plan) or passively. The unmarked options do not belong: Ignore (A) is not a recognized formal strategy since risks cannot simply be ignored under proper risk management, and Delete (D) is not a standard risk response term—it is more akin to data or file operations, not risk handling.

Answer

Ignore.

Answer

Delete.

Question 5

Which TWO of the following factors should influence the frequency of risk reporting to the board?

Accepted Answer

The current risk posture and volatility of the environment.. Option B is correct because the frequency of risk reporting should be driven by the organization's current risk posture and the volatility of its environment — when risk levels are elevated or the threat landscape is changing rapidly, the board needs more frequent updates to maintain effective oversight. Option E is correct because risks that are significant to business objectives (for example, those threatening critical services, regulatory compliance, or strategic goals) warrant more frequent reporting than low-impact risks, since the board's primary governance role is to protect the achievement of those objectives. The remaining options do not belong: the size of the IT office building (A) is a physical facility detail with no bearing on governance reporting cadence, the number of years board members have served (C) is a tenure consideration unrelated to risk materiality or volatility, and the color of the report cover page (D) is a cosmetic formatting choice with no impact on reporting frequency.

Answer

The size of the IT office building.

Answer

The number of years the board members have served.

Answer

The color of the risk report cover page.

Question 6

Which THREE of the following represent effective ways to integrate IT risk into the organizational culture?

Accepted Answer

Regular risk management training for all staff.. Option A is correct because regular risk management training for all staff builds awareness and embeds risk thinking into daily decision-making, which is a core mechanism for shaping organizational culture. Option C is correct because linking performance bonuses to risk management outcomes aligns individual incentives with risk-aware behavior, reinforcing the desired culture through measurable accountability. Option D is correct because executive sponsorship of risk management initiatives signals top-down commitment, sets the tone at the top, and legitimizes risk management as a shared organizational value. Options B and E do not belong: changing the corporate logo is a cosmetic branding action with no bearing on risk culture, and reducing IT staff is a headcount decision that neither integrates risk into culture nor necessarily improves risk management.

Answer

Changing the corporate logo.

Answer

Reducing the number of IT staff.

Question 7

Which TWO of the following are examples of 'Avoidance' as a risk response?

Accepted Answer

Deciding not to enter a new market with high regulatory risk.. Option B is correct because avoidance means eliminating the risk entirely by not engaging in the activity that creates it — deciding not to enter a high-regulatory-risk market removes the exposure rather than mitigating or transferring it. Option E is correct for the same reason: canceling a project with excessive security risks removes the risk source altogether, which is the defining characteristic of the Avoid response. Option A is incorrect because buying insurance is a Transfer response, shifting the financial impact to a third party while the risk remains. Option C is incorrect because creating a database backup is a Mitigation (risk reduction) action that lessens impact but does not eliminate the threat. Option D is incorrect because installing antivirus software is also Mitigation, reducing the likelihood or impact of malware rather than avoiding the risk.

Answer

Buying insurance for a data center.

Answer

Creating a backup of the database.

Answer

Installing an antivirus program.

Question 8

Which TWO of the following describe the role of the 'Risk Owner'?

Accepted Answer

Responsible for monitoring the effectiveness of controls.. Option B is correct because the Risk Owner is responsible for monitoring the effectiveness of the controls put in place to mitigate a risk, ensuring they continue to reduce the risk to an acceptable level. Option D is correct because the Risk Owner is accountable for managing the identified risk, including decisions on treatment and acceptance. Options A, C, and E are incorrect because marketing emails, tax filing, and hardware repairs are unrelated to the risk management role of a Risk Owner.

Answer

Writing all the company's marketing emails.

Answer

Approving the company's annual tax filing.

Answer

Fixing all hardware issues in the company.

Question 9

An organization is integrating IT risk management into its enterprise governance framework. Which approach best ensures that IT risk is treated as a component of enterprise risk?

Accepted Answer

Establishing a common risk taxonomy shared between the IT risk and Enterprise Risk Management (ERM) functions.. A common risk taxonomy shared between IT risk and ERM functions is the mechanism that lets IT risk be expressed, aggregated, and reported in the same language as enterprise risk. This enables the board and ERM to see IT risk as a subset of enterprise risk rather than a separate technical silo. COBIT's EDM03 (Ensure Risk Optimization) and APO12 (Manage Risk) explicitly call for integration with enterprise risk management.

Answer

Implementing a standalone IT risk registry managed only by the CISO.

Answer

Focusing exclusively on technical vulnerabilities in the IT asset inventory.

Answer

Delegating all IT risk assessments to the IT infrastructure team.

Question 10

A firm has decided to pursue a high-risk innovation strategy. How should the enterprise risk appetite statement be adjusted to support this goal?

Accepted Answer

Establish a higher risk appetite for experimental initiatives with clear sunset clauses.. To support a high-risk innovation strategy, the risk appetite statement should explicitly raise tolerance for experimental initiatives while imposing clear sunset clauses so that unsuccessful experiments are terminated rather than allowed to persist. This balances the pursuit of innovation with governance discipline. Sunset clauses ensure that elevated risk acceptance is time-bound and reviewed, preventing risk creep.

Answer

Mandate that all innovation projects pass a legacy audit before approval.

Answer

Outsource the management of all new innovation projects to a third party.

Answer

Lower the threshold for all IT risk controls to ensure maximum security.

Question 11

You are auditing the integration of IT risk management. Which finding indicates a failure in the governance of enterprise risk?

Accepted Answer

IT risk assessments are performed independently of business impact analysis (BIA).. Performing IT risk assessments independently of the business impact analysis (BIA) is a governance failure because it disconnects technical risk from business consequence, which is the essence of enterprise risk integration. A properly governed process uses the BIA to determine which systems and processes are critical, then prioritizes IT risk treatment accordingly. Without that linkage, risk ratings become arbitrary and cannot inform strategic decisions.

Answer

The IT risk register is reviewed quarterly by the IT steering committee.

Answer

The CISO reports to the CIO instead of the CEO.

Answer

The risk management policy was updated 18 months ago.

Question 12

When balancing risk and value in IT investment, what is the primary consideration for the CGEIT practitioner?

Accepted Answer

Optimizing the realization of benefits while maintaining risk exposure within the enterprise appetite.. The primary consideration for a CGEIT practitioner is to optimize value realization while keeping risk exposure within the enterprise's defined risk appetite. This balances the pursuit of benefits with the constraint of acceptable risk, aligning IT investment with business strategy. It is not about eliminating risk or ignoring it for ROI.

Answer

Prioritizing compliance over all other business requirements.

Answer

Total elimination of IT risk.

Answer

Maximizing the return on investment (ROI) regardless of risk exposure.

Question 13

An organization experiences a high frequency of minor IT incidents. What is the most effective governance action to ensure this does not result in a significant enterprise risk?

Accepted Answer

Implementing a root cause analysis (RCA) program to identify systemic patterns across recurring incidents.. The most effective governance action is to implement a root cause analysis (RCA) program to identify systemic patterns across recurring incidents. This addresses the underlying causes rather than symptoms, preventing minor incidents from accumulating into a significant enterprise risk. Governance focuses on systemic improvement, not just operational fixes.

Answer

Updating the incident management policy to mandate shorter SLA targets.

Answer

Increasing the budget for incident response staff.

Answer

Requiring all incidents to be reported directly to the board of directors.

Question 14

Your organization is undergoing a major digital transformation. To ensure risk is optimized throughout the lifecycle, what is the most critical governance activity during the planning phase?

Accepted Answer

Defining explicit risk-based criteria for project prioritization in the business case.. During the planning phase of a digital transformation, the most critical governance activity is defining explicit risk-based criteria for project prioritization in the business case. This ensures that risk is optimized from the outset by aligning investment decisions with the organization's risk appetite and strategic objectives. It embeds risk consideration into the decision-making process before any technical work begins.

Answer

Ensuring the technical architecture is fully documented.

Answer

Setting up an automated monitoring tool for the new cloud environment.

Answer

Hiring a third-party consultant to conduct a penetration test on the future system.

Question 15

The board of directors is concerned about the impact of recent cybersecurity threats on the company's reputation. Which TWO of the following actions should the Governance committee prioritize to address these concerns?

Accepted Answer

Reviewing the alignment of the current risk appetite with the brand resilience strategy.. The Governance committee's role is to provide oversight and strategic direction, not to manage technical operations, so it should prioritize actions that connect security risk to business reputation. Option B is correct because reviewing the alignment of the current risk appetite with the brand resilience strategy ensures that the level of risk the organization is willing to accept matches its ability to protect and recover its reputation, which directly addresses the board's concern. Option E is correct because requesting a report on the effectiveness of incident response and crisis communication plans evaluates whether the organization can contain an incident and manage public perception during and after an attack, which is central to reputational impact. Option A is not appropriate because a summary of blocked network packets is a low-level technical metric that does not inform governance-level reputational risk decisions. Option C is not appropriate because immediately upgrading all legacy hardware is a tactical IT remediation task, not a governance priority, and may not be justified by risk. Option D is not appropriate because changing the password rotation policy is an operational security control that does not directly address the board's reputational concerns.

Answer

Directing the CISO to provide a summary of all blocked network packets.

Answer

Requiring the IT department to upgrade all legacy hardware immediately.

Answer

Changing the password rotation policy for all employees.