Courseiva

CCNA Governance OF Enterprise IT Questions

32 of 107 questions · Page 2/2 · Governance OF Enterprise IT · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQmedium

A government agency's IT governance committee is finalizing its governance framework. A dispute arises over who should approve exceptions to the enterprise architecture standards when a business unit needs a rapid technology deployment. Which principle should guide the committee's decision on where to place exception approval authority?

A.Exceptions should be approved by a designated architecture authority with defined criteria and time limits.
B.Exceptions should be approved by the external auditor to provide independent validation of each case.
C.Exceptions should be approved by the requesting business unit's project manager to preserve agility.
D.Exceptions should be approved by the IT governance committee for every deployment to ensure consistency.
AnswerA

Placing exception authority with a designated architecture authority, governed by explicit criteria and expiration dates, balances agility with control. It ensures decisions are made by a body with the expertise and objectivity to assess architectural and risk impacts, while time limits prevent exceptions from becoming permanent de facto standards. This aligns with ISACA CGEIT governance design principles.

Why this answer

Exception authority should sit with a designated architecture authority operating under explicit criteria, documented rationale, and time limits, which preserves both agility and control. Self-approval by requesters, case-by-case governance committee review, and external auditor approval all misplace authority, creating conflicts, bottlenecks, or independence breaches. ISACA CGEIT guidance supports delegated decision rights bounded by criteria and escalation for material impacts.

Exam trap

The trap here is assuming that faster deployment requires approval by the requesting party, when speed can be preserved through a delegated authority with clear criteria and time limits.

Practice this question →
77
MCQmedium

A multinational retailer's board has approved an enterprise risk appetite statement that explicitly limits financial exposure from any single IT outage to $2 million. The CIO reports that a core payment system runs on unsupported infrastructure with an estimated single-event loss of $8 million. The board asks the IT governance committee to respond. Which action BEST aligns with ISACA CGEIT governance principles?

A.Ask the CIO to revise the risk appetite statement so the payment system falls within tolerance.
B.Direct management to accept the risk because the system has operated without failure for five years.
C.Instruct internal audit to add the payment system to next year's audit plan and wait for findings.
D.Escalate the gap to the board with options to remediate, transfer, or formally approve a time-bound exception.
AnswerD

When a risk exceeds the approved appetite, governance requires escalation to the body that owns the appetite so it can decide among remediation, risk transfer, or a documented exception. This preserves accountability, keeps the decision at the right authority level, and ensures the board explicitly owns any temporary tolerance breach rather than management silently absorbing it.

Why this answer

Governance bodies own risk appetite, so when an identified exposure exceeds the approved threshold, the committee must escalate to that owner with viable response options rather than accept, defer, or redefine the limit. Escalation preserves accountability, ensures the decision sits with the authority that set the tolerance, and produces a documented, time-bound resolution aligned with ISACA CGEIT governance expectations.

Exam trap

The trap here is assuming the governance committee can itself accept or adjust a risk that exceeds the board's appetite, when only the appetite owner can authorize such a breach.

Practice this question →
78
MCQmedium

In the context of the COBIT 2019 framework, what does 'Governance' mean?

A.Execution of technical tasks.
B.Evaluation, direction, and monitoring of enterprise activities.
C.Managing the budget of the IT department.
D.Developing software applications.
AnswerB

In COBIT 2019, governance means evaluating stakeholder needs and options, directing through prioritisation and decision-making, and monitoring performance and compliance against agreed direction. This evaluate-direct-monitor definition distinguishes governance from management, which plans, builds, runs and monitors activities in alignment with that direction.

Why this answer

In COBIT 2019, governance is defined as the set of activities that ensure enterprise objectives are achieved by evaluating stakeholder needs, setting direction through prioritization and decision-making, and monitoring performance and compliance. This is captured in the governance framework's core model of Evaluate, Direct, and Monitor (EDM), which sits above the management objectives. Therefore, 'evaluation, direction, and monitoring of enterprise activities' is the precise COBIT definition.

Exam trap

The trap here is conflating governance with management; candidates often pick operational activities like budgeting or software development because they sound like IT leadership tasks, but COBIT strictly defines governance as Evaluate, Direct, and Monitor.

How to eliminate wrong answers

Option A is wrong because executing technical tasks is a management activity (aligned with COBIT's APO, BAI, DSS, and MEA domains), not governance, which operates at a higher oversight level. Option C is wrong because managing the IT department budget is a specific management responsibility (part of APO06—Managed Budget and Costs), not the broad governance definition. Option D is wrong because developing software applications is a management/build activity (BAI03—Managed Solutions Identification and Build), not governance.

Practice this question →
79
MCQhard

A conflict arises between the IT department's desire for innovation and the business unit's desire for operational stability. What is the role of governance?

A.The IT department should always win for innovation.
B.The governance framework should facilitate a balance based on strategic priorities.
C.The business unit should always win for stability.
D.The board should ignore the conflict.
AnswerB

Governance arbitrates competing innovation and stability demands by reference to strategic priorities, not departmental preference. This satisfies the stem's requirement for governance's role in resolving the conflict, ensuring the balance struck reflects enterprise strategy rather than either party's agenda.

Why this answer

Governance exists to align IT with enterprise strategy, so when innovation and stability conflict, the governance framework should facilitate a balanced decision based on strategic priorities. It provides the decision rights, escalation paths, and criteria to resolve the tension rather than letting either side automatically prevail. This ensures IT investments and operations support overall business objectives.

Exam trap

CGEIT often tests whether candidates understand governance as a balancing and decision-rights mechanism; the trap is choosing a partisan answer (IT wins or business wins) instead of the balanced, strategy-driven governance role.

How to eliminate wrong answers

Option A is wrong because governance does not default to IT's innovation agenda; that would ignore business stability requirements and strategic alignment. Option C is wrong because automatically favoring the business unit's stability preference is equally unbalanced and can stifle necessary transformation. Option D is wrong because ignoring the conflict abdicates governance responsibility; the board and governance bodies are precisely who should arbitrate such tensions.

Practice this question →
80
MCQhard

A firm identifies that its IT governance framework is too burdensome for its agile, small-team structure. What is the most appropriate governance action?

A.Standardize all processes across the company.
B.Tailor the governance system by adjusting design factors.
C.Ignore the framework until the company grows.
D.Appoint more auditors to monitor compliance.
AnswerB

Tailoring the governance system by adjusting design factors right-sizes controls to the organisation's size, culture and agile delivery model. COBIT explicitly expects this adaptation, so governance remains effective without imposing disproportionate process overhead on small teams.

Why this answer

COBIT 2019 explicitly supports tailoring the governance system by adjusting design factors — enterprise size, goals, risk profile, and culture — so the framework fits the organization rather than forcing the organization to fit the framework. For a small, agile firm, tailoring means scaling down process rigor, reducing documentation, and focusing on the governance objectives that matter most. This is the most appropriate action because it preserves governance intent while removing unnecessary burden.

Exam trap

CGEIT often tests the COBIT tailoring principle — candidates pick standardization or more auditors because they equate governance with rigor, but COBIT explicitly requires adjusting design factors so governance fits the enterprise context.

How to eliminate wrong answers

Option A is wrong because standardizing all processes across the company increases burden and ignores the design factor principle — it forces a one-size-fits-all model that is exactly the problem being described. Option C is wrong because ignoring the framework until the company grows leaves the organization without governance during its most vulnerable growth phase and is not a governance action at all. Option D is wrong because appointing more auditors adds cost and oversight without addressing the root cause — the framework is too heavy, not under-enforced, so more auditors would worsen the burden.

Practice this question →
81
MCQhard

A global manufacturer operates in multiple jurisdictions with differing data protection requirements. The IT governance committee must decide how to structure oversight so that local compliance is maintained while enterprise-wide IT risk is managed consistently. Which approach BEST achieves this?

A.Allow each regional IT organization to define and enforce its own data protection controls independently.
B.Establish enterprise-level data protection principles and risk tolerances, with regional implementation tailored to local legal requirements and reported through a common risk reporting structure.
C.Centralize all data protection decisions at headquarters and require regions to submit requests for any local deviation.
D.Apply the strictest single jurisdiction's data protection requirements uniformly across all regions.
AnswerB

This approach preserves consistent enterprise risk direction through common principles, tolerances, and reporting, while allowing regional tailoring to satisfy differing legal requirements. The committee retains a consolidated view of risk and can compare treatment across jurisdictions, achieving both local compliance and enterprise-wide consistency without forcing a single rigid control set.

Why this answer

Multinational IT governance must reconcile enterprise consistency with local legal variation. Setting enterprise principles, risk tolerances, and common reporting preserves a unified view of risk, while permitting regional implementation tailored to local law achieves compliance. This layered model lets the committee govern aggregate exposure without dictating identical controls in every jurisdiction.

Exam trap

The trap here is treating the choice as strictly centralize or strictly decentralize, when effective multinational governance layers enterprise principles over regionally tailored implementation and reporting.

Practice this question →
82
MCQmedium

Which action should the governance body take if a major IT risk is identified that exceeds the enterprise's risk appetite?

A.Formally communicate the risk to the board and propose a risk treatment plan
B.Wait for the risk to manifest before taking action
C.Re-evaluate the definition of risk appetite to match the current state
D.Request the IT department to simply delete the system causing the risk
E.Ignore the risk if it helps achieve a short-term profit target
AnswerA

Escalating a risk beyond appetite to the board preserves accountability, since only the board can sanction acceptance or mandate treatment. Formal communication plus a proposed treatment plan satisfies the stem's requirement to act when risk exceeds the enterprise's stated risk appetite.

Why this answer

When a major IT risk exceeds the enterprise's risk appetite, the governance body must escalate it formally to the board and propose a risk treatment plan (mitigate, transfer, avoid, or accept with justification). This fulfills the governance body's oversight duty and ensures informed decision-making at the highest level. Simply ignoring or redefining risk appetite to fit the situation undermines the integrity of the risk management framework.

Exam trap

CGEIT often tests the governance principle that risk appetite is a board-set boundary — candidates may pick 're-evaluate risk appetite' as a quick fix, missing that changing appetite to fit a risk is a governance failure, not a treatment.

How to eliminate wrong answers

Option B is wrong because waiting for the risk to manifest violates proactive risk management and can result in severe impact. Option C is wrong because redefining risk appetite to match the current state is a form of 'moving the goalposts' that defeats the purpose of having a risk appetite. Option D is wrong because simply deleting the system is not a considered treatment — it ignores business impact, dependencies, and may not be feasible.

Option E is wrong because ignoring risk for short-term profit is a fundamental governance failure and may constitute a breach of fiduciary duty.

Practice this question →
83
MCQhard

An enterprise's IT steering committee has approved a portfolio of digital initiatives, but six months later, value delivery is unclear and business sponsors report that IT priorities do not reflect strategic objectives. A review finds that initiatives were approved based on technical feasibility rather than business case alignment. Which governance action should the committee take to correct this?

A.Delegate initiative prioritization to the enterprise architecture team, since they understand technical dependencies.
B.Institute a formal investment decision process that requires business case justification and explicit linkage to strategic objectives before approval.
C.Increase the frequency of status reporting from project managers to the steering committee.
D.Require all new initiatives to be approved exclusively by the CIO to speed up decision-making.
AnswerB

The problem is that investment decisions lacked business-case rigor and strategic linkage. Instituting a formal process that requires documented business cases and traceability to strategy directly addresses the root cause. It ensures the steering committee evaluates initiatives on value and alignment rather than technical feasibility alone. This restores the governance principle that IT investments must demonstrably support enterprise objectives and be accountable for outcomes.

Why this answer

The steering committee's failure was approving initiatives on technical feasibility rather than strategic value. Correcting this requires a formal investment process that mandates business case justification and traceable linkage to enterprise objectives. Such a process ensures decisions are grounded in value and alignment, which is the core governance purpose of IT investment oversight.

Monitoring and delegation changes do not address the flawed selection criteria that produced the misalignment.

Exam trap

The trap here is treating increased reporting or centralized approval as a fix, when the real defect is the absence of value-based and strategy-linked investment criteria.

Practice this question →
84
MCQmedium

A newly appointed CIO is establishing an IT governance framework. Which approach best ensures that IT governance activities are integrated into existing business decision-making processes?

A.Embedding IT governance roles and responsibilities into existing business management functions
B.Requiring all IT decisions to be signed off by the board of directors
C.Implementing an IT-only governance framework based strictly on COBIT 2019
D.Creating a separate IT governance committee with independent reporting lines
AnswerA

Embedding IT governance roles into existing business management functions avoids a parallel structure, so IT decisions are made within the same forums, budgets and accountability chains as business decisions. This satisfies the stem's integration requirement by making governance inseparable from routine business decision-making.

Why this answer

Embedding IT governance roles and responsibilities into existing business management functions ensures governance is not a parallel silo but part of how the business already makes decisions. This approach leverages existing decision-making forums, reporting lines, and accountability structures, which is the most effective way to integrate IT governance into business processes per COBIT and ISO/IEC 38500.

Exam trap

CGEIT often tests the misconception that stronger governance means more separate IT oversight bodies or stricter board approval, when the correct answer is integration into existing business decision-making structures.

How to eliminate wrong answers

Option B is wrong because requiring board sign-off on all IT decisions creates a bottleneck and conflates governance with operational approval; boards should set direction and oversee, not approve every IT decision. Option C is wrong because an IT-only framework based strictly on COBIT 2019 ignores the business context and fails to integrate with business decision-making — COBIT itself emphasizes tailoring and enterprise-wide integration. Option D is wrong because a separate IT governance committee with independent reporting lines creates a silo that is disconnected from business management, which is the opposite of integration.

Practice this question →
85
MCQhard

A financial services firm's IT governance committee is reviewing its performance measurement approach. Executives report that current IT metrics focus on uptime and help-desk volumes, and the board cannot tell whether IT is delivering strategic value. The committee wants metrics that demonstrate IT's contribution to enterprise objectives. Which approach should the committee adopt?

A.Benchmark help-desk resolution times against industry averages and report the variance.
B.Implement a balanced scorecard linking IT objectives to enterprise goals with outcome-based measures.
C.Adopt a single composite IT health index that aggregates all operational metrics into one score.
D.Increase the frequency of uptime reporting from monthly to weekly to improve visibility.
AnswerB

A balanced scorecard connects IT objectives and metrics to enterprise goals across financial, customer, internal process, and learning perspectives, translating IT activity into business outcomes. This gives the board a line of sight from IT performance to strategic value. It directly addresses the committee's need to demonstrate contribution rather than operational activity, aligning with ISACA CGEIT performance management guidance.

Why this answer

Demonstrating IT's strategic contribution requires metrics that trace from IT objectives to enterprise goals, which a balanced scorecard with outcome-based measures provides. Operational metrics such as uptime, resolution times, and composite health indices describe activity and efficiency but cannot show value delivery. ISACA CGEIT stresses aligning IT performance measurement with enterprise strategy so governing bodies can assess whether IT is creating intended value.

Exam trap

The trap here is choosing a more detailed or more frequent operational metric, when the board's real need is a causal linkage between IT performance and enterprise outcomes.

Practice this question →
86
MCQeasy

A hospital network's IT governance committee is establishing its oversight structure. The committee needs a mechanism that provides independent, objective assurance to the board on whether IT controls are designed and operating effectively. Which mechanism should the committee establish?

A.A weekly operations review meeting with IT managers to track incident metrics.
B.An IT steering committee chaired by the CIO to prioritize project requests.
C.A vendor scorecard process that rates third-party service providers quarterly.
D.An internal audit function with a reporting line to the board or audit committee.
AnswerD

Internal audit provides independent, objective assurance on control design and operating effectiveness when it reports to the board or audit committee rather than to management. This independence is exactly what the governance committee needs to verify that IT controls work as intended. It is the recognized assurance mechanism under ISACA CGEIT and professional auditing standards.

Why this answer

Independent assurance over IT control design and operating effectiveness is delivered by internal audit when it reports to the board or audit committee, free from management influence. Steering committees, operations reviews, and vendor scorecards all serve valid purposes but are management-aligned activities that cannot objectively attest to controls. ISACA CGEIT emphasizes this separation as fundamental to effective governance oversight.

Exam trap

The trap here is equating any oversight meeting or performance scorecard with independent assurance, when independence of the reporting line is the defining requirement.

Practice this question →
87
Multi-Selecthard

Which THREE factors should the board of directors consider when establishing IT governance oversight mechanisms?

Select 3 answers
A.Regulatory and compliance requirements.
B.Alignment of IT initiatives with business strategy.
C.Enterprise risk appetite.
D.Daily network uptime statistics.
E.Detailed software configuration standards.
AnswersA, B, C

Boards must ensure oversight mechanisms embed regulatory and compliance obligations, since external mandates define minimum governance controls the enterprise cannot tailor away. This factor directly satisfies the stem's requirement to consider what constrains governance design, ensuring the board's oversight framework remains legally defensible and auditable.

Why this answer

Option A (Regulatory and compliance requirements) is correct because IT governance oversight must ensure the organization meets legal, statutory, and industry obligations such as GDPR, HIPAA, SOX, or PCI DSS, which directly shape governance structures, controls, and reporting to the board. Option B (Alignment of IT initiatives with business strategy) is correct because a core purpose of IT governance is to ensure technology investments and initiatives support and enable the enterprise's strategic objectives, typically through frameworks like COBIT that link IT goals to business goals. Option C (Enterprise risk appetite) is correct because the board must define and monitor how much IT-related risk the organization is willing to accept, guiding decisions on security, resilience, and investment priorities.

Option D (Daily network uptime statistics) is not appropriate for board-level governance oversight, as it is an operational metric handled by IT management, not a strategic governance factor. Option E (Detailed software configuration standards) is also operational and tactical, belonging to IT operations and technical teams rather than the board's governance responsibilities.

Exam trap

CGEIT often tests the governance-versus-management boundary, tempting candidates to select operational metrics (uptime, configuration standards) as board-level oversight inputs when those belong to IT management.

Practice this question →
88
MCQmedium

A large enterprise is transitioning to a hybrid cloud environment. How should the governance policy be updated to maintain effective oversight?

A.Develop policies addressing shared responsibility and cloud governance controls.
B.Centralize all IT infrastructure back to on-premises.
C.Shift all responsibility for security to the cloud provider.
D.Eliminate the need for internal IT policies.
AnswerA

Hybrid cloud splits control between the enterprise and providers, so policy must define shared responsibility boundaries and cloud-specific controls. This satisfies the stem's oversight requirement because existing on-premises policies cannot address provider-managed layers, leaving accountability gaps that undermine governance.

Why this answer

In a hybrid cloud model, governance must be updated to reflect the shared responsibility model, where the cloud provider secures the cloud infrastructure while the enterprise remains accountable for data, identities, and configurations in the cloud. Developing policies that explicitly address shared responsibility and cloud-specific governance controls (e.g., CASB, CSPM, contract SLAs) ensures oversight is maintained across both on-premises and cloud environments. This aligns with CGEIT's focus on aligning IT governance with enterprise strategy and risk.

Exam trap

CGEIT often tests the misconception that moving to the cloud transfers security and governance responsibility to the provider, when in fact the enterprise always retains accountability for its data and compliance.

How to eliminate wrong answers

Option B is wrong because centralizing all infrastructure back on-premises contradicts the hybrid cloud transition and eliminates the agility and cost benefits that drove the strategy, while also failing to address governance in the cloud. Option C is wrong because shifting all security responsibility to the cloud provider misinterprets the shared responsibility model—the provider never assumes responsibility for customer data, access management, or regulatory compliance. Option D is wrong because eliminating internal IT policies removes the enterprise's ability to enforce oversight, compliance, and risk management, which is the core purpose of governance regardless of hosting model.

Practice this question →
89
MCQmedium

The IT steering committee is evaluating a high-cost digital transformation project. What should the committee prioritize to ensure strategic alignment?

A.The potential for technical debt reduction.
B.The specific vendor selection process used for the software purchase.
C.The business value proposition and contribution to organizational goals.
D.Detailed technical architectural specifications.
AnswerC

Business value and contribution to organisational goals are the criteria that tie investment decisions to enterprise strategy. For a high-cost transformation, the committee must judge the business case against strategic objectives, not technical elegance or cost alone, ensuring the spend advances the organisation's stated direction.

Why this answer

For a high-cost digital transformation, the IT steering committee's primary governance responsibility is to ensure strategic alignment — that the investment delivers business value and advances organizational goals. Prioritizing the business value proposition and contribution to goals is the essence of strategic alignment.

Exam trap

CGEIT often tests whether candidates keep the steering committee focused on strategic value and business alignment rather than technical or procurement details, tempting them to select architecture or vendor options.

How to eliminate wrong answers

Option A is wrong because technical debt reduction, while valuable, is a technical/operational consideration and not the primary strategic alignment criterion for a steering committee evaluating a major investment. Option B is wrong because the vendor selection process is a procurement/execution detail, not a strategic alignment concern — the committee should focus on value, not sourcing mechanics. Option D is wrong because detailed technical architectural specifications are the domain of architects and engineering teams; the steering committee should evaluate strategic fit and business value, not technical design specifics.

Practice this question →
90
MCQeasy

Which stakeholder is ultimately accountable for the governance of IT in an enterprise?

A.The IT Steering Committee
B.The Internal Audit department
C.The Chief Information Officer (CIO)
D.The Board of Directors
AnswerD

The Board of Directors holds ultimate accountability for enterprise governance of IT, setting direction and overseeing value delivery. This satisfies the stem's accountability constraint because boards own governance outright, whereas executives and IT managers only execute delegated responsibilities.

Why this answer

Ultimate accountability for IT governance rests with the Board of Directors (D). In governance frameworks such as COBIT and ISO/IEC 38500, the board is responsible for setting direction, ensuring IT delivers value, optimizing risk, and optimizing resources. While IT steering committees, the CIO, and audit provide oversight and execution, the board holds the ultimate fiduciary accountability to stakeholders for how IT is governed.

Exam trap

CGEIT often tests the difference between responsibility (CIO, steering committee) and ultimate accountability (board), so candidates pick the CIO or steering committee because they are the most visible IT governance actors.

How to eliminate wrong answers

Option A is wrong because the IT Steering Committee is a management-level body that prioritizes and oversees IT initiatives; it operates under delegated authority and is accountable to the board, not ultimately accountable for governance. Option B is wrong because Internal Audit provides independent assurance on controls and governance effectiveness; it evaluates and reports but does not own or hold ultimate accountability for IT governance. Option C is wrong because the CIO is the senior executive responsible for IT strategy and delivery, but accountability for governance ultimately sits above the CIO at the board level — the CIO implements and reports, the board governs.

Practice this question →
91
MCQeasy

What is the primary objective of 'IT resource management' as part of IT governance?

A.To ensure IT staff are working 40 hours per week
B.To eliminate the need for IT staff through automation
C.To buy the cheapest available technology
D.To optimize the allocation and use of IT resources to support the business
AnswerD

IT resource management optimises how IT assets, people and budgets are allocated and used, ensuring they align with and support business objectives. This allocation-and-use focus is the mechanism the stem requires, distinguishing it from risk or performance management within IT governance.

Why this answer

IT resource management within IT governance exists to ensure that IT assets — people, infrastructure, applications, and budgets — are allocated and used in a way that maximizes business value and aligns with strategic objectives. It is about optimization and alignment, not cost minimization or headcount reduction. The primary objective is therefore to optimize allocation and use of IT resources to support the business.

Exam trap

The trap is equating 'resource management' with cost-cutting or staff reduction — the exam tests whether you understand governance objectives are about value and alignment, not mere expense minimization.

How to eliminate wrong answers

Option A is wrong because enforcing a 40-hour work week is a labor/HR concern, not the objective of IT resource management. Option B is wrong because eliminating IT staff through automation is a possible outcome in some areas but is not the governance objective, which is value optimization, not headcount reduction. Option C is wrong because buying the cheapest technology prioritizes cost over value and can increase risk and total cost of ownership, contradicting the goal of optimized resource use.

Practice this question →
92
MCQeasy

Which document is essential for formalizing the relationship and expectations between IT and the business units?

A.Governance Policy Statement.
B.Project Charter.
C.IT Strategic Plan.
D.Service Level Agreement (SLA).
AnswerD

An SLA formalises IT-to-business expectations by defining measurable service targets, responsibilities and escalation paths for specific services. It satisfies the stem's requirement to document the relationship between IT and business units, translating business needs into agreed, reviewable performance commitments rather than informal arrangements.

Why this answer

A Service Level Agreement (SLA) is the formal document that defines the services IT will deliver, the expected performance levels, responsibilities of both parties, and remedies for non-performance. It is the primary instrument for codifying the relationship and mutual expectations between IT and business units. While other documents set direction or authorize work, the SLA operationalizes the IT-business relationship.

Exam trap

The trap here is confusing strategic or project-level documents (IT Strategic Plan, Project Charter) with the operational instrument that actually formalizes ongoing IT-business expectations — the SLA.

How to eliminate wrong answers

Option A is wrong because a Governance Policy Statement establishes principles, decision rights, and accountability at the enterprise level — it does not define specific service expectations between IT and business units. Option B is wrong because a Project Charter authorizes a specific project, defines its scope and sponsor, and is temporary; it does not formalize ongoing IT-business service relationships. Option C is wrong because the IT Strategic Plan sets long-term direction and investment priorities, not the operational service expectations and performance commitments that govern day-to-day IT-business interaction.

Practice this question →
93
MCQhard

An organization is merging with another company. How should the governance structures be reconciled?

A.Adopt the framework of the company with more employees.
B.Keep both frameworks as they are.
C.Abandon both frameworks and start from scratch.
D.Conduct a gap analysis and develop a unified governance framework.
AnswerD

A gap analysis exposes differences in decision rights, committees and processes between the merging entities, then a unified framework reconciles them. This satisfies the merger scenario by producing one coherent governance structure rather than duplicated or conflicting oversight.

Why this answer

When merging organizations, governance structures should be reconciled through a gap analysis that identifies differences, overlaps, and best practices, followed by development of a unified framework. This ensures the merged entity has a coherent governance model aligned with its new strategy, risk profile, and regulatory obligations. Simply adopting one side's framework or keeping both creates inconsistency and accountability gaps.

Exam trap

CGEIT often tests the principle of structured reconciliation, tempting candidates to choose simple or expedient options (adopt larger company's framework, keep both) that ignore the need for gap analysis and unified design.

How to eliminate wrong answers

Option A is wrong because adopting the framework of the company with more employees ignores fit, risk profile, and regulatory context — size alone is not a valid criterion for governance design. Option B is wrong because keeping both frameworks as they are creates conflicting policies, duplicated oversight, and unclear accountability across the merged entity. Option C is wrong because abandoning both frameworks and starting from scratch discards institutional knowledge and proven practices, increasing risk and cost during an already disruptive transition.

Practice this question →
94
Multi-Selectmedium

Which TWO stakeholders are essential for successful IT governance?

Select 2 answers
A.Local IT repair technicians
B.Delivery drivers
C.Executive Management
D.Board of Directors
E.External janitorial staff
AnswersC, D

Executive management translates board direction into funded, resourced IT initiatives and owns operational accountability for risk and performance. Without their sponsorship, governance decisions lack enforcement authority, so they are essential alongside the board in the stem's governance model.

Why this answer

Executive Management (C) is essential because IT governance requires top leadership to set strategic direction, approve IT policies, allocate budgets, and ensure IT investments align with business objectives and risk appetite. The Board of Directors (D) is also essential because it provides ultimate oversight and accountability, ensuring that IT governance frameworks, risk management, and compliance obligations are met at the highest organizational level. Together, these two stakeholders supply the authority, strategic alignment, and oversight that define successful IT governance.

Local IT repair technicians (A) perform operational support tasks rather than governance-level decision-making, delivery drivers (B) are unrelated to IT governance, and external janitorial staff (E) have no governance role, so none of these belong.

Exam trap

CGEIT often tests the misconception that IT governance is a technical or operational concern, when the exam expects recognition that Board of Directors and Executive Management are the essential strategic stakeholders.

Practice this question →
95
Multi-Selectmedium

A healthcare organization is establishing an IT governance framework to improve alignment between IT and business strategy. The governance body must define key roles and responsibilities. Which TWO of the following are essential governance mechanisms to ensure effective IT decision-making? (Choose two.)

Select 2 answers
A.Defining a formal IT decision-making process with clear escalation paths.
B.Implementing a chargeback model to allocate IT costs to business units.
C.Outsourcing all IT operations to a third-party provider to reduce internal complexity.
D.Establishing an IT steering committee with representation from business and IT leadership.
E.Adopting a technology-first approach where IT determines business requirements.
AnswersA, D

A formal decision-making process with escalation paths ensures that IT decisions are made consistently, transparently, and at the appropriate level. It prevents bottlenecks and ensures that strategic decisions are escalated to the governance body, enabling effective oversight and accountability.

Why this answer

The essential governance mechanisms are establishing an IT steering committee with business and IT leadership and defining a formal IT decision-making process with clear escalation paths. These mechanisms ensure that IT decisions are made collaboratively, aligned with business objectives, and escalated appropriately. They provide the structure for accountability and strategic alignment, which are core to effective IT governance.

Exam trap

The trap here is confusing operational or financial tools like outsourcing or chargeback models with governance mechanisms that define decision rights and accountability.

Practice this question →
96
MCQeasy

A retail company's IT governance committee is reviewing the performance of its IT investments. The committee wants to ensure that IT is delivering value in line with business expectations. Which of the following is the MOST effective way to demonstrate IT value delivery?

A.Counting the number of IT service incidents reported by users.
B.Measuring the achievement of business case benefits defined for each IT investment.
C.Monitoring the IT budget variance compared to the annual plan.
D.Tracking the number of IT projects completed on time and within budget.
AnswerB

This is the most effective way because it directly assesses whether IT investments are delivering the intended business outcomes, such as increased revenue, cost savings, or improved customer satisfaction. It ties IT performance to business value, which is the core of value delivery governance.

Why this answer

The most effective way to demonstrate IT value delivery is to measure the achievement of business case benefits defined for each IT investment. This approach directly links IT spending to business outcomes, ensuring that IT is not just efficient but also effective in delivering strategic value. It aligns with governance principles that emphasize value creation as a key objective.

Exam trap

The trap here is equating project management success (on-time, on-budget) or cost control with value delivery, when true value is measured by business benefit realization.

Practice this question →
97
MCQeasy

What is the primary purpose of an IT governance framework?

A.To automate IT operations.
B.To ensure 100% system uptime.
C.To provide a structured approach for achieving IT value and managing risk.
D.To minimize IT costs at all times.
AnswerC

A governance framework supplies the decision rights, structures and processes that direct IT investment towards value delivery while embedding risk management. This directly satisfies the stem's requirement for a structured approach, since it coordinates accountability across the enterprise rather than merely documenting controls or measuring performance.

Why this answer

An IT governance framework provides a structured approach for aligning IT with business objectives, delivering value, and managing risk through defined processes, roles, and decision rights. It is not about automation, uptime guarantees, or cost minimization in isolation, but about ensuring IT enables and protects enterprise goals. This is the core definition reflected in frameworks like COBIT and ISO/IEC 38500.

Exam trap

CGEIT often tests the distinction between governance (value and risk alignment) and management (operations, cost, uptime), tempting candidates to choose operational or cost-focused answers that sound practical but miss the governance purpose.

How to eliminate wrong answers

Option A is wrong because automating IT operations is a management objective enabled by tools and processes, not the primary purpose of a governance framework. Option B is wrong because 100% system uptime is an unrealistic operational target and not the goal of governance, which focuses on value and risk rather than absolute availability. Option D is wrong because minimizing IT costs at all times ignores value delivery and risk trade-offs; governance balances cost, risk, and value rather than optimizing a single dimension.

Practice this question →
98
MCQhard

A multinational corporation is struggling with IT strategic alignment. The board wants to ensure IT investments directly correlate to business value. Which metric should the governance committee prioritize?

A.Percentage of IT initiatives that directly contribute to documented business strategy goals.
B.Total cost of ownership (TCO) of IT assets.
C.System uptime and availability percentages.
D.IT project delivery on time and within budget.
AnswerA

Percentage of IT initiatives directly contributing to documented business strategy goals measures strategic alignment itself, evidencing that investment correlates with business value. Financial or operational metrics alone cannot demonstrate that linkage, which is the board's stated concern.

Why this answer

The board's concern is strategic alignment — ensuring IT investments directly correlate to business value. The metric that most directly measures this is the percentage of IT initiatives that contribute to documented business strategy goals. This metric ties IT portfolio composition to strategic intent, which is the essence of alignment.

Other metrics measure efficiency or operational performance but not alignment itself.

Exam trap

CGEIT often tests the distinction between strategic alignment metrics and operational efficiency metrics (TCO, uptime, on-time delivery), tempting candidates to pick a familiar operational KPI.

How to eliminate wrong answers

Option B is wrong because TCO measures the cost of owning IT assets, which addresses cost efficiency, not whether investments align with business strategy; a low TCO portfolio can still be strategically misaligned. Option C is wrong because uptime and availability measure operational reliability, which is a service delivery concern, not strategic alignment; systems can be highly available yet support no strategic objective. Option D is wrong because on-time and on-budget delivery measures project execution efficiency, not strategic value; a project can be delivered perfectly and still contribute nothing to business strategy.

Practice this question →
99
MCQeasy

Which document outlines the authority and responsibilities of the IT governance committee?

A.The committee charter.
B.The annual financial report.
C.The IT project plan.
D.The employee handbook.
AnswerA

The charter formally establishes the committee and defines its mandate, authority limits and reporting responsibilities. This satisfies the stem because governance bodies derive their legitimacy and decision rights from this document, not from meeting minutes or terms of reference held elsewhere.

Why this answer

The committee charter is the formal document that establishes the IT governance committee, defines its purpose, and explicitly outlines its authority, responsibilities, and scope of decision-making. It serves as the foundational governance instrument that empowers the committee to act on behalf of the board or executive management. Without a charter, the committee lacks formal standing and its mandate may be unclear or contested.

Exam trap

CGEIT often tests the distinction between governance artifacts and operational documents; candidates may incorrectly select the IT project plan or employee handbook because they confuse committee responsibilities with project management or HR policies.

How to eliminate wrong answers

Option B is wrong because the annual financial report is a statutory financial disclosure document that summarizes an organization's financial performance and position; it does not define governance committee authority or responsibilities. Option C is wrong because the IT project plan is a tactical document that details project scope, schedule, resources, and deliverables for a specific initiative; it does not establish governance committee mandates. Option D is wrong because the employee handbook communicates general employment policies, workplace rules, and employee expectations; it does not address the authority or responsibilities of an IT governance committee.

Practice this question →
100
MCQhard

An organization has decentralized its IT operations, leading to fragmented governance. Which action will best restore governance oversight while retaining operational agility?

A.Mandate that all business units use the same IT software stack
B.Standardize all IT purchasing processes across the enterprise
C.Implement a federated governance structure with central policy oversight
D.Centralize all IT functions and reporting lines under the CIO
AnswerC

A federated governance structure pairs centralised policy definition with delegated execution, letting business units retain day-to-day operational agility while Microsoft Entra ID-style central oversight enforces consistent standards. This directly resolves the stem's fragmented governance constraint: authority for policy stays central, yet decision-making rights remain distributed, restoring enterprise-wide oversight without recentralising IT operations.

Why this answer

A federated governance structure keeps central authority over policy, standards, and risk appetite while delegating day-to-day operational decisions to business units, which restores enterprise-wide oversight without sacrificing the agility that decentralization was meant to provide. This is the classic CGEIT answer for balancing control and responsiveness in a decentralized organization.

Exam trap

CGEIT often tests the false dichotomy that restoring governance requires centralization — candidates pick the CIO-centralization option, missing that federated governance preserves agility while restoring oversight.

How to eliminate wrong answers

Option A is wrong because mandating a single software stack is a standardization tactic that reduces flexibility and may not fit diverse business needs; it addresses technology uniformity, not governance oversight. Option B is wrong because standardizing purchasing processes is a procurement control that improves efficiency but does not establish governance of IT strategy, risk, or value delivery across the enterprise. Option D is wrong because fully centralizing IT under the CIO reverses the decentralization entirely, destroying the operational agility the organization wants to retain and often creating bottlenecks and business-unit resistance.

Practice this question →
101
Multi-Selectmedium

An energy utility's board is reviewing whether its IT governance framework remains effective after a major merger doubled the size of the organization. Which TWO actions should the governance committee take to reassess the framework's effectiveness? (Choose two.)

Select 2 answers
A.Suspend governance activities until the post-merger integration is fully complete to avoid conflicting decisions.
B.Delegate all governance reassessment to the external auditor and implement its recommendations without internal review.
C.Re-evaluate whether the existing decision rights, committee structures, and escalation paths still match the merged organization's size and complexity.
D.Confirm that the framework still aligns with the enterprise's updated strategic objectives and regulatory obligations following the merger.
E.Replace the entire governance framework with a generic industry-standard template to simplify the transition.
AnswersC, D

A merger changes organizational scale, reporting lines, and risk profile, so the original governance design may no longer fit. Re-evaluating decision rights, committee structures, and escalation paths ensures the framework remains proportionate and workable. This is a foundational effectiveness check because even well-designed governance can fail when the enterprise it governs has materially changed in size or complexity.

Why this answer

A merger materially changes scale, strategy, and regulatory exposure, so effectiveness must be reassessed in two directions: whether the governance design still fits the new organizational structure, and whether it still aligns with updated strategic objectives and compliance obligations. Together, these checks confirm the framework remains relevant and workable rather than merely existing on paper.

Exam trap

The trap here is assuming a merger only requires operational integration, when it also demands a deliberate reassessment of governance design and strategic alignment.

Practice this question →
102
Multi-Selecthard

Which THREE of the following are essential elements of an IT risk governance policy?

Select 3 answers
A.Procedures for reporting and escalating risks
B.The physical location of all backup tapes
C.Defined enterprise risk appetite and tolerance levels
D.A list of all software vendors currently in use
E.Clear roles and responsibilities for risk ownership
AnswersA, C, E

Reporting and escalation procedures satisfy the policy's requirement for defined accountability channels, ensuring identified risks reach the appropriate decision-makers with authority to act. Without explicit escalation paths, risk governance collapses into undocumented local handling, so this element is essential for the policy to function.

Why this answer

Option A is correct because an IT risk governance policy must define how risks are reported and escalated through the organization, ensuring timely visibility to appropriate management levels and enabling consistent response. Option C is correct because the policy must establish the enterprise's risk appetite and tolerance levels, which set the boundaries for acceptable risk and guide decision-making on risk treatment. Option E is correct because clear roles and responsibilities for risk ownership are essential to assign accountability for identifying, assessing, and managing risks across the organization.

Option B is not correct because the physical location of backup tapes is an operational or asset-management detail, not a governance policy element. Option D is not correct because a list of software vendors is an inventory artifact rather than a governance principle.

Exam trap

CGEIT often tests whether candidates can distinguish governance-policy elements (appetite, ownership, escalation) from operational artefacts (tape locations, vendor lists) that are sometimes mistakenly included in policy documents.

Practice this question →
103
Multi-Selecteasy

Which TWO are common IT governance structures?

Select 2 answers
A.Architecture Review Board
B.Coffee and Donut Club
C.Software testing team
D.Help desk support
E.IT Steering Committee
AnswersA, E

An Architecture Review Board provides cross-functional oversight of technology decisions, ensuring solutions align with enterprise architecture principles and strategic objectives. It satisfies the governance requirement for structured decision-making authority, distinct from operational management bodies. This formal review mechanism enforces standards and accountability across projects, which is characteristic of IT governance structures rather than day-to-day delivery functions.

Why this answer

An Architecture Review Board (A) is a recognized IT governance structure because it provides formal oversight and decision-making authority over architecture standards, technology choices, and design compliance across projects. An IT Steering Committee (E) is also a standard governance body, typically composed of senior business and IT leaders who prioritize IT investments, align IT strategy with business goals, and approve major initiatives. The Coffee and Donut Club (B) is a social group with no governance authority, decision rights, or accountability for IT outcomes.

A Software testing team (C) is an operational delivery function focused on quality assurance, not on setting or enforcing governance policy. Help desk support (D) is a service management/operations function that resolves user incidents, not a governance structure that directs IT strategy or standards.

Exam trap

CGEIT often tests the distinction between governance structures (decision-making bodies) and operational teams (testing, help desk), causing candidates to select functional teams as governance structures.

Practice this question →
104
MCQhard

A firm is experiencing 'governance drift' where IT initiatives are no longer aligned with corporate strategy. Which action should the governance committee take first?

A.Perform a review of business strategy and IT design factors.
B.Replace the existing CIO.
C.Conduct an audit of all current IT projects.
D.Increase the IT budget to support more initiatives.
AnswerA

Governance drift stems from misalignment between business strategy and IT design factors, so the committee must first review both to re-establish the linkage. Only after understanding current strategic priorities and how IT is designed to support them can realignment actions, such as revised decision rights or investment criteria, be correctly targeted.

Why this answer

Governance drift means the linkage between IT initiatives and corporate strategy has weakened, so the first step is to re-examine the business strategy and the IT design factors that should drive IT direction. This re-establishes the 'Evaluate' and 'Direct' inputs the governance committee needs before any corrective action. Auditing projects or changing leadership without first re-validating strategy would treat symptoms rather than the root cause.

Exam trap

CGEIT often tests the instinct to jump to audits or personnel changes — the exam rewards re-validating strategy and design factors before taking corrective action.

How to eliminate wrong answers

Option B is wrong because replacing the CIO is a personnel action that does not address the underlying misalignment between strategy and IT direction; it is a reactive, blame-oriented response. Option C is wrong because auditing all current IT projects examines execution compliance, not whether the projects still map to current business strategy — an audit may confirm projects are well-run but strategically irrelevant. Option D is wrong because increasing the IT budget amplifies misaligned spending rather than correcting the alignment gap; more money without strategic re-anchoring worsens drift.

Practice this question →
105
Multi-Selecthard

Which THREE types of risks should IT governance oversee?

Select 3 answers
A.Operational risks
B.Risk of office plant death
C.Risk of printer paper jam
D.Compliance risks
E.Strategic risks
AnswersA, D, E

Operational risks cover the day-to-day delivery of IT services, so governance must oversee them to protect service continuity and efficiency. This satisfies the stem's requirement for a distinct risk category spanning the three governance domains of operational, compliance and strategic risk.

Why this answer

IT governance should oversee operational risks (A) because they cover failures in day-to-day IT services, processes, and infrastructure that can disrupt business continuity, and governance ensures controls, SLAs, and incident management are in place. Compliance risks (D) must be governed because IT must satisfy legal, regulatory, and contractual requirements such as GDPR, HIPAA, SOX, or PCI DSS, and governance ensures policies, audits, and evidence of adherence exist. Strategic risks (E) belong under governance because IT investments, architecture, and digital transformation decisions must align with business objectives and be managed against risks that could prevent achieving those goals.

The unmarked options do not belong: office plant death (B) is a trivial facilities matter, and a printer paper jam (C) is a routine operational incident handled by end-user support, not a governance-level risk category.

Exam trap

CGEIT often tests whether candidates can distinguish governance-level risk categories from trivial operational incidents — the trap is picking a low-level IT or facilities nuisance as if it were a governance risk.

Practice this question →
106
MCQmedium

A large multinational corporation is transitioning to COBIT 2019. The governance board needs to prioritize governance objectives. Which action should the IT governance lead take first?

A.Conduct a design factors assessment.
B.Implement the IT Balanced Scorecard.
C.Adopt all 40 governance objectives immediately.
D.Draft new board-level IT policies.
AnswerA

Design factors capture the enterprise's context, goals, risk profile and technology landscape, and COBIT 2019 uses them to determine which governance and management objectives matter most. Assessing them first gives the board an evidence-based priority ranking rather than an arbitrary selection.

Why this answer

COBIT 2019 requires the governance system to be tailored to the enterprise's context, and that tailoring begins with a design factors assessment. Design factors (enterprise strategy, goals, risk profile, IT-related issues, threat landscape, compliance requirements, role of IT, sourcing model, IT adoption strategy, enterprise size, and technology adoption) determine which of the 40 governance and management objectives are relevant and how they should be prioritized. Only after this assessment can the governance board meaningfully prioritize objectives.

Exam trap

CGEIT often tests the misconception that COBIT 2019 should be adopted wholesale, when the framework explicitly requires tailoring through design factors before any objective prioritization.

How to eliminate wrong answers

Option B is wrong because the IT Balanced Scorecard is a performance measurement mechanism used after governance objectives and metrics are selected; implementing it first puts measurement before design. Option C is wrong because adopting all 40 governance objectives immediately ignores the tailoring principle of COBIT 2019 and creates an unmanageable scope that does not reflect the enterprise's specific design factors. Option D is wrong because drafting board-level IT policies is a downstream activity that should flow from the prioritized objectives and target capability levels identified through the design factors assessment.

Practice this question →
107
MCQhard

A company is struggling with shadow IT. Which governance strategy is most effective?

A.Identify the cause of shadow IT and provide sanctioned, secure alternatives.
B.Block all unauthorized websites and applications.
C.Increase the budget for the IT department.
D.Fire any employee caught using non-sanctioned tools.
AnswerA

Addressing shadow IT's root cause and supplying sanctioned, secure alternatives removes the incentive driving unsanctioned usage. This satisfies the stem's requirement for the most effective strategy, since blocking alone leaves the underlying business need unmet and shadow IT persists.

Why this answer

Shadow IT exists because business units adopt unsanctioned tools to solve real problems faster than IT can deliver approved alternatives. The most effective governance strategy is to diagnose the root cause—whether it's slow procurement, missing functionality, or poor user experience—and then provide sanctioned, secure alternatives that meet the business need. This addresses the underlying driver rather than just the symptom, reducing the incentive to bypass IT governance.

Exam trap

CGEIT often tests the misconception that shadow IT is best solved with technical blocking or punitive measures—candidates must recognize that governance effectiveness comes from addressing root causes and providing viable, sanctioned alternatives.

How to eliminate wrong answers

Option B is wrong because blocking unauthorized websites and applications is a purely technical, reactive control that drives shadow IT further underground (e.g., personal devices, mobile hotspots) and does not address why users sought the tools in the first place. Option C is wrong because increasing the IT budget does not automatically resolve shadow IT—without governance alignment and faster delivery of sanctioned services, more budget may simply be spent on tools users still won't adopt. Option D is wrong because firing employees is a punitive, disproportionate response that destroys trust, damages morale, and fails to address the systemic governance gaps that enabled shadow IT to flourish.

Practice this question →
← PreviousPage 2 of 2 · 107 questions total

Ready to test yourself?

Try a timed practice session using only Governance OF Enterprise IT questions.

Start 20-question session