CGEIT Risk Optimization Practice Test 3 — 15 Questions

Question 1

Which THREE of the following are essential components of a risk reporting framework?

Accepted Answer

Actionable insights and trends.. Effective reports must be timely, relevant, and actionable for decision-makers.

Answer

A comprehensive list of every single IT asset.

Answer

The source code of the reporting software.

Question 2

Which TWO of the following are key elements of a Business Impact Analysis (BIA)?

Accepted Answer

Identification of critical business processes.. BIA identifies critical processes and the impact of their disruption.

Answer

The color scheme of the company website.

Answer

The specific model of server hardware.

Answer

The annual salary of the IT staff.

Question 3

Which THREE of the following are common risk response strategies?

Accepted Answer

Avoid.. Standard risk strategies are Accept, Avoid, Transfer, and Mitigate.

Answer

Ignore.

Answer

Delete.

Question 4

Which TWO of the following factors should influence the frequency of risk reporting to the board?

Accepted Answer

The current risk posture and volatility of the environment.. Frequency should be driven by risk volatility and business impact.

Answer

The size of the IT office building.

Answer

The number of years the board members have served.

Answer

The color of the risk report cover page.

Question 5

Which THREE of the following represent effective ways to integrate IT risk into the organizational culture?

Accepted Answer

Regular risk management training for all staff.. Culture change requires leadership, training, and incentive alignment.

Answer

Changing the corporate logo.

Answer

Reducing the number of IT staff.

Question 6

Which TWO of the following are examples of 'Avoidance' as a risk response?

Accepted Answer

Deciding not to enter a new market with high regulatory risk.. Avoidance is exiting an activity that carries risk.

Answer

Buying insurance for a data center.

Answer

Creating a backup of the database.

Answer

Installing an antivirus program.

Question 7

Which THREE of the following are key inputs for defining the IT risk appetite?

Accepted Answer

The enterprise's strategic objectives.. Appetite is defined by strategic goals, resource capacity, and stakeholder expectations.

Answer

The specific brand of coffee in the breakroom.

Answer

The number of printers in the office.

Question 8

Which TWO of the following describe the role of the 'Risk Owner'?

Accepted Answer

Responsible for monitoring the effectiveness of controls.. Risk owners are accountable for the management and monitoring of specific risks.

Answer

Writing all the company's marketing emails.

Answer

Approving the company's annual tax filing.

Answer

Fixing all hardware issues in the company.

Question 9

An organization is integrating IT risk management into its enterprise governance framework. Which approach best ensures that IT risk is treated as a component of enterprise risk?

Accepted Answer

Establishing a common risk taxonomy shared between the IT risk and Enterprise Risk Management (ERM) functions.. Integrating IT risk into the enterprise risk framework ensures visibility for the board and alignment with business objectives, rather than treating it as a siloed technical concern.

Answer

Implementing a standalone IT risk registry managed only by the CISO.

Answer

Focusing exclusively on technical vulnerabilities in the IT asset inventory.

Answer

Delegating all IT risk assessments to the IT infrastructure team.

Question 10

A firm has decided to pursue a high-risk innovation strategy. How should the enterprise risk appetite statement be adjusted to support this goal?

Accepted Answer

Establish a higher risk appetite for experimental initiatives with clear sunset clauses.. Governance bodies must define risk tolerance thresholds that allow for strategic agility while ensuring that excessive risk does not threaten core enterprise continuity.

Answer

Mandate that all innovation projects pass a legacy audit before approval.

Answer

Outsource the management of all new innovation projects to a third party.

Answer

Lower the threshold for all IT risk controls to ensure maximum security.

Question 11

You are auditing the integration of IT risk management. Which finding indicates a failure in the governance of enterprise risk?

Accepted Answer

IT risk assessments are performed independently of business impact analysis (BIA).. If risk management activities are not linked to the strategic business objectives, the organization lacks effective governance over IT risk.

Answer

The IT risk register is reviewed quarterly by the IT steering committee.

Answer

The CISO reports to the CIO instead of the CEO.

Answer

The risk management policy was updated 18 months ago.

Question 12

When balancing risk and value in IT investment, what is the primary consideration for the CGEIT practitioner?

Accepted Answer

Optimizing the realization of benefits while maintaining risk exposure within the enterprise appetite.. Governance is about the trade-offs. Delivering value requires taking risks; the objective is to optimize, not eliminate, risk.

Answer

Prioritizing compliance over all other business requirements.

Answer

Total elimination of IT risk.

Answer

Maximizing the return on investment (ROI) regardless of risk exposure.

Question 13

An organization experiences a high frequency of minor IT incidents. What is the most effective governance action to ensure this does not result in a significant enterprise risk?

Accepted Answer

Implementing a root cause analysis (RCA) program to identify systemic patterns across recurring incidents.. Aggregating risk is essential. Multiple minor incidents can indicate a systemic control weakness that, if unaddressed, leads to a major catastrophe.

Answer

Updating the incident management policy to mandate shorter SLA targets.

Answer

Increasing the budget for incident response staff.

Answer

Requiring all incidents to be reported directly to the board of directors.

Question 14

Your organization is undergoing a major digital transformation. To ensure risk is optimized throughout the lifecycle, what is the most critical governance activity during the planning phase?

Accepted Answer

Defining explicit risk-based criteria for project prioritization in the business case.. Embedding risk criteria into the project selection and prioritization process ensures that the organization only commits resources to projects that align with the board's risk appetite.

Answer

Ensuring the technical architecture is fully documented.

Answer

Setting up an automated monitoring tool for the new cloud environment.

Answer

Hiring a third-party consultant to conduct a penetration test on the future system.

Question 15

The board of directors is concerned about the impact of recent cybersecurity threats on the company's reputation. Which TWO of the following actions should the Governance committee prioritize to address these concerns?

Accepted Answer

Reviewing the alignment of the current risk appetite with the brand resilience strategy.. Aligning risk reporting with board interests and ensuring management accountability are key responsibilities of the governance committee.

Answer

Directing the CISO to provide a summary of all blocked network packets.

Answer

Requiring the IT department to upgrade all legacy hardware immediately.

Answer

Changing the password rotation policy for all employees.