CGEIT Risk Optimization Practice Test 5 — 15 Questions

Question 1

A retail bank's board has approved a risk appetite stating that no single technology failure may cause more than two hours of customer-facing outage. The CIO reports that the core banking platform depends on a single data center with a tested recovery time objective of six hours. Which action should the CGEIT practitioner recommend FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Escalate the appetite gap to the board risk committee with options to remediate the recovery capability or formally revise the appetite.. The board-approved appetite defines acceptable exposure, and the six-hour recovery objective exceeds the two-hour tolerance. The practitioner's first duty is to surface that gap to the board risk committee with remediation options and the alternative of formally revising the appetite. This preserves board ownership, enables an informed decision, and prevents either silent acceptance or unilateral spending.

Answer

Immediately approve funding for a second data center without consulting the board risk committee.

Answer

Revise the risk appetite statement to a six-hour tolerance so that reporting shows full compliance.

Answer

Accept the six-hour recovery time objective because the platform has never experienced a full outage.

Question 2

A multinational corporation is expanding into a new market with significant regulatory uncertainty. The CGEIT practitioner is tasked with ensuring that the risk management process remains effective despite rapidly changing regulations. Which of the following approaches is MOST appropriate?

Accepted Answer

Establish a dynamic risk monitoring process that includes regulatory horizon scanning and triggers for reassessment.. In a rapidly changing regulatory environment, a dynamic risk monitoring process with horizon scanning and reassessment triggers is most appropriate. It enables early detection of changes and timely risk response, keeping the risk management process effective and aligned with governance objectives. Static or passive approaches fail to address the velocity of regulatory change.

Answer

Transfer all regulatory compliance risks to a third-party legal firm through contractual agreements.

Answer

Adopt a wait-and-see approach until regulations are finalized to avoid unnecessary risk mitigation costs.

Answer

Conduct a one-time comprehensive risk assessment before market entry and update it annually.

Question 3

A financial services firm is integrating its IT risk register with its enterprise risk management (ERM) framework. The CGEIT practitioner is asked to ensure that IT risk reporting to the board is both actionable and aligned with strategic objectives. Which TWO of the following practices are MOST critical to achieve this integration? (Choose two.)

Accepted Answer

Mapping IT risks to specific business processes and strategic objectives.. Integrating IT risk with ERM requires expressing IT risks in business terms and using consistent methodologies. Mapping IT risks to business processes and strategic objectives ensures the board understands impact on corporate goals. A common risk taxonomy and scoring methodology enables aggregation and comparison with other enterprise risks. Together, these practices make IT risk reporting actionable and aligned with strategy. Other options, such as equal reporting frequency or exclusive CIO ownership, undermine integration by creating silos or diluting focus.

Answer

Conducting annual IT risk assessments without continuous monitoring.

Answer

Delegating IT risk ownership exclusively to the CIO to streamline accountability.

Answer

Reporting all IT risks with equal frequency and detail to ensure completeness.

Question 4

An insurance company is developing a new mobile app that will allow customers to file claims and upload sensitive documents. The CGEIT practitioner is asked to ensure that risk is optimized during the development lifecycle. Which of the following should be the PRIMARY consideration when integrating risk management into the project?

Accepted Answer

Embedding risk assessment and response activities into each phase of the development lifecycle.. Risk optimization during a project requires continuous risk management integrated into every phase of the lifecycle. This enables early identification of threats and opportunities, informed decision-making, and timely adjustments. While compliance, penetration testing, and insurance are important, they are individual controls or responses, not the overarching approach to embedding risk management into the development process.

Answer

Ensuring that all regulatory requirements for data privacy are met before launch.

Answer

Purchasing cyber insurance to transfer the risk of a data breach.

Answer

Conducting a penetration test before the app is released to production.

Question 5

A pharmaceutical company relies on a legacy laboratory information management system that cannot be patched and is essential for regulatory submissions. The CGEIT practitioner is updating the risk register and must select the most appropriate risk response for the confirmed inability to remediate. Which response should be documented?

Accepted Answer

Risk acceptance with documented compensating controls, executive approval, and a scheduled replacement roadmap.. Because the legacy system is essential and cannot be patched, avoidance and mitigation are infeasible, and transfer alone leaves operational and regulatory exposure unmanaged. Deliberate acceptance with compensating controls, executive approval, and a replacement roadmap keeps the residual risk visible, governed, and bounded while the business continues to meet its regulatory obligations.

Answer

Risk transfer by purchasing cyber insurance and removing the system from the risk register.

Answer

Risk avoidance by decommissioning the system immediately and halting regulatory submissions.

Answer

Risk mitigation by applying an unsupported third-party patch to the legacy system without vendor validation.

Question 6

A hospital's board has established a risk appetite that prioritizes patient safety over cost efficiency. The CGEIT practitioner is reviewing IT investment proposals and must ensure they align with this risk appetite. Which TWO of the following actions best demonstrate alignment with the board's risk appetite? (Choose two.)

Accepted Answer

Prioritize funding for a redundant electronic health record (EHR) system to minimize downtime risk, even though it increases costs.. The board's risk appetite prioritizes patient safety over cost efficiency. Therefore, investments that increase costs but reduce patient safety risks—such as redundant EHR systems and clinical decision support tools—are aligned. Actions that cut costs by deferring security patching, outsourcing to low-cost providers, or reducing backup testing increase patient safety risks and thus misalign with the stated appetite.

Answer

Outsource the management of patient monitoring systems to a low-cost provider to reduce expenses and free up internal resources.

Answer

Defer security patching on medical devices to avoid disrupting clinical workflows, as patient safety takes precedence.

Answer

Reduce the frequency of backup testing for clinical databases to save on operational costs, since backups are rarely needed.

Question 7

A financial services firm is reviewing its IT risk management framework. The CGEIT practitioner has been asked to identify the factors that should be considered when determining the appropriate risk response for a critical IT system failure. Which TWO of the following factors are MOST important for this determination? (Choose two.)

Accepted Answer

The cost-benefit analysis of each risk response option.. Determining the appropriate risk response requires aligning with the organization's risk appetite and tolerance, and evaluating the cost-benefit of response options. These factors ensure the response is both strategically aligned and economically justified. Technical details, staffing, and vendor reputation are secondary considerations that may affect implementation but do not drive the fundamental choice of response.

Answer

The IT department's current staffing levels and skills.

Answer

The number of vulnerabilities identified in the last penetration test.

Answer

The technology vendor's market share and brand reputation.

Question 8

A healthcare provider experiences a ransomware attack that encrypts patient records. The incident response team has contained the malware and restored systems from backups. According to IT governance principles, which action should the CGEIT practitioner ensure is performed NEXT?

Accepted Answer

Conduct a post-incident review to identify root causes and update the risk register.. Following containment and recovery, the governance priority is to learn from the incident. A post-incident review identifies root causes, evaluates control effectiveness, and updates the risk register. This ensures that risk management is iterative and that the board receives assurance of improvement. Notification, personnel actions, and insurance decisions are important but should be informed by the review's findings. The review is the foundational step that enables other actions to be taken correctly and in the right sequence.

Answer

Immediately notify all patients and regulators about the breach.

Answer

Purchase additional cyber insurance to transfer future ransomware risks.

Answer

Terminate the employment of the IT staff responsible for the backup failure.

Question 9

A telecommunications provider has completed a risk assessment for a new 5G network slicing service. The CGEIT practitioner must ensure the results are used to optimize risk. Which action best demonstrates that risk assessment outputs are driving resource allocation decisions?

Accepted Answer

Prioritizing security investment for the highest-rated slicing risks and adjusting the service launch plan to remediate them before go-live.. Risk optimization means assessment outputs change where money, time, and attention go. Prioritizing investment toward the highest-rated network slicing risks and making remediation a condition of launch converts analysis into concrete allocation and sequencing decisions. Archiving, counting, or equalizing budgets do not alter resource flows in response to risk severity, so they fail to demonstrate optimization.

Answer

Assigning every identified risk an equal remediation budget to avoid perceived favoritism among business units.

Answer

Presenting the total number of identified risks to the executive committee as a measure of assessment thoroughness.

Answer

Filing the assessment in the project repository so it is available for future audits.

Question 10

A multinational bank's board has set a low risk appetite for regulatory compliance failures. The CGEIT practitioner discovers that a critical IT system supporting anti-money laundering (AML) reporting is running on an unsupported operating system. The IT director argues that upgrading is too costly and proposes compensating controls. Which action should the practitioner recommend to the board?

Accepted Answer

Present a risk analysis to the board that quantifies the compliance exposure and evaluates options, including upgrade, compensating controls, and system replacement.. With a low risk appetite for compliance failures, the board must be presented with a thorough risk analysis that quantifies exposure and evaluates all viable options. This enables an informed decision that balances risk reduction with cost and operational considerations. The analysis should include the likelihood and impact of regulatory penalties, the effectiveness of compensating controls, and the feasibility of upgrade or replacement. This approach ensures the board exercises proper oversight and documents its rationale, which is crucial for regulatory accountability.

Answer

Accept the compensating controls because they reduce risk to an acceptable level.

Answer

Defer the decision to the next annual risk assessment cycle to gather more data.

Answer

Direct the IT director to upgrade the system immediately, regardless of cost.

Question 11

A telecommunications company has a risk appetite that allows for moderate risk-taking to achieve innovation goals. The CGEIT practitioner is reviewing a proposal to adopt a new, unproven 5G technology for a critical network segment. The technology promises significant competitive advantage but has known stability issues. What is the MOST appropriate recommendation?

Accepted Answer

Recommend a phased implementation with enhanced monitoring and a rollback plan, treating the risk as acceptable within the innovation appetite.. Given a moderate risk appetite for innovation, the best recommendation is a phased implementation with enhanced monitoring and a rollback plan. This approach allows the company to pursue competitive advantage while managing stability risks within acceptable limits. It balances risk and reward, consistent with the board's stated tolerance for moderate risk-taking.

Answer

Recommend transferring the risk by outsourcing the network segment to a third party that specializes in 5G.

Answer

Approve full deployment immediately to gain first-mover advantage, accepting the stability risks as within appetite.

Answer

Reject the proposal because unproven technology poses unacceptable risk to critical infrastructure.

Question 12

A hospital group's board has set a low tolerance for clinical system availability risk. The IT director proposes a multi-year program to reduce downtime, but the CFO wants to defer funding to next year's budget cycle. Which governance principle should the CGEIT practitioner cite to support immediate funding consideration?

Accepted Answer

Risk response decisions must be aligned with the board-approved risk appetite and tolerance levels.. The board's low tolerance for clinical system availability risk obligates the enterprise to resource responses consistent with that tolerance, regardless of budget cycle timing. Citing appetite and tolerance alignment supports immediate funding consideration because deferral would leave exposure outside the board-defined boundary. The other statements are financial or procedural heuristics that do not reflect governance accountability for risk appetite.

Answer

Operational risk decisions should be delegated entirely to the IT director without board involvement.

Answer

All IT investments must achieve a positive return on investment within twelve months.

Answer

Risk treatment should always be postponed until the next annual enterprise risk assessment cycle.

Question 13

An e-commerce company's risk register shows that a third-party payment gateway poses a high risk of data breach. The CGEIT practitioner is asked to recommend a risk response that aligns with the enterprise's risk appetite. The board has stated that it will not accept any risk that could lead to a material data breach. Which risk response should the practitioner recommend?

Accepted Answer

Avoid the risk by discontinuing use of the third-party gateway and developing an in-house payment solution.. The board's risk appetite explicitly rejects any risk that could lead to a material data breach. Among risk responses, avoidance is the only option that eliminates the risk entirely. Discontinuing the third-party gateway removes the exposure, while mitigation, transfer, and acceptance leave residual risk that could still result in a breach. Although developing an in-house solution may be costly, it aligns with the board's directive and ensures the enterprise does not violate its stated tolerance. This recommendation demonstrates governance alignment with risk appetite.

Answer

Mitigate the risk by implementing additional encryption and monitoring controls on the gateway.

Answer

Transfer the risk by requiring the payment gateway provider to accept full liability for breaches.

Answer

Accept the risk because the third-party gateway is industry-standard and widely used.

Question 14

A pension fund administrator has completed a quantitative risk analysis for its core benefits-processing platform. The analysis shows an inherent annualized loss expectancy of $4.8 million. Management has implemented redundant data centers, automated reconciliation controls, and 24x7 monitoring at an annual cost of $900,000, which reduces the expected loss to $1.1 million. The CIO argues the remaining $1.1 million should be treated as fully mitigated because controls are now in place. As the CGEIT practitioner advising the risk committee, what is the MOST appropriate governance response?

Accepted Answer

Document the $1.1 million as residual risk that must be formally accepted or further treated by the appropriate risk owner, since controls reduce but never eliminate exposure.. Controls reduce exposure but do not eliminate it, so the post-control figure of $1.1 million is residual risk. Enterprise governance requires each residual risk to have a named owner and an explicit accept-or-treat decision recorded in the register, even when the amount sits within appetite. The reduction achieved demonstrates good control design, but it does not convert the remaining exposure into a non-risk or justify deleting it from oversight.

Answer

Reclassify the $1.1 million as an inherent risk in the register because the original assessment was performed before the controls were deployed.

Answer

Remove the platform from the enterprise risk register because the implemented controls have brought the exposure below the organization's stated risk appetite threshold.

Answer

Approve the CIO's position because the $3.7 million reduction in expected loss demonstrates that the control investment has been cost-justified against the inherent exposure.

Question 15

A national retail chain is selecting a cloud-based point-of-sale analytics provider that will process aggregated sales and loyalty data. The vendor will store data in a multi-tenant environment and subcontract a third party for data enrichment. The information security manager proposes approving the vendor based on its ISO/IEC 27001 certificate alone. As the CGEIT practitioner, which action BEST ensures third-party risk is governed appropriately before contract signature?

Accepted Answer

Perform risk-based due diligence that evaluates the vendor's controls, the subcontractor's role, contractual liability, and the sensitivity of the data, then document residual third-party risk for acceptance.. Third-party risk must be governed through due diligence scaled to data sensitivity and service criticality, extending to subcontractors and contractual protections. A certification supports but does not replace that assessment. The practitioner should ensure the evaluation covers controls, data handling, liability, and breach obligations, and that the resulting residual risk is documented and accepted by the appropriate risk owner before the enterprise becomes contractually committed.

Answer

Require the vendor to purchase cyber liability insurance and proceed once the certificate of insurance confirms coverage limits exceed the contract value.

Answer

Accept the certification as sufficient assurance because ISO/IEC 27001 requires an independent audit of the vendor's control environment.

Answer

Delegate the decision to the procurement team because vendor selection is a sourcing activity rather than an enterprise risk governance matter.