CGEIT Risk Optimization — Timed 10 Questions

Question 1

When the board of directors requests a report on the current IT risk posture, which metric is most effective for demonstrating alignment between risk appetite and investment?

Accepted Answer

Total dollar value of IT capital expenditure.. The risk-adjusted return on investment or the coverage of critical business processes by risk mitigation controls provides the board with actionable insight into how risk appetite is being honored.

Answer

Number of open high-severity security patches.

Answer

Average response time for IT service desk tickets.

Answer

Historical count of phishing emails blocked by the email gateway.

Question 2

When reporting IT risk to the board, which of the following provides the most value?

Accepted Answer

A heat map showing the impact of top risks on business value drivers.. Boards need context, trends, and business impact rather than technical metrics.

Answer

A list of all open vulnerabilities categorized by severity.

Answer

The total number of security incidents reported in the last quarter.

Answer

A detailed technical audit report of the firewall configurations.

Question 3

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

To serve as an early warning signal of potential risk events.. KRIs are early warning signs that risk exposure is changing.

Answer

To ensure that all employees have completed security awareness training.

Answer

To provide a detailed log of all security threats blocked by the firewall.

Answer

To measure the success of past risk mitigation strategies.

Question 4

An enterprise is evaluating the trade-off between the cost of risk mitigation and the potential business benefit. Which framework or approach should the practitioner use?

Accepted Answer

Return on Security Investment (ROSI).. Cost-benefit analysis in risk management is fundamental to risk optimization.

Answer

Total Cost of Ownership (TCO) analysis.

Answer

Key Risk Indicator (KRI) dashboarding.

Answer

Business Impact Analysis (BIA).

Question 5

What is the most effective way to ensure that IT risk management is integrated with enterprise risk management (ERM)?

Accepted Answer

Aligning the IT risk taxonomy and reporting thresholds with the corporate ERM framework.. Common language and metrics are required for cross-departmental risk alignment.

Answer

Moving the IT risk management function under the responsibility of the Chief Financial Officer.

Answer

Requiring IT to report risks directly to the Chief Risk Officer on a weekly basis.

Answer

Mandating that IT uses the same risk assessment software as the finance department.

Question 6

An IT project is identified as having a high inherent risk that exceeds the board-approved appetite. The project is critical for competitive advantage. Which approach is most appropriate?

Accepted Answer

Present a business case to the board for formal risk acceptance with compensatory controls.. Governance allows for risk acceptance at the appropriate level if the business value is high.

Answer

Implement excessive controls regardless of project cost.

Answer

Direct the IT team to lower the risk by reducing project scope.

Answer

Cancel the project immediately to maintain compliance.

Question 7

An organization is transitioning to a cloud-based infrastructure. Which governance mechanism is most effective for ensuring that the cloud service provider's risk management practices remain aligned with the enterprise's risk appetite?

Accepted Answer

Embedding ongoing risk assessment requirements into the service provider contract.. Continuous monitoring and contractual requirements are key for third-party risk governance.

Answer

Performing an annual penetration test on the provider's infrastructure.

Answer

Mandating a SOC 2 Type II report review on an annual basis.

Answer

Establishing clear service level agreements (SLAs) with penalty clauses for downtime.

Question 8

During an IT governance board meeting, the CGEIT practitioner notices that the current risk profile deviates significantly from the approved risk appetite. What is the most appropriate next step?

Accepted Answer

Formally report the variance to the board and propose a remediation plan.. Governance requires transparency and corrective action when thresholds are exceeded.

Answer

Update the enterprise risk management policy to include the new risks.

Answer

Instruct the IT department to stop all new projects until the risk is lowered.

Answer

Adjust the risk appetite levels to match the current risk profile.

Question 9

An enterprise is aligning its IT risk appetite with corporate strategic objectives. Which action should the CGEIT-certified practitioner prioritize first?

Accepted Answer

Define the enterprise risk capacity based on strategic objectives.. Aligning risk appetite requires a clear understanding of the enterprise's strategic goals and its capacity to absorb loss.

Answer

Draft the IT risk register for department heads.

Answer

Conduct a technical vulnerability scan of all production servers.

Answer

Implement an automated GRC risk dashboard.

Question 10

When assessing the impact of a risk, what is the best perspective to take?

Accepted Answer

The effect on business objectives and value delivery.. Impact is defined by the loss of business value, not technical downtime.

Answer

The cost of the hardware that needs to be replaced.

Answer

The percentage of the IT budget consumed by the incident.

Answer

The number of hours required to restore the system.