Knowledge + Practice

← Back to ISACA Certified in the Governance of Enterprise IT (CGEIT) (CGEIT) questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise ISACA Certified in the Governance of Enterprise IT (CGEIT) (CGEIT) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

20

scenario questions

CGEIT

exam code

ISACA

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related CGEIT topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Benefits Realization practice questions

Benefits Realization practice questions for CGEIT.

Risk Optimization practice questions

Sharpen your CGEIT knowledge of Risk Optimization.

IT Resources practice questions

Targeted CGEIT practice covering IT Resources.

Governance OF Enterprise IT practice questions

Governance OF Enterprise IT practice questions for CGEIT.

CGEIT fundamentals practice questions

Sharpen your CGEIT knowledge of CGEIT fundamentals.

CGEIT scenario practice questions

Sharpen your CGEIT knowledge of CGEIT scenario.

CGEIT troubleshooting practice questions

Practise CGEIT questions linked to CGEIT troubleshooting.

Practice set

Practice scenarios

Question 1mediummulti select

Full question →

A healthcare provider is evaluating its IT resource sourcing strategy. The CIO wants to ensure that the strategy supports both cost efficiency and compliance with patient data regulations. Which TWO of the following governance actions are MOST important to include in the sourcing strategy? (Choose two.)

A
Establish a regular review process to monitor vendor performance against both cost and compliance metrics.
Ongoing monitoring ensures that vendors continue to meet cost efficiency and compliance expectations after the contract is signed. Regulations and business needs evolve, so periodic reviews allow the provider to detect issues early and take corrective action, sustaining both objectives.
B
Outsource all IT functions to a single vendor to achieve economies of scale.
Why it fails: Single-vendor outsourcing may reduce costs but concentrates risk and may not suit all functions, especially those handling sensitive patient data. It does not inherently ensure compliance and could create lock-in. A balanced sourcing strategy is needed, not blanket outsourcing.
C
Define clear criteria for evaluating vendor compliance with healthcare data protection regulations before contracting.
Vendor compliance evaluation is critical because patient data regulations impose strict requirements on data handling. Without pre-contract assessment, the provider risks non-compliance and penalties. This action ensures that only vendors meeting regulatory standards are selected, directly supporting the compliance objective.
D
Delegate all sourcing decisions to the procurement department to expedite contracting.
Why it fails: Delegating solely to procurement may neglect IT governance and compliance considerations. Procurement typically focuses on cost and terms, not on technical or regulatory compliance. This could lead to contracts that fail to protect patient data or align with IT strategy, undermining both objectives.
E
Require all vendors to use the same technology stack as the healthcare provider to simplify integration.
Why it fails: Mandating a specific technology stack can limit vendor options, increase costs, and may not be feasible for specialized services. It does not directly address compliance with patient data regulations or cost efficiency, and could even reduce competition, leading to higher prices.

Full breakdown with real-world context →

Question 2hardmulti select

Full question →

Which TWO of the following factors should influence the frequency of risk reporting to the board?

A
The size of the IT office building.
Why it fails: Physical office size has no bearing on how often the board needs risk information; reporting frequency should track risk profile, appetite thresholds and change velocity. It is tempting because facility factors do appear in some operational risk assessments, but they inform risk content, not board reporting cadence.
B
The current risk posture and volatility of the environment.
Reporting cadence should track how rapidly exposure shifts. A deteriorating or highly volatile risk posture warrants more frequent board updates, because stale information could mislead oversight; a stable, low-volatility environment justifies longer intervals between reports.
C
The number of years the board members have served.
Why it fails: Board tenure does not determine how frequently risk information must reach the board; cadence should follow risk materiality, appetite breaches and the rate of change in the risk landscape. It is tempting because tenure affects board dynamics and familiarity, yet it does not alter the underlying need for timely risk visibility.
D
The color of the risk report cover page.
Why it fails: Cover page colour is presentational and has no relationship to the timeliness of risk information reaching the board; frequency should reflect risk severity, appetite thresholds and emerging exposures. It is tempting because report design does affect readability, but formatting choices never determine reporting cadence.
E
The significance of the risks to business objectives.
Frequency should reflect materiality: risks capable of materially affecting strategic objectives demand more frequent board attention, while peripheral risks need not consume the same reporting cycle. Significance to business objectives directly determines how often escalation is warranted.

Full breakdown with real-world context →

Question 3hardmulti select

Full question →

Which THREE activities are required when managing the 'Benefits Lifecycle'?

A
Reducing the number of project stakeholders.
Why it fails: Reducing stakeholders is an organisational change with no bearing on identifying, tracking or realising benefits; the lifecycle requires engaging stakeholders to define and measure value. It is tempting because stakeholder management is a governance concern, and it would be relevant if the question asked how to simplify project governance structures.
B
Tracking the realization of benefits after implementation.
Tracking benefits after implementation satisfies the realisation phase of the benefits lifecycle, verifying that forecast outcomes actually materialise and enabling corrective action. This ongoing measurement distinguishes benefits management from mere business case approval, ensuring value delivery is evidenced rather than assumed throughout the investment's operational life.
C
Ensuring project deliverables align with business requirements.
Aligning deliverables with business requirements directly satisfies the benefits realisation constraint, ensuring outputs translate into intended outcomes rather than mere technical completion. Within the Benefits Lifecycle, this alignment underpins the transition from project delivery to value measurement, confirming that each deliverable contributes measurably to the business case before benefits tracking begins.
D
Updating the project's source code documentation.
Why it fails: Source code documentation is a software engineering deliverable, not a benefits management activity; the benefits lifecycle covers identifying, analysing, planning, realising and reviewing benefits. It is tempting because documentation supports governance, and it would fit if the question concerned configuration or change management rather than benefits realisation.
E
Identifying and quantifying potential benefits.
Identifying and quantifying potential benefits is the foundational activity of the Benefits Lifecycle, establishing the baseline against which realisation is later measured. Without this upfront quantification, subsequent monitoring and reporting lack a reference point, so it directly satisfies the stem's requirement for managing benefits from initiation through to delivery.

Full breakdown with real-world context →

Question 4mediummulti select

Full question →

Which TWO factors are essential for a successful benefits realization culture?

A
A focus on learning from both successes and failures.
Treating both successes and failures as learning inputs lets the organisation refine benefit forecasts and interventions rather than repeating errors. This adaptive feedback loop is essential to a benefits realisation culture, which depends on continuous improvement rather than blame.
B
Requiring all employees to learn programming.
Why it fails: Benefits realisation culture requires staff to understand and pursue value delivery, not programming skills; mandating coding for all employees addresses no governance or benefit-tracking requirement. It is tempting because technical literacy can support digital initiatives, so it is correct when a specific role's capability gap, not enterprise-wide culture, is the barrier.
C
Clear accountability for benefit achievement.
Clear accountability ensures named individuals own each benefit outcome, satisfying the stem's requirement for a benefits realisation culture. Without assigned ownership, benefits tracking becomes diffuse and unenforceable, so accountability directly enables the governance discipline that sustains realisation across the investment lifecycle.
D
Frequent updates to the technical architecture.
Why it fails: Benefits realisation depends on governance behaviours such as clear ownership, benefit tracking and accountability; refreshing technical architecture does not build that culture. It is tempting because modern architecture can enable benefit measurement, so it is correct when the organisation's problem is outdated platforms blocking delivery of expected outcomes, not cultural adoption.
E
Reducing the number of board meetings.
Why it fails: Fewer board meetings weakens the oversight and sponsorship that benefits realisation culture depends on; governance cadence must remain sufficient to review benefit delivery. It is tempting because reducing meeting overhead can improve efficiency, so it is correct when the board's agenda is genuinely bloated and duplicative, not when benefit oversight is the goal.

Full breakdown with real-world context →

Question 5mediummulti select

Full question →

A manufacturing firm's CIO is establishing benefits ownership for a portfolio of IT-enabled change programs. The steering committee wants to ensure each benefit has clear accountability so that realization can be tracked and intervened upon. Which TWO of the following are essential components of effective benefits ownership? (Choose two.)

A
Assignment of benefit tracking to the project management office for the duration of the program.
Why it fails: The PMO can support tracking, but assigning ownership there confuses monitoring with accountability. The PMO typically lacks authority over business processes and often disengages after project closure, exactly when benefits begin to accrue. Benefits therefore risk becoming unowned once delivery ends, which is the classic failure mode of benefits realization in IT portfolios.
B
A named business owner who is accountable for the outcome and has authority over the processes that generate the benefit.
A benefit can only be realized where the change actually occurs, so the accountable owner must sit in the business function that controls the affected process. Without that authority, the owner cannot enforce adoption, adjust operations, or remove obstacles. Naming a business owner with real process control converts a benefit from an aspiration into a managed outcome with a single point of accountability.
C
A commitment from the CIO to report benefit status directly to the board each quarter.
Why it fails: Executive reporting is valuable but is not a component of ownership. It describes an escalation and visibility mechanism, not who is accountable for producing the benefit or how it is measured. Relying on CIO-level reporting without a business owner and defined measures leaves the actual realization unmanaged, and the board receives status updates that no one in the business is accountable for delivering.
D
A defined measurement method, baseline, and target for each benefit that the owner is expected to deliver.
Accountability is meaningless without an agreed measure. A defined metric, a documented baseline captured before change, and a target value let the owner and the committee judge whether the benefit is being delivered and when intervention is needed. This measurement contract also protects against disputes about whether savings or improvements are real or merely accounting shifts.
E
A benefits register maintained exclusively by the finance department to ensure consistency of valuation.
Why it fails: Finance may validate valuation, but exclusive custody by finance disconnects the register from the operational drivers and owners who must act on it. Benefits realization is a business management activity, not a purely financial reporting one. Centralizing it in finance tends to produce periodic accounting snapshots rather than the continuous, owner-driven tracking needed to intervene before value is lost.

Full breakdown with real-world context →

Question 6mediummulti select

Full question →

Which TWO stakeholders are essential for successful IT governance?

A
Local IT repair technicians
Why it fails: Repair technicians execute hardware fixes, holding no mandate to set risk appetite, direct strategy or account for value delivery, so they cannot fulfil governance's decision-making role. They are tempting because operational staff do supply the asset and incident data that governance bodies consume, and in very small firms a technician may informally double as the IT manager.
B
Delivery drivers
Why it fails: Delivery drivers hold no accountability for IT direction, resource decisions or value delivery, so they cannot fulfil the governance stakeholder role the stem requires. It is tempting because drivers are genuine operational stakeholders affected by logistics systems, and would be relevant to an operational service question rather than IT governance.
C
Executive Management
Executive management translates board direction into funded, resourced IT initiatives and owns operational accountability for risk and performance. Without their sponsorship, governance decisions lack enforcement authority, so they are essential alongside the board in the stem's governance model.
D
Board of Directors
The board holds ultimate accountability for IT governance outcomes, setting risk appetite and ensuring technology investment aligns with enterprise strategy. Its oversight authority is what legitimises governance decisions, making it essential rather than merely influential in the stem's governance structure.
E
External janitorial staff
Why it fails: External janitorial staff hold no decision rights or accountability over IT investments and outcomes, so they cannot be essential IT governance stakeholders. It is tempting because they are legitimate external parties interacting with facilities, and would be relevant to a physical security or facilities question rather than IT governance.

Full breakdown with real-world context →

Question 7easymulti select

Full question →

To effectively integrate risk management into enterprise governance, which THREE activities should be conducted?

A
Defining the enterprise risk appetite in quantitative or qualitative terms.
Governance integration requires a stated boundary for acceptable exposure. Defining risk appetite, quantitatively or qualitatively, gives the board a benchmark against which opportunities and threats are evaluated, aligning risk decisions with strategy rather than leaving tolerance implicit.
B
Establishing clear accountability for risk ownership at the executive level.
Assigning risk ownership to executives embeds risk accountability within governance structures, ensuring risks are owned, escalated and reported at the highest level. This aligns risk management with strategic decision-making and oversight, which is essential for enterprise-wide integration.
C
Standardizing the IT configuration management database (CMDB) structure.
Why it fails: A CMDB records configuration items and their relationships; it does not govern risk appetite, tolerance or oversight accountability, so it cannot integrate risk into governance. Standardising it is worthwhile for service management and change control, where consistent configuration data supports impact analysis, but that is a separate discipline from enterprise governance integration.
D
Integrating risk reporting into the existing enterprise performance management process.
Embedding risk reporting within enterprise performance management ties risk directly to strategic objectives and existing governance cycles, satisfying the stem's requirement for effective integration into enterprise governance rather than treating risk as a standalone compliance exercise.
E
Outsourcing the primary data center to a tier-one cloud provider.
Why it fails: Migrating the data centre changes hosting and operational risk exposure but performs no governance activity such as defining risk appetite, assigning ownership or embedding risk reporting into board oversight. Outsourcing to a tier-one cloud provider is a legitimate infrastructure strategy when resilience or cost goals demand it, yet it is a delivery decision, not risk governance integration.

Full breakdown with real-world context →

Question 8easymulti select

Full question →

Which TWO of the following are considered key elements of a robust Benefits Realization Plan (BRP)?

A
Detailed software vendor licensing terms.
Why it fails: Vendor licensing terms govern cost and usage rights; they do not define expected benefits, measurement methods, accountability or review points, so they cannot drive benefit realisation. It is tempting because licensing affects the business case, and such terms would be correct within procurement or contract management documentation rather than a Benefits Realization Plan.
B
Project team contact list.
Why it fails: A contact list identifies people to notify; it carries no benefit measures, targets, ownership or tracking dates, so it cannot evidence whether benefits were realised. It is tempting because stakeholder communication underpins delivery, and a contact list would be correct for a project communications or escalation plan rather than a Benefits Realization Plan.
C
Technical architectural diagrams.
Why it fails: Architectural diagrams describe solution structure and components; they contain no benefit metrics, baselines, owners or realisation milestones, so they cannot demonstrate value delivery. It is tempting because architecture artefacts support solution governance, and diagrams would be correct for a technical design or architecture review deliverable, not a Benefits Realization Plan.
D
Clear identification of benefits and their owners.
Naming each benefit and assigning a named owner creates accountability for delivery, preventing vague aspirations from entering the plan. This satisfies the BRP requirement that benefits be explicitly identified and owned, enabling tracking and intervention when realisation drifts.
E
Defined metrics and baseline performance measurements.
Metrics with baseline measurements establish the comparison point against which benefit delivery is later assessed. Without a baseline, claimed improvements are unverifiable, so this element satisfies the BRP requirement for measurable, evidence-based benefit tracking throughout the investment lifecycle.

Full breakdown with real-world context →

Question 9hardmulti select

Full question →

Which THREE metrics are commonly used to measure the success of an IT investment?

A
Total cost of software development.
Why it fails: Total development cost measures spend, not investment success; it ignores returns, benefits realised and business value delivered. Cost tracking suits budgeting and variance analysis, whereas investment success metrics compare benefits against cost, such as ROI, NPV or payback period.
B
Customer satisfaction or Net Promoter Score (NPS).
Customer satisfaction and Net Promoter Score capture perceived value delivered to users, complementing financial and operational measures of an IT investment. This satisfies the stem by providing a stakeholder-facing metric that indicates whether the investment achieved its intended business outcomes.
C
Return on Investment (ROI).
ROI expresses net investment gain as a percentage of cost, letting governance compare IT initiatives against alternative uses of capital. It directly satisfies the stem's demand for a commonly used investment success metric by quantifying financial return relative to the amount invested.
D
Net Present Value (NPV).
NPV discounts all future cash flows to present value, so it captures the time value of money that ROI ignores. This satisfies the stem's requirement for a standard IT investment success metric by showing whether an initiative increases absolute financial value.
E
The number of hours the development team worked.
Why it fails: Hours worked measure effort and resource consumption, not whether the investment delivered value. Effort tracking suits capacity planning and project accounting, whereas success metrics quantify outcomes, such as ROI, net present value, payback period or benefit realisation against the business case.

Full breakdown with real-world context →

Question 10hardmulti select

Full question →

Which THREE of the following represent effective ways to integrate IT risk into the organizational culture?

A
Regular risk management training for all staff.
Mandatory training gives every employee shared vocabulary and awareness of IT risk responsibilities, embedding risk thinking across all roles rather than confining it to specialists. This directly satisfies the stem's cultural integration goal by making risk consideration routine behaviour organisation-wide.
B
Changing the corporate logo.
Why it fails: A logo change carries no risk governance content, so it cannot embed IT risk into decision-making or accountability. It is tempting because visible branding exercises are genuine culture-change tools, and would be correct where the objective is raising general risk awareness rather than integrating risk into processes.
C
Linking performance bonuses to risk management outcomes.
Tying bonuses to risk outcomes aligns individual incentives with risk-aware behaviour, embedding IT risk into performance management rather than leaving it as guidance. This satisfies the stem's cultural integration requirement by making risk management a measurable, rewarded part of everyday decision-making.
D
Executive sponsorship of risk management initiatives.
Visible executive sponsorship signals that IT risk is a governance priority, not a technical afterthought. Leaders modelling risk-aware decisions embed the expected behaviours into daily practise, satisfying the stem's requirement to integrate risk into organisational culture through demonstrated tone from the top.
E
Reducing the number of IT staff.
Why it fails: Headcount reduction alters capacity and cost, not risk ownership, appetite or reporting behaviour, so it cannot integrate IT risk into culture. It is tempting because staffing decisions do affect who owns controls, and would be correct where the goal is restructuring the risk function rather than embedding risk into everyday conduct.

Full breakdown with real-world context →

Question 11hardmulti select

Full question →

Which THREE of the following are elements of a strong IT resource governance policy?

A
A list of all individual employee salaries
Why it fails: Employee salary data is personally identifiable HR information governed by privacy and payroll controls, not an IT resource governance artefact. It is tempting because cost transparency supports IT investment decisions, but the policy should define resource ownership, funding and accountability rather than list individual remuneration.
B
A list of all vendor passwords
Why it fails: Storing vendor passwords in a governance policy document creates a credential repository that bypasses privileged access management and secrets vaulting, increasing breach exposure. It is tempting because credential control is a genuine governance concern, but the policy should mandate vaulting and rotation, not enumerate the passwords themselves.
C
Defined KPIs and metrics to measure the effectiveness of resource usage
Defined KPIs and metrics provide quantifiable evidence that IT resources deliver value and meet performance expectations, satisfying the governance requirement for measurable accountability. Without such measures, resource usage cannot be objectively evaluated, so this element directly supports the oversight and monitoring mandate central to a strong IT resource governance policy.
D
Standardized processes for requesting, approving, and allocating resources
Standardised request, approval, and allocation processes embed governance directly into resource workflows, satisfying the stem's demand for a strong policy element. They enforce consistent authorisation, traceable decisions, and equitable allocation across the organisation, preventing ad hoc provisioning. This control mechanism is precisely what distinguishes governed IT resource management from informal arrangements.
E
Clearly defined roles, responsibilities, and decision-making authorities
Clearly defined roles, responsibilities, and decision-making authorities establish accountability for IT resource use, directly satisfying governance's need to assign ownership and escalation paths. Without named decision rights, resource allocation becomes ad hoc and unenforceable, so this element anchors the policy's control structure.

Full breakdown with real-world context →

Question 12hardmulti select

Full question →

Which THREE of the following are essential elements of an IT risk governance policy?

A
Procedures for reporting and escalating risks
Reporting and escalation procedures satisfy the policy's requirement for defined accountability channels, ensuring identified risks reach the appropriate decision-makers with authority to act. Without explicit escalation paths, risk governance collapses into undocumented local handling, so this element is essential for the policy to function.
B
The physical location of all backup tapes
Why it fails: Backup tape storage locations are an operational continuity detail, not a governance element defining risk appetite, roles, or tolerance thresholds. It tempts because physical media protection matters in disaster recovery planning, where asset inventories and offsite storage would legitimately appear.
C
Defined enterprise risk appetite and tolerance levels
Risk appetite and tolerance define how much exposure the enterprise accepts before action is mandated, giving decision-makers quantified thresholds. This element satisfies the governance requirement that risk acceptance be deliberate and consistently applied rather than left to individual judgement.
D
A list of all software vendors currently in use
Why it fails: A vendor inventory is procurement and asset-management data, not a governance instrument establishing risk criteria, accountability, or escalation paths. It tempts because third-party risk oversight is a genuine governance concern, but that is addressed through vendor risk policy, not a raw software list.
E
Clear roles and responsibilities for risk ownership
Assigning named accountability for each risk ensures every identified exposure has an owner who assesses, treats and monitors it. Without explicit ownership, the policy cannot enforce decisions, so this element satisfies the governance requirement for accountability across the enterprise.

Full breakdown with real-world context →

Question 13easymulti select

Full question →

Which THREE of the following are key aspects of workforce planning in IT?

A
Implementing retention strategies for key talent
Retention strategies for key talent address the supply side of workforce planning by reducing attrition of scarce, strategically critical IT skills, ensuring the capability pipeline identified during demand analysis remains available to deliver the enterprise's objectives.
B
Developing training and professional development programs
Training and professional development programmes close the gap between the competencies the IT workforce currently holds and those the organisation's future strategy demands, making them a core workforce planning activity rather than an operational HR task.
C
Selecting the IT department's holiday party venue
Why it fails: Choosing a holiday party venue is an administrative social event, carrying no competency, capacity or succession implications for IT workforce planning. It tempts because team-building and morale do influence retention, but genuine planning covers skills inventories, role demand forecasting and gap remediation, not venue logistics.
D
Identifying current and future competency requirements
Identifying current and future competency requirements ensures the IT workforce possesses the skills needed to deliver services now and as business strategy evolves. This satisfies the stem's demand for key workforce planning aspects by addressing the competency-gap analysis that underpins recruitment, training and succession decisions.
E
Mandatory office attendance policies
Why it fails: Mandatory office attendance is a workplace policy decision, not workforce planning, which forecasts the skills, roles and capacity IT needs against strategic demand. It tempts because attendance rules can affect retention and resourcing, yet planning addresses competency gaps, sourcing mix and succession rather than location mandates.

Full breakdown with real-world context →

Question 14mediummulti select

Full question →

Which TWO of the following are effective strategies for optimizing workforce resources?

A
Reducing the frequency of staff performance reviews
Why it fails: Cutting performance review frequency removes the feedback and development mechanism through which underperformance is identified and skills gaps addressed, so workforce capability is not optimised. It is tempting because it reduces administrative overhead, and would be defensible where reviews are purely bureaucratic and consume disproportionate management time.
B
Using a flexible resource model for non-core, variable IT activities
A flexible resource model lets non-core, variable IT activities scale up or down using contractors, partners or shared services rather than permanent staff. This satisfies the optimisation goal by aligning cost and capacity with actual demand, avoiding idle permanent headcount.
C
Requiring all staff to work in the office five days a week
Why it fails: Mandating five office days removes flexible and remote working arrangements, which reduces retention and access to wider talent pools rather than optimising the workforce. It is tempting because co-location can aid collaboration, and would be reasonable where on-site presence is a genuine operational requirement.
D
Increasing the number of layers in the management hierarchy
Why it fails: Adding management layers lengthens decision and escalation paths, increasing coordination overhead and cost without improving the productivity or capability of the existing workforce. It is tempting because extra supervision appears to tighten control, and would be justified where span of control is genuinely unmanageable.
E
Implementing a cross-training program to increase staff versatility
Cross-training builds secondary skills so staff can cover multiple roles, reducing single-person dependencies and key-person risk. It satisfies the optimisation goal by raising versatility, letting the organisation redeploy existing headcount flexibly instead of hiring for every fluctuating demand.

Full breakdown with real-world context →

Question 15easymulti select

Full question →

Which TWO are common IT governance structures?

A
Architecture Review Board
An Architecture Review Board provides cross-functional oversight of technology decisions, ensuring solutions align with enterprise architecture principles and strategic objectives. It satisfies the governance requirement for structured decision-making authority, distinct from operational management bodies. This formal review mechanism enforces standards and accountability across projects, which is characteristic of IT governance structures rather than day-to-day delivery functions.
B
Coffee and Donut Club
Why it fails: A social club holds no decision rights, accountability or oversight over IT, so it cannot constitute a governance structure. Informal groups are relevant when discussing organisational culture, not the formal bodies that direct and control enterprise IT.
C
Software testing team
Why it fails: A software testing team performs verification activities within delivery, not governance; it holds no decision rights, accountability or oversight mandate. Testing teams are the correct subject when the question addresses quality assurance roles rather than governance structures.
D
Help desk support
Why it fails: Help desk support is an operational service-delivery function, not a governance structure; it executes incident resolution rather than setting decision rights and oversight. It would be relevant when the question concerns IT service management processes, such as incident or request handling.
E
IT Steering Committee
An IT steering committee is a standing governance body that prioritises IT investments, approves projects and aligns IT delivery with business strategy. It satisfies the stem's requirement for a common governance structure by providing cross-functional oversight and decision rights over IT, distinct from operational management or project-level roles.

Full breakdown with real-world context →

Question 16hardmulti select

Full question →

A global insurer is expanding its use of cloud-hosted underwriting platforms. The CIO proposes a single enterprise risk register entry for 'cloud provider outage,' with quarterly review by the IT steering committee. The board risk committee has asked the CGEIT practitioner to strengthen the integration of IT risk with enterprise risk management. Which TWO actions best align the IT risk taxonomy and reporting with the enterprise risk framework? (Choose two.)

A
Delegate all cloud risk decisions to the third-party provider's risk team and accept their residual risk assessment as the enterprise view.
Why it fails: Outsourcing risk assessment to a provider does not transfer accountability for enterprise risk. The organization remains responsible for determining whether residual cloud risk falls within its appetite and for reporting that exposure to the board. Accepting a vendor's assessment without independent validation undermines governance and leaves the enterprise risk profile incomplete, so this action fails the integration requirement.
B
Increase the frequency of vulnerability scans on the underwriting platform and report the raw scan counts directly to the board risk committee.
Why it fails: More frequent vulnerability scanning improves technical detection but does not integrate IT risk with the enterprise risk framework. Raw scan counts are operational metrics that lack business impact context, and reporting them directly to the board bypasses risk aggregation and prioritization. This action addresses control monitoring rather than the governance alignment requested, so it does not satisfy the board's integration objective.
C
Define IT risk appetite thresholds in business terms such as maximum tolerable downtime for underwriting services and incorporate them into the enterprise risk appetite statement.
Expressing IT risk appetite in business impact terms, such as maximum tolerable downtime, lets the board compare cloud risk against other enterprise exposures using a common language. Embedding these thresholds into the enterprise risk appetite statement connects technology decisions to strategic objectives. This integration ensures IT risk is governed at the same level and cadence as other material enterprise risks.
D
Consolidate all cloud contracts under a single procurement owner to reduce the number of vendor relationships managed by IT.
Why it fails: Contract consolidation may improve commercial leverage but does not integrate IT risk into the enterprise risk framework. It changes sourcing structure without addressing risk taxonomy, appetite alignment, or board reporting. The scenario requires governance integration, not procurement efficiency, so this action would leave the fragmented IT risk view intact and fail to meet the board's request.
E
Map cloud outage scenarios to the enterprise risk taxonomy and aggregate them into the operational resilience category reported to the board risk committee.
Mapping IT loss events to the enterprise risk taxonomy allows the board to see cloud exposure alongside other operational resilience risks. Aggregating scenarios under a common category supports consistent appetite statements, capital discussions, and regulatory reporting. A single IT register entry reviewed only by the steering committee would fragment this view, so aligning terminology and reporting lines is essential for integrated enterprise risk management.

Full breakdown with real-world context →

Question 17mediummulti select

Full question →

A hospital's IT governance committee is reviewing its IT resource management practices. The committee wants to ensure that IT resources are effectively governed to support clinical and administrative needs. Which TWO of the following are key components of an effective IT resource governance framework? (Choose two.)

A
Clearly defined roles and responsibilities for IT resource management, including ownership and stewardship.
This is a key component because clear roles and responsibilities establish accountability for IT resources. Without defined ownership and stewardship, resource management becomes uncoordinated, leading to inefficiencies, gaps, and conflicts. In a hospital setting, this is critical for ensuring that clinical systems and data are managed appropriately and that resources are aligned with patient care priorities.
B
A process for continuously monitoring and reporting on IT resource utilization and performance.
Continuous monitoring and reporting are essential for effective governance. They provide the data needed to make informed decisions about resource allocation, identify underutilized or overburdened assets, and ensure that resources are delivering value. In a healthcare environment, real-time monitoring can also support compliance with regulations and ensure that critical clinical systems are performing as required.
C
An annual external audit of all IT resource expenditures to ensure cost minimization.
Why it fails: An annual external audit is a monitoring and assurance activity, but it is not a key component of the governance framework itself. Governance requires ongoing oversight and decision-making structures, not just periodic audits. Moreover, focusing solely on cost minimization ignores the need to optimize resources for value and strategic alignment, which is the broader goal of IT resource governance.
D
A decentralized approach where each department independently manages its own IT resources without central coordination.
Why it fails: A fully decentralized approach without central coordination is contrary to effective IT resource governance. It leads to duplication, inconsistent standards, and a lack of enterprise-wide visibility, which can increase costs and risks. While some decentralization may be appropriate, a governance framework must provide central oversight, policies, and coordination to ensure resources are managed in the best interest of the entire organization.
E
A policy that mandates the use of a single vendor for all IT hardware and software to simplify management.
Why it fails: Mandating a single vendor is not a key component of effective IT resource governance. It can reduce flexibility, increase risk through vendor lock-in, and may not be cost-effective. While vendor consolidation can be a strategy, it is not a fundamental governance requirement. Governance focuses on principles, policies, and oversight, not on restrictive procurement mandates.

Full breakdown with real-world context →

Question 18mediummulti select

Full question →

A retail enterprise's IT steering committee is reviewing how application portfolio resources should be governed. The portfolio has grown to over 400 applications, many with overlapping functionality and unclear ownership. The committee wants to establish a repeatable governance process for rationalizing the portfolio. Which TWO of the following actions are MOST effective for this purpose? (Choose two.)

A
Set a fixed target of retiring 25% of applications within twelve months to create urgency for the rationalization effort
Why it fails: A fixed retirement percentage prioritizes quantity over value and can force premature decommissioning of applications that still deliver business benefit or carry data retention obligations. Rationalization should be driven by capability overlap, cost, risk, and strategic alignment, not an arbitrary headcount-style target. Such targets often produce cosmetic retirements that do not reduce cost or complexity.
B
Migrate the entire portfolio to a single vendor's SaaS platform to eliminate integration and ownership complexity
Why it fails: Wholesale migration to a single SaaS vendor creates significant concentration risk, may not support specialized retail processes, and does not address the underlying governance gap of unclear ownership and duplication. It substitutes one form of complexity for another and can lock the enterprise into unfavorable terms. Rationalization requires understanding the portfolio first, not replacing it wholesale.
C
Delegate all application retirement decisions to individual business unit leaders to accelerate the rationalization process
Why it fails: Delegating retirement decisions to individual business units fragments governance and risks removing applications that support cross-unit or regulatory functions. Business unit leaders optimize for their own domain, not the enterprise portfolio. Retirement decisions require enterprise-wide visibility into dependencies, data retention obligations, and shared services, which is precisely what a centralized governance process provides.
D
Mandate that all new application acquisitions follow a standardized business case and architecture review process
Gating new acquisitions through a standardized business case and architecture review prevents further portfolio sprawl and embeds governance into the intake process. It ensures each new application is justified against existing capabilities and enterprise architecture standards. Combined with an inventory, this creates a repeatable control loop: the inventory informs rationalization, and the intake gate prevents recurrence of the problem.
E
Establish an application inventory with business capability mapping, lifecycle status, and assigned business owners
An application inventory linked to business capabilities, lifecycle status, and ownership provides the factual foundation for rationalization decisions. Without it, the committee cannot identify duplication, orphaned applications, or candidates for retirement. Assigning business owners ensures accountability for each application's ongoing value and cost, which is a core IT resource governance requirement. This action directly enables repeatable, evidence-based portfolio decisions.

Full breakdown with real-world context →

Question 19mediummulti select

Full question →

A global retailer is implementing a new enterprise resource planning (ERP) system. The CGEIT practitioner is tasked with ensuring that risk optimization is embedded throughout the project lifecycle. Which TWO of the following actions are most critical to achieve this? (Choose two.)

A
Conduct a single comprehensive risk assessment at the project's initiation.
Why it fails: A single assessment at initiation is insufficient because risks evolve. New risks emerge, and existing risks may change in likelihood or impact. Without ongoing assessment, the project may be exposed to unmanaged risks. Risk optimization requires continuous risk management throughout the lifecycle, not just at the start.
B
Establish a risk register that is reviewed at key project milestones.
A risk register reviewed at milestones provides a structured way to track and manage risks over time. It ensures that risks are revisited and updated as the project progresses. This practice supports risk optimization by maintaining visibility and enabling timely decisions. It also facilitates communication with stakeholders and governance bodies.
C
Integrate risk assessments into each phase of the ERP implementation.
Integrating risk assessments into each phase ensures that risks are identified and addressed early, preventing costly rework. It allows for continuous monitoring and adjustment of risk responses as the project evolves. This proactive approach aligns with risk optimization by embedding risk management into the project lifecycle, rather than treating it as a one-time activity.
D
Assign risk ownership to the project manager for all identified risks.
Why it fails: While the project manager should oversee risk management, assigning all risk ownership to them is not optimal. Risk owners should be the individuals best positioned to manage specific risks, often functional or technical experts. Centralizing all ownership can lead to bottlenecks and reduced accountability. Effective risk optimization requires distributed ownership with clear responsibilities.
E
Delegate all risk decisions to the ERP vendor to leverage their expertise.
Why it fails: Delegating all risk decisions to the vendor abdicates the organization's responsibility for risk management. The vendor may not fully understand the enterprise's risk appetite and strategic objectives. The organization must retain ownership of risk decisions, using vendor expertise as input. This ensures alignment with governance and accountability.

Full breakdown with real-world context →

Question 20mediummulti select

Full question →

A hospital's board has established a risk appetite that prioritizes patient safety over cost efficiency. The CGEIT practitioner is reviewing IT investment proposals and must ensure they align with this risk appetite. Which TWO of the following actions best demonstrate alignment with the board's risk appetite? (Choose two.)

A
Outsource the management of patient monitoring systems to a low-cost provider to reduce expenses and free up internal resources.
Why it fails: Outsourcing patient monitoring systems to a low-cost provider may reduce expenses but could introduce risks to patient safety if the provider's quality or reliability is inadequate. This action prioritizes cost reduction over safety, contradicting the board's risk appetite. Unless the provider can demonstrably meet or exceed safety standards, this decision misaligns with the stated preference for patient safety over cost efficiency.
B
Defer security patching on medical devices to avoid disrupting clinical workflows, as patient safety takes precedence.
Why it fails: Deferring security patching on medical devices to avoid workflow disruption actually increases risk to patient safety by leaving vulnerabilities that could be exploited, potentially affecting device availability or data integrity. This does not align with a risk appetite that prioritizes patient safety; instead, it prioritizes operational convenience. Proper alignment would require finding ways to patch without compromising safety, such as scheduled maintenance windows.
C
Reduce the frequency of backup testing for clinical databases to save on operational costs, since backups are rarely needed.
Why it fails: Reducing backup testing for clinical databases increases the risk of data loss or unavailability in the event of a failure, which could directly impact patient care. This action prioritizes cost savings over patient safety, contrary to the board's risk appetite. Regular testing is essential to ensure backups are reliable; skipping it introduces a hidden risk that could manifest during a critical incident.
D
Prioritize funding for a redundant electronic health record (EHR) system to minimize downtime risk, even though it increases costs.
Investing in redundancy for the EHR system directly supports patient safety by reducing the risk of downtime that could compromise care. Accepting higher costs to mitigate a patient safety risk aligns with a risk appetite that prioritizes safety over cost efficiency. This demonstrates that risk response decisions are consistent with the board's stated tolerance for risk in pursuit of patient safety objectives.
E
Implement a real-time clinical decision support tool that reduces the likelihood of medication errors, despite a higher initial investment.
A clinical decision support tool that reduces medication errors directly mitigates a patient safety risk. The higher initial investment is justified because the board's risk appetite prioritizes safety over cost efficiency. This action shows that the organization is willing to allocate resources to reduce risks that could harm patients, consistent with the stated risk appetite. It is a clear example of aligning IT investment with risk tolerance.

Full breakdown with real-world context →

These CGEIT practice questions are part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style CGEIT questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.