CGEIT Risk Optimization Practice Test 4 — 15 Questions

Question 1

To effectively integrate risk management into enterprise governance, which THREE activities should be conducted?

Accepted Answer

Defining the enterprise risk appetite in quantitative or qualitative terms.. Option A is correct because defining the enterprise risk appetite in quantitative or qualitative terms establishes the boundaries and thresholds against which all risk decisions are made, which is foundational for embedding risk management into governance. Option B is correct because establishing clear accountability for risk ownership at the executive level ensures that risk decisions are tied to strategic objectives and that someone with authority is answerable for outcomes, a core governance principle. Option D is correct because integrating risk reporting into the existing enterprise performance management process embeds risk into the same metrics, reviews, and decision cycles used to steer the business, making risk management continuous rather than a separate exercise. Option C is not correct because standardizing the CMDB structure is an IT service management configuration task, not a governance-level risk management activity. Option E is not correct because outsourcing the primary data center to a tier-one cloud provider is a specific sourcing decision that may address some risks but does not itself integrate risk management into enterprise governance.

Answer

Standardizing the IT configuration management database (CMDB) structure.

Answer

Outsourcing the primary data center to a tier-one cloud provider.

Question 2

You are evaluating the maturity of your organization's risk reporting to the board. Which THREE of the following elements are essential for high-maturity reporting?

Accepted Answer

Presentation of risk trends in relation to strategic business milestones.. High-maturity board risk reporting must connect risk to strategy, so option A is correct because presenting risk trends against strategic business milestones shows how risk exposure evolves relative to the organization's objectives and major initiatives. Option B is correct because expressing residual risk against defined risk appetite thresholds tells the board whether current exposure is within tolerance and where remediation or acceptance decisions are needed. Option E is correct because documenting emerging risks that could affect the enterprise's long-term viability gives the board forward-looking insight beyond current operational issues. Option C does not belong because detailed technical architecture diagrams of security tools are operational artifacts, not board-level risk reporting elements. Option D does not belong because reporting on all low-impact vulnerability scans is excessive operational detail and does not focus on material risk or strategic impact.

Answer

Detailed technical architectural diagrams of all security tools.

Answer

Reporting on the status of all low-impact vulnerability scans.

Question 3

A global logistics enterprise has approved a risk appetite stating that no single operational disruption may exceed a four-hour recovery time objective for its customs-clearance platform. The CIO proposes migrating that platform to a hyperscale cloud provider under a shared-responsibility model. Which governance action BEST ensures the residual risk remains within the board-approved appetite?

Accepted Answer

Commission an independent assessment of the proposed architecture's recoverability and update the risk register with quantified residual risk against the appetite threshold.. Because the board expressed risk appetite as a measurable recovery-time tolerance, the governing body needs objective evidence that the proposed cloud architecture can satisfy it. An independent recoverability assessment, coupled with quantified residual risk recorded against the appetite threshold, lets the board accept, conditionally approve, or reject the migration. Contractual transfer, provider attestations, and delegated approval all fail to demonstrate that the four-hour objective is actually achievable.

Answer

Obtain the provider's SOC 2 Type II report and confirm it covers availability and processing integrity.

Answer

Delegate approval of the migration to the CIO because cloud resilience is a technical decision within IT's domain.

Answer

Require the cloud provider to accept contractual liability for any customs-clearance outage exceeding four hours.

Question 4

You are the CGEIT practitioner for a global logistics enterprise. During an IT governance committee meeting, the CIO presents a proposal to increase the IT risk appetite for cloud migration to accelerate time-to-market. The CFO objects, noting that the board has not approved a revised risk appetite statement. According to CGEIT governance principles, what should be the immediate next step?

Accepted Answer

Escalate the proposal to the board for approval of a revised IT risk appetite statement.. The board owns the enterprise risk appetite, so any change must be approved by the board. Escalating the proposal ensures proper governance and alignment with strategic goals. Other actions either bypass board authority or misplace decision rights. Maintaining board oversight is critical for effective risk optimization.

Answer

Allow the CIO to proceed since the CFO's objection is not a formal veto.

Answer

Conduct a risk assessment to quantify the impact of the increased appetite before any decision.

Answer

Refer the matter to the IT steering committee for a decision on risk tolerance.

Question 5

A multinational bank is integrating its IT risk management with enterprise risk management (ERM). The CGEIT practitioner is asked to evaluate the effectiveness of this integration. Which of the following indicators best demonstrates successful integration?

Accepted Answer

IT risk scenarios are mapped to the enterprise risk taxonomy and reported in the ERM dashboard.. Successful integration is evidenced by IT risks being incorporated into the enterprise risk taxonomy and reported alongside other risks. This ensures a comprehensive view and supports informed decision-making at the enterprise level. Separate registers, misaligned frequencies, and fragmented policy approvals are signs of poor integration.

Answer

The IT risk management policy is approved by the CIO, and the enterprise risk policy is approved by the CFO.

Answer

The IT risk register is maintained separately from the enterprise risk register to preserve IT-specific details.

Answer

IT risk assessments are conducted annually, while enterprise risk assessments are conducted quarterly.

Question 6

A healthcare provider is developing a risk response plan for a critical patient records system. The CGEIT practitioner must ensure that the plan aligns with the enterprise's risk appetite. Which of the following actions is most appropriate?

Accepted Answer

Select risk responses that keep residual risk within the board-approved risk appetite.. Risk responses should be chosen to align with the enterprise's risk appetite, ensuring residual risk stays within acceptable limits. Eliminating all risks, accepting all risks, or transferring all risks without assessment are not aligned with governance principles. The correct approach balances risk and cost.

Answer

Transfer all risks to a third-party insurer without assessing residual risk.

Answer

Implement all possible controls to eliminate all identified risks regardless of cost.

Answer

Accept all risks because the system is critical and cannot be taken offline.

Question 7

The board of a multinational bank has approved a risk appetite statement that explicitly prohibits any single operational risk event exceeding $5 million. The CIO proposes migrating the core banking platform to a public cloud provider, which would introduce a concentration risk that could potentially cause a $12 million outage. The CIO argues that the cloud provider's certifications and service-level agreements mitigate the risk. As the CGEIT practitioner, what should you recommend?

Accepted Answer

Require a formal risk assessment to quantify the potential impact and identify controls that could reduce it to within the approved appetite before proceeding.. The board-approved risk appetite sets a hard limit on acceptable loss. Before approving any initiative that appears to exceed that limit, the CGEIT practitioner must ensure a formal risk assessment quantifies the potential impact and identifies controls that can reduce residual risk to within appetite. This preserves governance integrity and enables informed decision-making.

Answer

Approve the migration because the provider's certifications and SLAs effectively transfer the risk.

Answer

Reject the migration outright because any concentration risk is unacceptable under the risk appetite.

Answer

Recommend that the board revisit the risk appetite statement to accommodate the strategic benefits of cloud migration.

Question 8

A global retailer's board has approved a risk appetite statement that permits a maximum acceptable annual loss from e-commerce fraud of $2 million. Six months into the fiscal year, the CISO reports cumulative fraud losses of $1.9 million, and the fraud team projects an additional $600,000 in losses before year-end if no action is taken. The CISO proposes deploying an AI-based fraud detection tool costing $400,000 annually. What should the CGEIT practitioner recommend FIRST?

Accepted Answer

Escalate the projected risk appetite breach to the board with a risk analysis and recommended response options.. A projected breach of the board-approved risk appetite triggers a governance obligation to escalate with a thorough risk analysis and response options. The board must decide whether to accept, mitigate, transfer, or avoid the risk. Approving a specific tool or adjusting the appetite without board involvement bypasses governance and could lead to misalignment with strategic objectives.

Answer

Instruct the fraud team to increase manual review of transactions to reduce losses below the threshold.

Answer

Approve the AI-based fraud detection tool because the projected losses exceed the risk appetite threshold.

Answer

Revise the risk appetite statement to allow a higher fraud loss limit so the enterprise remains within tolerance.

Question 9

A global retailer is implementing a new enterprise resource planning (ERP) system. The CGEIT practitioner is tasked with ensuring that risk optimization is embedded throughout the project lifecycle. Which TWO of the following actions are most critical to achieve this? (Choose two.)

Accepted Answer

Establish a risk register that is reviewed at key project milestones.. Embedding risk optimization in the ERP project lifecycle requires continuous risk assessment and a dynamic risk register reviewed at milestones. These actions ensure risks are managed proactively. Assigning all risk to one person, conducting a one-time assessment, or delegating decisions to the vendor are ineffective and misaligned with governance.

Answer

Conduct a single comprehensive risk assessment at the project's initiation.

Answer

Assign risk ownership to the project manager for all identified risks.

Answer

Delegate all risk decisions to the ERP vendor to leverage their expertise.

Question 10

A retail company's IT risk register shows that a legacy point-of-sale system has a high likelihood of failure due to unsupported hardware. The CIO wants to replace it, but the CFO argues that the system still works and replacement is too expensive. The CEO asks the CGEIT practitioner to facilitate a decision. Which of the following should be the primary basis for the decision?

Accepted Answer

The alignment of the decision with the enterprise's risk appetite and tolerance levels.. Governance decisions about IT risk should be anchored in the enterprise's risk appetite. When a risk exceeds tolerance, the organization must act to bring it within acceptable levels, even if that requires investment. The CGEIT practitioner facilitates this by ensuring the decision is framed around risk-return alignment rather than cost or technical specifications alone.

Answer

The CFO's cost-benefit analysis showing that replacement is not financially justified.

Answer

The total cost of ownership of the legacy system versus the replacement.

Answer

The technical specifications of the replacement system compared to the legacy system.

Question 11

A global insurer is expanding its use of cloud-hosted underwriting platforms. The CIO proposes a single enterprise risk register entry for 'cloud provider outage,' with quarterly review by the IT steering committee. The board risk committee has asked the CGEIT practitioner to strengthen the integration of IT risk with enterprise risk management. Which TWO actions best align the IT risk taxonomy and reporting with the enterprise risk framework? (Choose two.)

Accepted Answer

Define IT risk appetite thresholds in business terms such as maximum tolerable downtime for underwriting services and incorporate them into the enterprise risk appetite statement.. Integrating IT risk with enterprise risk management requires a shared taxonomy and appetite expressed in business terms. Mapping cloud outage scenarios to the enterprise taxonomy lets the board see technology exposure within operational resilience, while defining thresholds such as maximum tolerable downtime embeds IT risk into the enterprise risk appetite statement. Together these actions align reporting, prioritization, and governance oversight across the organization.

Answer

Delegate all cloud risk decisions to the third-party provider's risk team and accept their residual risk assessment as the enterprise view.

Answer

Increase the frequency of vulnerability scans on the underwriting platform and report the raw scan counts directly to the board risk committee.

Answer

Consolidate all cloud contracts under a single procurement owner to reduce the number of vendor relationships managed by IT.

Question 12

A financial services firm is implementing an enterprise risk management (ERM) framework. The CGEIT practitioner is asked to ensure that IT risk is integrated with overall ERM. Which of the following is the MOST important action to achieve this integration?

Accepted Answer

Ensure IT risk is assessed using the same risk taxonomy and scoring methodology as other enterprise risks.. Integrating IT risk with ERM requires a common risk taxonomy and scoring methodology so that IT risks can be compared, aggregated, and prioritized alongside other enterprise risks. This shared approach enables consistent reporting and informed decision-making at the board level, breaking down silos between IT and business risk management.

Answer

Purchase cyber insurance to transfer IT risks, thereby aligning with enterprise risk transfer strategies.

Answer

Assign the CIO as the sole owner of all IT risks to ensure clear accountability.

Answer

Conduct an annual IT risk assessment separate from the enterprise risk assessment to maintain focus.

Question 13

A global retailer's board has approved a risk appetite statement specifying that the enterprise will accept no more than a 5% annual loss of availability for its e-commerce platform. The CIO proposes moving the platform to a public cloud provider whose standard SLA guarantees 99.5% uptime. Which action should the CGEIT practitioner recommend FIRST?

Accepted Answer

Validate the cloud provider's SLA terms, measurement methodology, and historical performance against the board's tolerance before deciding.. The board's risk appetite is a 5% annual availability loss tolerance for the e-commerce platform. The proposed SLA's 99.5% uptime nominally fits, but SLAs frequently exclude planned maintenance, have vague measurement windows, and offer service credits rather than guaranteed uptime. The practitioner must validate the SLA's actual terms, exclusions, and the provider's historical performance to confirm the real risk exposure. Only after this validation can a recommendation be made that aligns with the board's stated tolerance.

Answer

Accept the proposal because the SLA meets the availability target, and proceed with migration.

Answer

Escalate the decision to the board for a vote because cloud migration inherently changes the risk profile.

Answer

Reject the proposal because 99.5% uptime does not meet the 5% loss tolerance.

Question 14

A global manufacturing firm has a decentralized IT governance model. Each region manages its own IT risk register and reports quarterly to the corporate risk committee. The CGEIT practitioner discovers that one region has been classifying a critical supplier outage as 'low risk' because it has a local backup supplier. However, the corporate risk appetite states that any single supplier failure affecting more than 10% of global production is unacceptable. What is the MOST effective action for the CGEIT practitioner to take?

Accepted Answer

Escalate the discrepancy to the corporate risk committee and recommend a review of the risk governance framework to ensure consistent application of risk appetite across all regions.. In a decentralized governance model, inconsistent application of risk appetite is a governance failure. The CGEIT practitioner should escalate the specific discrepancy to the corporate risk committee and recommend strengthening the framework with a common risk taxonomy, clear escalation criteria, and regular calibration. This addresses both the immediate misclassification and the systemic root cause.

Answer

Recommend that the region increase its quarterly reporting frequency to monthly to improve oversight.

Answer

Direct the region to reclassify the risk as high and update its risk register immediately.

Answer

Accept the region's classification because local backup suppliers mitigate the risk at the regional level.

Question 15

A financial services firm has a low risk appetite for data breaches. The CGEIT practitioner is reviewing the IT risk register and notices that a critical vulnerability in the customer database has a high likelihood of exploitation and a high impact. The current risk response is 'accept' with no further action. What should the CGEIT practitioner recommend?

Accepted Answer

Re-evaluate the risk response because it exceeds the risk appetite and should be mitigated or avoided.. The risk response must align with the low risk appetite for data breaches. Accepting a high-likelihood, high-impact risk is inappropriate. The CGEIT practitioner should recommend re-evaluating the response, likely mitigation or avoidance. Maintaining acceptance, transferring without mitigation, or changing appetite are not aligned with governance principles.

Answer

Escalate to the board to increase the risk appetite for data breaches to align with the current response.

Answer

Maintain the 'accept' response since the database is critical and cannot be taken offline.

Answer

Transfer the risk by purchasing cyber insurance and continue accepting the residual risk.