CGEIT - Certified in the Governance of Enterprise IT — Questions and Answers

Question 1: In CGEIT, 'informed stakeholders' in a RACI matrix are BEST described as those who:

Approve all major IT investment decisions
Receive updates on decisions and outcomes but do not participate in making them (Correct answer)
Perform the hands-on technical work
Are consulted before decisions are finalized

Correct answer: Receive updates on decisions and outcomes but do not participate in making them

Informed stakeholders are kept in the loop about outcomes and decisions but are not part of the decision-making or consultation process.

Question 2: Which role is MOST responsible for ensuring IT governance compliance with regulatory requirements?

Network operations center staff
External auditors who conduct annual reviews
Chief Information Officer (CIO) and senior IT governance leadership (Correct answer)
Individual IT developers

Correct answer: Chief Information Officer (CIO) and senior IT governance leadership

The CIO and senior IT governance leadership are accountable for ensuring IT practices meet regulatory requirements — they cannot delegate that accountability.

Question 3: Which of the following resource categories includes skill sets, certifications, productivity, and morale?

Products
Processes
People (Correct answer)
Partners

Correct answer: People

Explanation: The resource category that includes skill sets, certifications, productivity, and morale is "People." This category refers to the human resources within an organization, including their skills, qualifications, certifications, productivity levels, and morale. Effective management and development of people are crucial for achieving organizational objectives and maintaining competitive advantage.

Question 4: An IT investment delivers on time and on budget but the business reports no improvement in outcomes. From a governance perspective, this investment was:

Partially successful and should be considered adequate
A vendor failure that should trigger contract penalties
Unsuccessful, because value delivery — not project metrics — is the ultimate measure (Correct answer)
Successful, because it met all project management criteria

Correct answer: Unsuccessful, because value delivery — not project metrics — is the ultimate measure

IT governance defines success by business outcomes, not project delivery metrics — an on-time, on-budget project that delivers no business value has failed its governance purpose.

Question 5: The PRIMARY reason IT governance communication plans fail is:

They are not tailored to the needs and communication preferences of each stakeholder group (Correct answer)
They include too much financial data
They are updated too frequently
They rely on external consultants

Correct answer: They are not tailored to the needs and communication preferences of each stakeholder group

A one-size-fits-all communication approach fails because different stakeholders need different levels of detail, formats, and frequencies.

Question 6: Which of the following is a process that occurs due to mergers, outsourcing, or changing business needs?

Involuntary exit (Correct answer)
Plant closing
Voluntary exit
Outplacement

Correct answer: Involuntary exit

Explanation: Involuntary exit refers to the process where employees are terminated or laid off from their jobs due to reasons such as mergers, outsourcing, or changing business needs. This happens when the organization needs to reduce its workforce or restructure due to strategic changes, financial pressures, or shifts in business priorities. Involuntary exits are typically initiated by the employer rather than the employee, distinguishing them from voluntary exits where employees choose to leave on their own accord.

Question 7: When IT governance metrics consistently meet targets, a governance board should FIRST:

Immediately raise all targets by 20%
Remove the metrics from the dashboard
Reassign the IT team to other projects
Verify that targets are appropriately challenging and not set too low (Correct answer)

Correct answer: Verify that targets are appropriately challenging and not set too low

Consistently met targets may indicate they are set too conservatively — verifying target difficulty ensures metrics continue to drive meaningful performance.

Question 8: Enterprise Architecture (EA) PRIMARILY supports IT governance by:

Providing a structured blueprint that aligns IT capabilities with business strategy (Correct answer)
Documenting all software bugs for remediation
Tracking individual project milestones
Managing IT vendor contracts and pricing

Correct answer: Providing a structured blueprint that aligns IT capabilities with business strategy

Enterprise Architecture creates a holistic model of how IT capabilities, processes, and systems should be structured to support and enable business strategy.

Question 9: A governance review reveals that a KPI has been stable for two years but the underlying business condition it measures has changed significantly. The BEST action is to:

Continue tracking the KPI for historical continuity
Escalate the issue to the external auditor
Increase the reporting frequency of the existing KPI
Retire or redesign the KPI to reflect the current business reality (Correct answer)

Correct answer: Retire or redesign the KPI to reflect the current business reality

A KPI that no longer reflects current business conditions provides misleading signals and should be redesigned or retired to maintain governance relevance.

Question 10: An 'architecture review board' (ARB) in IT governance PRIMARILY serves to:

Manage the IT department's annual budget
Evaluate proposed IT changes for conformance with enterprise architecture standards (Correct answer)
Approve all IT vendor contracts
Conduct performance reviews for IT staff

Correct answer: Evaluate proposed IT changes for conformance with enterprise architecture standards

An ARB reviews proposed IT projects and changes to ensure they align with and comply with established enterprise architecture standards and principles.

Question 11: An enterprise has decided to use third-party software for a business process which is hosted and supported by the same third party. The BEST way to provide quality of service oversight would be to establish a process:

for robust change management.
for periodic service provider audits.
to qualify service providers. (Correct answer)
for enterprise architecture updates.

Correct answer: to qualify service providers.

Explanation: Qualifying service providers involves establishing criteria for selecting third-party vendors based on their capabilities, reputation, and ability to meet the enterprise's service requirements. By thoroughly vetting and qualifying service providers before engaging with them, the enterprise can ensure that they are capable of delivering high-quality services and support. This process helps mitigate risks associated with relying on third-party software and ensures that the enterprise selects a provider who can uphold the desired level of service quality.

Question 12: In which of the following types of biases does the data collection itself interfere with the process it is measuring?

Interaction (Correct answer)
Operational
Nonresponse
Perception

Correct answer: Interaction

Explanation: Interaction bias occurs when the process of data collection itself interferes with the process being measured. This interference can occur due to various factors, such as the presence of the data collectors influencing the behavior of the subjects or the environment, changes in conditions caused by the data collection process, or the data collection methods altering the natural state of the phenomenon being observed.

Question 13: Which element is MOST important when designing a KPI for IT governance?

Approval from the external IT auditor
A clear baseline, target, and accountability owner (Correct answer)
Selection of the most advanced data collection technology
Alignment with the IT department's internal goals

Correct answer: A clear baseline, target, and accountability owner

A well-designed KPI needs a baseline to measure against, a target to aim for, and a named owner who is accountable for the result.

Question 14: In CGEIT, 'governance effectiveness' is BEST measured by assessing:

The number of IT governance policies in place
The speed at which IT incidents are resolved
The ratio of IT staff to business users
The degree to which IT outcomes align with defined business objectives (Correct answer)

Correct answer: The degree to which IT outcomes align with defined business objectives

Governance effectiveness is measured by outcomes — specifically whether IT results consistently align with and advance business objectives.

Question 15: Dis-benefits in IT investments refer to:

Budget overruns caused by scope creep
IT costs that exceed vendor estimates
Negative consequences or costs resulting from an IT change (Correct answer)
Benefits that arrive later than planned

Correct answer: Negative consequences or costs resulting from an IT change

Dis-benefits are unintended negative outcomes of an IT investment, such as increased workload or disruption, that must also be tracked in the benefits realization plan.

Question 16: In CGEIT, which of the following BEST describes the role of IT resource optimization within enterprise governance?

Standardizing all IT resources to a single vendor platform
Delegating all resource decisions to departmental IT managers
Ensuring IT resources are acquired, deployed, and retired in a manner that maximizes value (Correct answer)
Reducing IT headcount to minimize operational expenses

Correct answer: Ensuring IT resources are acquired, deployed, and retired in a manner that maximizes value

IT resource optimization in governance ensures resources are managed throughout their lifecycle to deliver maximum business value.

Question 17: The TOGAF Architecture Development Method (ADM) is BEST described as:

A vendor selection methodology for enterprise software
A one-time process to document current IT systems
An iterative cycle for developing and managing enterprise architecture (Correct answer)
A compliance framework for financial reporting IT controls

Correct answer: An iterative cycle for developing and managing enterprise architecture

TOGAF ADM is an iterative, phased cycle that guides organizations through developing, implementing, and continually refining their enterprise architecture.

Question 18: Which practice BEST supports IT resource capacity management within a governance structure?

Delegating capacity decisions entirely to operational IT staff
Purchasing maximum available capacity to avoid shortfalls
Demand forecasting tied to business strategy and workload projections (Correct answer)
Reactive procurement based on immediate operational needs

Correct answer: Demand forecasting tied to business strategy and workload projections

Demand forecasting linked to business strategy enables proactive and cost-effective capacity management aligned with governance principles.

Question 19: A 'run vs. grow vs. transform' investment categorization in IT portfolio management MOST helps to:

Measure IT project manager performance
Compare IT spending across different business units
Track vendor contract renewal cycles
Balance spending between maintaining operations, enhancing capabilities, and driving innovation (Correct answer)

Correct answer: Balance spending between maintaining operations, enhancing capabilities, and driving innovation

Categorizing investments as run, grow, or transform enables governance bodies to deliberately balance maintaining the business, growing it, and transforming it.

Question 20: A CGEIT practitioner identifies that benefits are being reported without independent verification. The BEST recommendation is to:

Implement an independent review or audit of reported benefit figures (Correct answer)
Delay reviews until the next fiscal year
Accept self-reported benefits from project teams as sufficient
Remove the benefits reporting requirement to reduce workload

Correct answer: Implement an independent review or audit of reported benefit figures

Independent verification of reported benefits ensures objectivity and prevents overstating achievements, supporting credible governance.

Question 21: A governance 'architecture principle' MOST effectively guides IT decision-making by:

Documenting the preferences of individual IT project managers
Listing approved technology vendors for each IT category
Setting maximum budget limits for IT investments
Providing a stable rule that all IT decisions must respect regardless of project context (Correct answer)

Correct answer: Providing a stable rule that all IT decisions must respect regardless of project context

Architecture principles are enduring rules — like 'prefer reuse over rebuild' — that govern all IT decisions consistently, ensuring coherence across the enterprise.

Question 22: Which layer of enterprise architecture DIRECTLY governs how business processes are structured and documented?

Data Architecture
Business Architecture (Correct answer)
Technology Architecture
Application Architecture

Correct answer: Business Architecture

Business Architecture maps business processes, capabilities, and value streams, directly governing how work is structured and connected to IT enablement.

Question 23: Paul has been asked to complete a SWOT analysis for his solution scope. What does SWOT analysis mean?

Strengths, Weaknesses, Opportunities, Threats (Correct answer)
Stakeholders Weaknesses, Organization, Threats
Stakeholder Weaknesses, Organizational Threats
Strengths, Weaknesses, Opportunities, Time

Correct answer: Strengths, Weaknesses, Opportunities, Threats

Explanation: SWOT analysis stands for Strengths, Weaknesses, Opportunities, and Threats. It is a strategic planning tool used to identify and evaluate the internal strengths and weaknesses of a project, product, or organization, as well as the external opportunities and threats in the environment. This analysis helps in understanding the current position and situation, assessing potential risks and advantages, and formulating strategies to leverage strengths and opportunities while mitigating weaknesses and threats.

Question 24: Which activity is MOST essential when establishing a benefits realization framework for an IT investment?

Selecting the lowest-cost technology vendor
Assigning all responsibility to the IT department
Scheduling quarterly technology audits
Defining measurable business outcomes tied to strategic goals (Correct answer)

Correct answer: Defining measurable business outcomes tied to strategic goals

A benefits realization framework must link measurable outcomes directly to strategic goals so progress can be tracked and value confirmed.

Question 25: Which factor MOST determines the frequency of IT governance reporting to stakeholders?

The age of the existing IT infrastructure
The size of the IT department
The number of IT vendors under contract
The stakeholder's role, decision-making needs, and the volatility of the IT environment (Correct answer)

Correct answer: The stakeholder's role, decision-making needs, and the volatility of the IT environment

Reporting frequency should match how often stakeholders need information to make decisions, adjusted for how rapidly the IT environment is changing.

Question 26: In IT governance, identifying stakeholders PRIMARILY helps an organization to:

Reduce the number of people involved in IT projects
Limit communication to senior executives only
Assign technical tasks to appropriate teams
Understand who has interests in and influence over IT decisions (Correct answer)

Correct answer: Understand who has interests in and influence over IT decisions

Stakeholder identification maps out who has interests or influence so governance structures can engage the right people in IT decisions.

Question 27: An organization's IT governance committee approves a new enterprise application without an architecture review. The MOST likely consequence is:

Reduced IT operating costs
Integration conflicts, data duplication, and misalignment with the existing IT estate (Correct answer)
Faster deployment and improved business outcomes
Improved vendor relationship management

Correct answer: Integration conflicts, data duplication, and misalignment with the existing IT estate

Skipping architecture review risks introducing systems that conflict with existing integrations, duplicate data, and undermine the coherence of the enterprise IT estate.

Question 28: A Balanced Scorecard in IT governance PRIMARILY measures performance across which four perspectives?

Infrastructure, Applications, Data, and Security
Budget, Schedule, Scope, and Quality
Risk, Compliance, Strategy, and Operations
Financial, Customer, Internal Process, and Learning & Growth (Correct answer)

Correct answer: Financial, Customer, Internal Process, and Learning & Growth

The Balanced Scorecard measures IT governance performance across financial, customer, internal process, and learning & growth perspectives to provide a holistic view.

Question 29: A 'project portfolio' differs from a 'project' in that a portfolio:

Comprises multiple projects managed collectively to optimize strategic value (Correct answer)
Is managed by a single project manager
Contains only completed projects for historical reference
Is a single large project broken into phases

Correct answer: Comprises multiple projects managed collectively to optimize strategic value

A portfolio aggregates multiple projects and programs managed together so their combined investment delivers maximum strategic value.

Question 30: A continuous compliance monitoring program MOST benefits an organization by:

Detecting compliance gaps in real time rather than waiting for periodic audits (Correct answer)
Reducing the number of IT controls required
Automating all IT governance decision-making
Eliminating the need for annual external audits

Correct answer: Detecting compliance gaps in real time rather than waiting for periodic audits

Continuous monitoring provides real-time visibility into compliance status, enabling faster detection and remediation of gaps before they escalate.

Question 31: An IT organization is found to be SOX-compliant but experiences repeated data breaches. This MOST likely indicates:

Data breach responsibility lies entirely with the cybersecurity team
SOX requirements are too strict for practical implementation
Compliance does not guarantee adequate security controls beyond regulatory minimums (Correct answer)
The organization needs to abandon its IT governance framework

Correct answer: Compliance does not guarantee adequate security controls beyond regulatory minimums

SOX compliance addresses financial reporting controls, not comprehensive cybersecurity — meeting one compliance standard does not ensure security in all areas.

Question 32: The MAIN purpose of setting IT governance performance targets is to:

Provide a clear standard against which actual performance can be evaluated (Correct answer)
Satisfy external regulatory reporting requirements
Limit IT spending growth year over year
Standardize performance expectations across all IT vendors

Correct answer: Provide a clear standard against which actual performance can be evaluated

Performance targets give governance bodies a benchmark to assess whether IT activities are delivering at the required level.

Question 33: IT integration governance PRIMARILY ensures that:

Vendors deliver systems independently of each other
Different IT systems work together seamlessly to deliver coherent business outcomes (Correct answer)
IT staff from different teams are merged into a single department
All IT systems use identical technology platforms

Correct answer: Different IT systems work together seamlessly to deliver coherent business outcomes

Integration governance ensures that disparate IT systems communicate and interoperate effectively so they collectively support business outcomes without silos.

Question 34: A 'current state architecture' assessment in CGEIT PRIMARILY helps governance to:

Create a new organizational chart for the IT department
Document all open IT incidents
Understand existing IT capabilities and identify gaps relative to strategic needs (Correct answer)
Negotiate better vendor pricing

Correct answer: Understand existing IT capabilities and identify gaps relative to strategic needs

Current state assessment gives governance a clear picture of what IT capabilities exist today so gaps against future strategic needs can be identified and planned for.

Question 35: A benefits realization plan PRIMARILY ensures that:

IT investments deliver intended business value over time (Correct answer)
IT budgets remain under projected costs
Technology upgrades are completed on schedule
Vendor contracts are renegotiated annually

Correct answer: IT investments deliver intended business value over time

A benefits realization plan tracks whether IT investments produce the intended business value throughout and after implementation.

Question 36: Which scenario BEST illustrates IT governance performance measurement working as intended?

All KPIs are green so the governance committee cancels its quarterly meeting
A KPI trend showing declining customer satisfaction triggers a governance review that leads to a corrective action plan (Correct answer)
Annual financial reports show IT costs are within budget
The IT department self-reports excellent performance with no independent verification

Correct answer: A KPI trend showing declining customer satisfaction triggers a governance review that leads to a corrective action plan

When a declining KPI triggers a structured governance review and corrective action, measurement is fulfilling its purpose of enabling proactive governance.

Question 37: A Key Performance Indicator (KPI) in IT governance MUST be:

Focused exclusively on IT cost reduction
Set by IT staff without business input
Easy to collect from any existing IT system
Specific, measurable, and directly linked to a governance objective (Correct answer)

Correct answer: Specific, measurable, and directly linked to a governance objective

A valid KPI must be specific and measurable, and it must connect directly to a governance objective so it reflects meaningful progress.

Question 38: Which metric BEST reflects the overall performance of an IT investment portfolio?

Total IT budget spent versus allocated
Number of new IT projects initiated per quarter
Percentage of portfolio investments achieving or exceeding their business case targets (Correct answer)
Average project delivery time in weeks

Correct answer: Percentage of portfolio investments achieving or exceeding their business case targets

The proportion of investments achieving their business case targets directly measures whether the portfolio is delivering the value it was funded to create.

Question 39: An organization supports both programs and projects for various industries. What is a portfolio?

A portfolio describes the organization of related projects, programs, and operations. (Correct answer)
A portfolio describes any project or program within one industry or application area.
A portfolio describes all of the monies that are invested in the organization.
A portfolio is the total amount of funds that have been invested in programs, projects, and operations.

Correct answer: A portfolio describes the organization of related projects, programs, and operations.

Explanation: In the context of project management and organizational management, a portfolio refers to a collection or grouping of related projects, programs, and operations that are managed as a group to achieve strategic objectives. A portfolio allows organizations to manage resources, risks, and priorities across a set of projects and programs to maximize benefits and achieve organizational goals.

Question 40: A 'governance heat map' is BEST used in stakeholder communication to:

Track individual employee performance
Map network infrastructure components
Document software licensing agreements
Visually display risk or performance status across IT domains (Correct answer)

Correct answer: Visually display risk or performance status across IT domains

A governance heat map uses color coding to communicate risk levels or performance status across governance domains in a format quickly understood by stakeholders.

Question 41: An IT governance board reviews an enterprise architecture roadmap PRIMARILY to ensure it:

Eliminates all legacy systems within one year
Uses the latest available technology in all areas
Supports the organization's strategic direction and investment priorities (Correct answer)
Matches the architecture of industry competitors

Correct answer: Supports the organization's strategic direction and investment priorities

The governance board reviews the EA roadmap to confirm that planned IT changes align with and enable the organization's strategic priorities.

Question 42: An organization's IT portfolio review reveals several projects with no defined success metrics. The FIRST corrective action should be:

Transfer portfolio oversight to the finance department
Cancel all projects lacking defined metrics immediately
Increase project budgets to include a metrics workstream
Establish benefit KPIs and assign benefits owners for each project (Correct answer)

Correct answer: Establish benefit KPIs and assign benefits owners for each project

Establishing KPIs and assigning benefits owners creates the accountability structure needed to track and realize benefits.

Question 43: An IT compliance audit PRIMARILY evaluates whether:

IT projects are delivered on time and within budget
IT controls and practices conform to required standards, regulations, or policies (Correct answer)
IT staff have completed mandatory training
IT vendors are meeting their contractual obligations

Correct answer: IT controls and practices conform to required standards, regulations, or policies

An IT compliance audit assesses whether the organization's IT controls and practices conform to the applicable legal, regulatory, and policy requirements.

Question 44: Which stakeholder mapping technique categorizes stakeholders by their level of power and interest?

Balanced Scorecard
Power-Interest Grid (Correct answer)
RACI Matrix
SWOT Analysis

Correct answer: Power-Interest Grid

The Power-Interest Grid maps stakeholders into quadrants based on their influence and interest level, guiding how much engagement effort to invest in each group.

Question 45: Which metric BEST demonstrates that IT benefits have been realized?

Improvement in a KPI directly linked to the business case (Correct answer)
Reduction in the number of help desk tickets
Increase in the IT department headcount
Completion of all project milestones on time

Correct answer: Improvement in a KPI directly linked to the business case

A KPI directly tied to the original business case provides direct evidence that the promised benefit has materialized.

Question 46: IT portfolio management in CGEIT PRIMARILY ensures that:

All IT projects are delivered on time and within scope
Only proven technologies are included in IT investments
The collective set of IT investments optimally supports business strategy (Correct answer)
IT spending is distributed equally across business units

Correct answer: The collective set of IT investments optimally supports business strategy

IT portfolio management takes a holistic view of all IT investments to ensure they collectively maximize strategic value rather than being managed in isolation.

Question 47: Which governance role is MOST responsible for maintaining the enterprise architecture within an organization?

Chief Architect or Enterprise Architecture function (Correct answer)
IT helpdesk management
External compliance auditor
Chief Financial Officer

Correct answer: Chief Architect or Enterprise Architecture function

The Chief Architect or Enterprise Architecture function owns the ongoing development, maintenance, and governance of the enterprise architecture.

Question 48: An IT governance framework requires that IT infrastructure investments be prioritized based on:

The preference of the CIO and IT architecture team
Technical complexity and novelty of the technology
Business impact, risk exposure, and alignment with strategic objectives (Correct answer)
Vendor discount levels and contractual incentives

Correct answer: Business impact, risk exposure, and alignment with strategic objectives

Infrastructure investments should be prioritized based on their business impact, risk profile, and strategic alignment to ensure optimal resource allocation.

Question 49: Which IT governance mechanism BEST prevents individual business units from making uncoordinated IT investments?

Giving each business unit its own IT budget and approval authority
A centralized IT investment governance process with mandatory portfolio review (Correct answer)
Delegating all IT spending decisions to external auditors
Requiring all IT projects to use the same software vendor

Correct answer: A centralized IT investment governance process with mandatory portfolio review

Centralized portfolio governance with mandatory review prevents duplicative, misaligned investments by coordinating IT spending across the enterprise.

Question 50: Benefits realization is MOST closely aligned with which CGEIT domain?

IT Resource Optimization
IT Risk Optimization
IT Governance Framework
IT Value Delivery (Correct answer)

Correct answer: IT Value Delivery

IT Value Delivery is the domain focused on ensuring that IT investments produce the intended benefits and business value.

Question 51: When balancing an IT investment portfolio, a governance board should PRIMARILY consider:

Strategic alignment, risk profile, expected return, and resource availability (Correct answer)
Individual project manager experience levels
Vendor market share and analyst rankings
Historical IT project success rates only

Correct answer: Strategic alignment, risk profile, expected return, and resource availability

Portfolio balance requires evaluating each investment's strategic fit, risk, expected return, and feasibility given available resources to optimize the total mix.

Question 52: An organization's IT governance framework should treat compliance MOST appropriately as:

The ultimate goal of IT governance efforts
An obstacle that limits IT innovation
A minimum baseline, with governance aiming to deliver additional value beyond compliance (Correct answer)
A task solely delegated to the legal department

Correct answer: A minimum baseline, with governance aiming to deliver additional value beyond compliance

Compliance represents the floor, not the ceiling — good IT governance meets compliance requirements while also driving value creation and strategic alignment.

Question 53: When an organization adopts a cloud-first strategy, its enterprise architecture governance MOST needs to address:

Elimination of all internal IT staff
Security, data sovereignty, vendor dependency, and integration with on-premise systems (Correct answer)
Reduction of governance committee membership
Replacement of COBIT with a cloud-specific framework

Correct answer: Security, data sovereignty, vendor dependency, and integration with on-premise systems

Cloud adoption introduces new governance challenges around data control, regulatory compliance, vendor lock-in, and integration that EA governance must explicitly address.

Question 54: Which practice BEST ensures IT governance metrics remain relevant over time?

Adding more metrics each year to increase coverage
Delegating metric selection entirely to the IT department
Keeping the same metrics indefinitely for trend comparison
Periodically reviewing and updating metrics to reflect changes in business strategy (Correct answer)

Correct answer: Periodically reviewing and updating metrics to reflect changes in business strategy

As business strategy evolves, governance metrics must be reviewed and updated to ensure they continue measuring what matters most to the organization.

Question 55: An IT investment review board wants to ensure that IT will be able to support business initiatives. Each initiative is comprised of several interrelated IT projects. Which of the following would help ensure that the initiatives meet their goals?

Review of the business case for each initiative
Verification of initiatives against the architecture
Establishment of portfolio management (Correct answer)
Review of project management methodology

Correct answer: Establishment of portfolio management

Explanation: Portfolio management involves managing a collection of projects and initiatives as a portfolio to achieve strategic objectives. It helps ensure that each initiative aligns with business goals and objectives by providing oversight, prioritization, and resource allocation across interrelated IT projects. This approach enables the IT investment review board to effectively support business initiatives by coordinating efforts, managing risks, and optimizing resource utilization across the portfolio of initiatives.

Question 56: In CGEIT, the MAIN reason IT governance requires an enterprise architecture capability is to:

Outsource architecture design to external consultants
Reduce the authority of IT leadership in business decisions
Ensure IT decisions are made with a complete, integrated view of the organization (Correct answer)
Select the cheapest available technology solutions

Correct answer: Ensure IT decisions are made with a complete, integrated view of the organization

EA gives governance bodies the holistic view of IT and business connections needed to make well-informed, integrated decisions rather than siloed ones.

Question 57: Which phase of the investment lifecycle is MOST critical for setting up successful benefits realization?

Business case development and approval (Correct answer)
User acceptance testing
Solution design and architecture
Post-deployment support

Correct answer: Business case development and approval

Benefits realization success depends on correctly defining and committing to expected outcomes during business case development before the investment begins.

Question 58: In IT governance, 'compliance' PRIMARILY refers to:

Adherence to laws, regulations, standards, and internal policies applicable to IT (Correct answer)
Completing all IT projects on schedule
Maintaining uptime above a defined threshold
Achieving the lowest possible IT operational cost

Correct answer: Adherence to laws, regulations, standards, and internal policies applicable to IT

IT compliance means conforming to the external regulatory requirements and internal policies that govern how IT systems and data must be managed.

Question 59: The concept of 'IT assurance' BEST refers to:

Guarantees provided by IT vendors in service contracts
IT staff confidence in system performance
Automated monitoring of network uptime
Independent validation that IT controls are operating effectively and reliably (Correct answer)

Correct answer: Independent validation that IT controls are operating effectively and reliably

IT assurance is an independent evaluation that gives stakeholders confidence that IT controls are operating as intended and are reliable.

Question 60: An IT governance assurance review MOST commonly results in:

Suspension of all IT projects during the review period
Transfer of control ownership to the audit committee
An immediate system shutdown if any gaps are found
A report rating control effectiveness and recommending improvements (Correct answer)

Correct answer: A report rating control effectiveness and recommending improvements

Assurance reviews produce a rated assessment of how well controls are operating and prioritized recommendations for strengthening governance.

Question 61: When realized benefits fall short of expectations, the BEST governance response is to:

Close the project and move to the next investment
Transfer accountability to the IT department
Conduct a root cause analysis and adjust the realization approach (Correct answer)
Reduce the benefit targets retroactively

Correct answer: Conduct a root cause analysis and adjust the realization approach

A root cause analysis identifies why benefits were not fully realized and informs corrective action to recover or adjust the approach.

Question 62: In which of the following editions of COBIT was "Management Guidelines" added?

The fourth edition
The first edition
The second edition (Correct answer)
The third edition

Correct answer: The second edition

Explanation: Management Guidelines were added in the second edition of COBIT (Control Objectives for Information and Related Technologies). This addition enhanced the framework by providing detailed guidance and management practices for implementing the control objectives outlined in COBIT.

Question 63: In CGEIT, 'IT value delivery' encompasses which of the following?

Managing vendor relationships for optimal pricing
Defining, delivering, measuring, and sustaining the benefits of IT investments over their lifecycle (Correct answer)
Ensuring all IT infrastructure is current and up to date
Completing all IT projects before their deadlines

Correct answer: Defining, delivering, measuring, and sustaining the benefits of IT investments over their lifecycle

IT value delivery in CGEIT covers the full lifecycle — defining what value looks like, delivering it through IT, measuring whether it arrived, and sustaining it over time.

Question 64: An IT governance dashboard is MOST valuable when it:

Lists all open IT projects with their technical specifications
Tracks individual employee productivity metrics
Documents compliance with specific IT standards
Presents real-time KPIs that support executive decision-making (Correct answer)

Correct answer: Presents real-time KPIs that support executive decision-making

A governance dashboard's value is in providing current, relevant KPIs in a format that allows executives to make timely, informed governance decisions.

Question 65: Which IT governance body is MOST responsible for making IT portfolio investment decisions?

The IT help desk leadership team
IT Investment Committee or IT Steering Committee (Correct answer)
Individual project managers
External IT consultants

Correct answer: IT Investment Committee or IT Steering Committee

The IT Investment or Steering Committee provides governance-level oversight of IT investments, balancing risk, value, and strategic alignment across the portfolio.

Question 66: Which CGEIT concept BEST describes the practice of comparing IT governance performance against industry peers?

Baselining
Benchmarking (Correct answer)
Variance analysis
Capability assessment

Correct answer: Benchmarking

Benchmarking compares an organization's IT governance performance metrics against industry peers or best practices to identify gaps and improvement targets.

Question 67: In CGEIT, an enterprise architecture gap analysis PRIMARILY identifies:

Differences between two competing IT vendors
Employee skill shortages in the IT department
The differences between current IT capabilities and what is needed to achieve future business goals (Correct answer)
Budget overruns in active IT projects

Correct answer: The differences between current IT capabilities and what is needed to achieve future business goals

A gap analysis compares the current IT capability state to the future target state required by business strategy, identifying what must be built, changed, or retired.

Question 68: Which statement BEST describes the relationship between IT governance and benefits realization?

IT governance creates the accountability structures that ensure benefits are planned, tracked, and achieved (Correct answer)
IT governance eliminates the need for a formal benefits realization process
IT governance focuses only on technical delivery timelines
Benefits realization is exclusively a finance function, separate from governance

Correct answer: IT governance creates the accountability structures that ensure benefits are planned, tracked, and achieved

IT governance provides the oversight, accountability, and decision-making structures that make benefits realization systematic and enforceable.

Question 69: A CGEIT candidate identifies that IT governance decisions are being made without input from business unit leaders. This MOST likely results in:

Faster IT project delivery timelines
IT investments misaligned with actual business needs (Correct answer)
Lower IT operational costs
Reduced compliance exposure

Correct answer: IT investments misaligned with actual business needs

Excluding business unit leaders from IT governance decisions leads to misalignment between IT investments and the actual needs of the business.

Question 70: A newly established IT steering committee is concerned whether or not a system is meeting availability objectives. Which of the following will provide the BEST information to make an assessment?

Performance indicators
Capability maturity levels (Correct answer)
Critical success factors
Balanced scorecard

Correct answer: Capability maturity levels

Explanation: Capability maturity levels, such as those defined in models like CMMI (Capability Maturity Model Integration), assess the maturity and effectiveness of an organization's processes, including those related to system availability. By evaluating the maturity level of processes related to system availability management, the IT steering committee can gain insights into how well the organization's practices align with best practices and standards. This assessment helps in understanding the organization's capability to consistently meet availability objectives over time.

Question 71: A benefit that reduces manual processing time by 30% is an example of:

An intangible strategic benefit
A compliance-driven benefit
A tangible, measurable efficiency benefit (Correct answer)
A vendor-reported performance gain

Correct answer: A tangible, measurable efficiency benefit

A 30% reduction in processing time is a concrete, quantifiable efficiency benefit that can be verified against baseline data.

Question 72: Which technique BEST helps an organization prioritize IT investments based on expected benefits?

Lowest total cost of ownership comparison
Business case analysis with weighted benefit scoring (Correct answer)
First-come, first-served project intake
Technology trend benchmarking against competitors

Correct answer: Business case analysis with weighted benefit scoring

Business case analysis with weighted benefit scoring objectively compares investments based on their expected contribution to strategic goals.

Question 73: A stakeholder communication plan in IT governance PRIMARILY serves to:

Document all IT system changes for audit purposes
Minimize the number of governance meetings held
Ensure the right information reaches the right stakeholders at the right time (Correct answer)
Track vendor deliverables against contract terms

Correct answer: Ensure the right information reaches the right stakeholders at the right time

A communication plan systematically ensures stakeholders receive timely, relevant information that supports informed governance decisions and engagement.

Question 74: A third-party SOC 2 report PRIMARILY provides assurance about a service provider's:

Physical data center locations
Controls over security, availability, processing integrity, confidentiality, and privacy (Correct answer)
Financial performance and profitability
Staff qualifications and training certifications

Correct answer: Controls over security, availability, processing integrity, confidentiality, and privacy

A SOC 2 report provides independent assurance that a service provider's controls meet the Trust Services Criteria covering security, availability, and related principles.

Question 75: When developing an IT sourcing strategy, a governance board should PRIMARILY consider:

Current industry trends in IT outsourcing
The preference of the IT department head
The lowest available market price for IT services
The strategic importance of capabilities and associated risks of each sourcing option (Correct answer)

Correct answer: The strategic importance of capabilities and associated risks of each sourcing option

Governance boards must evaluate strategic importance and risk of sourcing options to make decisions that support long-term enterprise objectives.

Question 76: An organization's enterprise architecture lacks data architecture documentation. The MOST likely governance risk is:

Failure to meet software delivery timelines
Excessive IT infrastructure costs
Data silos, inconsistent data quality, and poor decision-making across business units (Correct answer)
Increased vendor negotiation complexity

Correct answer: Data silos, inconsistent data quality, and poor decision-making across business units

Without data architecture, organizations lack standards for how data is defined, stored, and shared, leading to silos and inconsistent data that undermines governance decisions.

Question 77: Which of the following should be the PRIMARY consideration for an enterprise when prioritizing IT projects?

Impact on the business due to expected project outcomes (Correct answer)
Process owner expectations based on operational benefits
Technical capability of the enterprise to execute the projects
Results of IT performance benchmarks against competitors

Correct answer: Impact on the business due to expected project outcomes

Explanation: This choice emphasizes the importance of aligning IT projects with business objectives and ensuring that the expected outcomes contribute significantly to business goals and priorities. While all options are relevant factors in project prioritization, the impact on the business is typically the most critical factor as it directly ties project investments to business value and strategic objectives.

Question 78: A 'control deficiency' identified during an IT audit MOST requires:

Immediate shutdown of the affected IT system
Public disclosure to all stakeholders
Transfer of responsibility to an external vendor
A documented remediation plan with assigned ownership and target dates (Correct answer)

Correct answer: A documented remediation plan with assigned ownership and target dates

A control deficiency requires a remediation plan with clear ownership and deadlines so the gap in controls is systematically closed.

Question 79: Which stakeholder group is MOST critical to engage when defining IT governance principles?

Board of directors and senior executive leadership (Correct answer)
IT help desk staff
External software vendors
End users of business applications

Correct answer: Board of directors and senior executive leadership

The board and senior executives set organizational direction and must own IT governance principles for them to carry authority and alignment with strategy.

Question 80: An IT Governance Maturity Model (such as COBIT's PAM) rates governance processes on a scale that MOST commonly ranges from:

D (Failing) to A+ (Excellent)
1 (Low) to 10 (High)
0 (Incomplete) to 5 (Optimizing) (Correct answer)
Basic to Advanced to Expert

Correct answer: 0 (Incomplete) to 5 (Optimizing)

COBIT's Process Assessment Model and similar frameworks rate governance maturity from 0 (incomplete/ad hoc) to 5 (continuously optimizing).

Question 81: Which standard is MOST commonly used as a framework for IT controls assurance in US organizations?

COBIT (Control Objectives for Information and Related Technologies) (Correct answer)
TOGAF (The Open Group Architecture Framework)
PMBOK (Project Management Body of Knowledge)
ITIL (IT Infrastructure Library)

Correct answer: COBIT (Control Objectives for Information and Related Technologies)

COBIT is the primary globally recognized framework for IT governance and control objectives, widely used for assurance and compliance assessments in US organizations.

Question 82: Which type of metric measures outcomes rather than activities in IT governance?

Lagging indicator (Correct answer)
Input metric
Activity metric
Leading indicator

Correct answer: Lagging indicator

Lagging indicators measure outcomes that have already occurred, such as business value realized, making them direct evidence of governance results.

Question 83: Which document BEST formalizes the expectations and responsibilities between an enterprise and an external IT service provider?

IT strategic plan
IT budget forecast
Risk register
Service Level Agreement (SLA) (Correct answer)

Correct answer: Service Level Agreement (SLA)

A Service Level Agreement formally defines performance expectations, responsibilities, and accountability measures between the enterprise and its IT service providers.

Question 84: When an enterprise transitions an IT function from in-house to a managed service provider, the governance board is MOST responsible for:

Overseeing the transition to ensure strategic alignment and risk management (Correct answer)
Negotiating individual contract clauses with the provider
Managing day-to-day operations of the outsourced function
Selecting the specific technology platform to be used

Correct answer: Overseeing the transition to ensure strategic alignment and risk management

The governance board oversees the transition at a strategic level, ensuring it aligns with enterprise goals and that risks are properly managed.

Question 85: An IT governance framework's effectiveness is BEST measured by:

The number of governance policies published
Vendor contract renewal rates
Reduction in IT department headcount
Stakeholder satisfaction and achievement of IT-business alignment outcomes (Correct answer)

Correct answer: Stakeholder satisfaction and achievement of IT-business alignment outcomes

Governance effectiveness is ultimately demonstrated through stakeholder satisfaction and whether IT and business goals are actually aligned and achieved.

Question 86: Which enterprise architecture domain governs the technical infrastructure that supports IT applications?

Application Architecture
Technology Architecture (Correct answer)
Data Architecture
Business Architecture

Correct answer: Technology Architecture

Technology Architecture covers the hardware, network, and infrastructure components that host and support business applications.

Question 87: An IT governance committee consistently has poor attendance from business leaders. The MOST effective remedy is to:

Replace absent business leaders with IT staff
Reduce meeting frequency to annual sessions
Move all governance decisions to email approval
Redesign meeting agendas to focus on business-relevant decisions and value (Correct answer)

Correct answer: Redesign meeting agendas to focus on business-relevant decisions and value

Business leaders attend when meetings are relevant to them — aligning governance agendas to business decisions increases meaningful participation.

Question 88: The MAIN benefit of an IT portfolio 'heat map' showing risk versus return is that it:

Enables governance bodies to visually identify investments to prioritize, monitor, or exit (Correct answer)
Measures employee satisfaction with IT services
Calculates the exact financial return of each IT investment
Documents technical specifications for all IT projects

Correct answer: Enables governance bodies to visually identify investments to prioritize, monitor, or exit

A risk-return heat map gives governance a visual tool to quickly assess which investments warrant more attention, accelerated pursuit, or discontinuation.

Question 89: When legacy system replacement is being considered, enterprise architecture governance MOST helps by:

Selecting the replacement system based solely on vendor reputation
Delegating the replacement decision entirely to the IT department
Assessing dependencies, integration impacts, and alignment with the target architecture before a decision is made (Correct answer)
Mandating immediate replacement of all systems older than 10 years

Correct answer: Assessing dependencies, integration impacts, and alignment with the target architecture before a decision is made

EA governance ensures replacement decisions are informed by a clear understanding of system dependencies, integration requirements, and future architectural direction.

Question 90: Integration middleware in enterprise IT architecture MOST supports governance by:

Enabling controlled, monitored data exchange between disparate systems (Correct answer)
Replacing the need for an enterprise architecture strategy
Reducing the number of business applications in use
Eliminating the need for data governance policies

Correct answer: Enabling controlled, monitored data exchange between disparate systems

Integration middleware provides governed, standardized pathways for systems to exchange data, enabling visibility and control over how information flows across the enterprise.

Question 91: An IT governance scorecard shows strong financial performance but declining stakeholder satisfaction. The governance board should PRIMARILY focus on:

Investigating and addressing the root causes of stakeholder dissatisfaction (Correct answer)
Reducing IT spending to improve stakeholder perceptions
Replacing the stakeholder satisfaction measurement with a financial metric
Continuing current practices since financial results are strong

Correct answer: Investigating and addressing the root causes of stakeholder dissatisfaction

Stakeholder dissatisfaction is a leading indicator of future governance failure — it must be investigated even when financial results are positive.

Question 92: A 'compliance risk' in IT governance BEST refers to:

The risk that IT staff will leave the organization
The risk that IT projects will exceed their budgets
The risk of choosing the wrong enterprise software platform
The risk of failing to meet legal, regulatory, or policy obligations related to IT (Correct answer)

Correct answer: The risk of failing to meet legal, regulatory, or policy obligations related to IT

Compliance risk is the exposure to legal penalties, reputational harm, or operational disruption resulting from failure to meet applicable IT-related obligations.

Question 93: Which practice BEST demonstrates effective IT value delivery governance?

Delegating investment decisions to individual project managers
Approving all projects submitted by the IT department
Measuring success solely by project delivery speed
Stage-gate reviews that confirm business value at each major phase before proceeding (Correct answer)

Correct answer: Stage-gate reviews that confirm business value at each major phase before proceeding

Stage-gate reviews create checkpoints where governance confirms that value is on track before committing further investment, preventing value erosion.

Question 94: Which of the following examples are included in the general controls embedded in IT processes and services? Each correct answer represents a complete solution.

Completeness
Systems development (Correct answer)
Accuracy
Change management (Correct answer)

Correct answer: Systems development

Explanation: General controls embedded in IT processes and services typically include: - Change management: This involves processes and procedures for managing changes to IT systems, applications, and infrastructure. Change management ensures that changes are documented, assessed for impact, tested, and implemented in a controlled manner to maintain the integrity and reliability of IT services. - Systems development: This encompasses the processes and methodologies used for developing, maintaining, and enhancing IT systems and applications. It includes activities such as requirements gathering, design, coding, testing, deployment, and maintenance of software systems.

Question 95: A large enterprise has been experiencing a high turnover of skilled IT personnel, resulting in a significant loss of knowledge within the IT department. Which of the following should be done FIRST to address this problem?

Conduct a survey of current IT staff. (Correct answer)
Develop an incentive scheme for IT employees.
Update human resources policies and practices.
Revise the IT resource management plan.

Correct answer: Conduct a survey of current IT staff.

Explanation: Conducting a survey of current IT staff will help gather insights into the reasons for turnover, understand their concerns, and identify areas where improvements are needed. This step is crucial for diagnosing the root causes of the turnover problem and informing subsequent actions effectively.

Question 96: While assessing the feasibility of introducing new IT practices and standards into the IT governance framework, it is CRITICAL to understand an organization's:

enterprise architecture. (Correct answer)
culture.
maturity of IT processes.
level of outsourcing.

Correct answer: enterprise architecture.

Explanation: Understanding an organization's enterprise architecture is indeed crucial when assessing the feasibility of introducing new IT practices and standards. Enterprise architecture provides a structured approach to aligning IT capabilities with business goals and requirements. It includes aspects such as the current IT infrastructure, systems, applications, data flows, and integration points across the organization. This understanding helps in evaluating how new IT practices and standards can be integrated into the existing architecture, identifying potential impacts, dependencies, and areas needing adaptation or enhancement.

Question 97: HIPAA compliance MOST directly impacts IT governance in organizations that handle:

Protected health information (PHI) stored or transmitted electronically (Correct answer)
Financial transaction data for public companies
Consumer credit reporting data
Federal government classified data

Correct answer: Protected health information (PHI) stored or transmitted electronically

HIPAA's Security Rule specifically governs IT controls over electronic protected health information, requiring encryption, access controls, and audit trails.

Question 98: A newly appointed CIO has issued a new IT strategic plan. Which of the following would be the MOST effective way for the CIO to ensure the IT management team is held accountable for the delivery of the plan?

Update the IT balanced scorecard with key objectives.
Revise the managers' performance goals to include key objectives. (Correct answer)
Enforce disciplinary action for managers if the plan is not delivered.
Provide management training on IT strategic objectives.

Correct answer: Revise the managers' performance goals to include key objectives.

Explanation: By revising the managers' performance goals to include key objectives from the IT strategic plan, the CIO directly ties individual accountability to the achievement of strategic goals. This approach aligns the efforts of the IT management team with the overarching strategic direction of the organization, making it clear what is expected from each manager in terms of delivering specific outcomes outlined in the plan. It provides a structured framework for measuring performance and progress towards strategic objectives.

Question 99: Which of the following is the BEST outcome measure to determine the effectiveness of IT risk management processes?

Number of events impacting business processes due to delays in responding to risks
Frequency of updates to the IT risk register
Time lag between when IT risk is identified and the enterprise's response (Correct answer)
Percentage of business users satisfied with the quality of risk training

Correct answer: Time lag between when IT risk is identified and the enterprise's response

Explanation: This measure is crucial because it assesses the efficiency and effectiveness of the IT risk management process in addressing identified risks promptly. A shorter time lag indicates that risks are being promptly identified, assessed, and responded to, minimizing potential negative impacts on the organization. It reflects how well the organization can detect and react to risks before they escalate into issues that could affect business operations.

Question 100: A company implements a new ERP system but sees no improvement in operational efficiency. The MOST likely governance failure is:

The ERP vendor was not experienced enough
No benefits realization plan was established before deployment (Correct answer)
The project exceeded its original budget
The IT team lacked sufficient training

Correct answer: No benefits realization plan was established before deployment

Without a benefits realization plan, there is no structured approach to tracking and capturing the efficiency gains the investment was meant to deliver.

Question 101: Which of the following objectives can be the best coordinated with Human Resource Management?

Focusing on business improvements
Satisfying the business needs (Correct answer)
Increasing the automation of the business processes
Rewarding employee fairly

Correct answer: Satisfying the business needs

Explanation: Satisfying the business needs is considered the best objective that can be coordinated with Human Resource Management (HRM), as it emphasizes the strategic alignment of HR practices with organizational objectives and operational requirements.

Question 102: IT governance performance measurement MOST supports which COBIT principle?

Separating IT management from business operations
Standardizing all IT procurement processes
Centralizing IT decision-making authority
Meeting stakeholder needs through the delivery of measurable value (Correct answer)

Correct answer: Meeting stakeholder needs through the delivery of measurable value

COBIT's core principle of meeting stakeholder needs is directly supported by performance measurement, which verifies that IT is delivering the value stakeholders require.

Question 103: In benefits realization management, a 'benefits owner' is BEST described as:

An IT lead who manages deployment timelines
A business manager responsible for achieving a specific benefit (Correct answer)
A vendor representative who delivers the solution
A finance analyst who tracks project spend

Correct answer: A business manager responsible for achieving a specific benefit

A benefits owner is a named business manager accountable for ensuring a specific benefit is achieved after implementation.

Question 104: When presenting IT governance results to a board of directors, the MOST appropriate format is:

Detailed technical architecture diagrams
Executive dashboard with KPIs, risks, and decisions required (Correct answer)
Vendor contract summaries
Line-by-line project budget spreadsheets

Correct answer: Executive dashboard with KPIs, risks, and decisions required

Boards need concise, strategic information including KPIs, key risks, and decisions they must make — not operational or technical detail.

Question 105: A CGEIT practitioner discovers that IT governance decisions are not being cascaded to operational teams. The BEST corrective action is to:

Increase the number of governance committee meetings
Establish a structured communication cascade from governance bodies to operational levels (Correct answer)
Outsource governance communication to a vendor
Restrict governance information to committee members only

Correct answer: Establish a structured communication cascade from governance bodies to operational levels

A communication cascade ensures governance decisions are translated and communicated down to the operational teams who must act on them.

Question 106: The BEST way for a CIO to monitor the alignment between the business and IT strategy is to regularly review:

IT services supporting business processes. (Correct answer)
key risk indicators (KRIs).
the risk register.
the balanced scorecard.

Correct answer: IT services supporting business processes.

Explanation: Regularly reviewing IT services that support business processes allows the CIO to directly assess how well IT operations and services are aligned with the needs and objectives of the business. This includes evaluating whether IT services are effectively enabling and enhancing business processes, contributing to operational efficiency, and supporting strategic goals. By monitoring this alignment, the CIO can identify areas where IT services may need to be adjusted or improved to better align with evolving business priorities.

Question 107: Following a major IT incident that resulted in a loss to the enterprise, a CIO is preparing for a meeting with the board of directors to discuss what may have failed internally. Which of the following should the CIO do FIRST to provide assurance to the board?

Review the IT control environment.
Verify continuous monitoring is being performed.
Review the incident response policy.
Ensure IT and enterprise risk management alignment. (Correct answer)

Correct answer: Ensure IT and enterprise risk management alignment.

Explanation: Ensuring alignment between IT and enterprise risk management is critical because it demonstrates that the organization's IT risks are being managed in line with broader enterprise risk management objectives. This includes assessing how the incident occurred in relation to overall risk management strategies, identifying any gaps or inconsistencies, and ensuring that future risk mitigation efforts are aligned with enterprise goals. By establishing this alignment, the CIO can provide the board with assurance that IT risks are being managed comprehensively and that measures are in place to prevent similar incidents from occurring in the future.

Question 108: Which document is the PRIMARY reference point for assessing whether IT benefits have been achieved?

IT budget variance report
Project status reports
Vendor service level agreement
Original approved business case (Correct answer)

Correct answer: Original approved business case

The original approved business case contains the benefit commitments against which actual outcomes are measured.

Question 109: IT value delivery governance MOST requires that business cases include:

Vendor qualifications and pricing comparisons
Clearly defined benefits, costs, risks, and success metrics before approval (Correct answer)
Historical data from similar projects at competitor organizations
Only technical specifications and delivery timelines

Correct answer: Clearly defined benefits, costs, risks, and success metrics before approval

A complete business case with benefits, costs, risks, and success metrics gives governance bodies the information needed to make informed investment decisions.

Question 110: Which control type BEST prevents unauthorized access to sensitive IT systems in a compliance context?

Preventive control (e.g., role-based access control) (Correct answer)
Corrective control (e.g., incident response plan)
Compensating control (e.g., manual approval process)
Detective control (e.g., access log review)

Correct answer: Preventive control (e.g., role-based access control)

Preventive controls like role-based access control stop unauthorized access from occurring in the first place, which is the most effective compliance posture.

Question 111: Which IT resource management practice best ensures that human capital investments align with enterprise IT governance objectives?

Outsourcing all IT functions to reduce overhead costs
Aligning IT workforce planning with strategic business goals and governance frameworks (Correct answer)
Hiring IT staff based solely on technical certifications
Limiting IT training to job-specific technical skills only

Correct answer: Aligning IT workforce planning with strategic business goals and governance frameworks

Aligning IT workforce planning with strategic business goals ensures that human capital decisions support governance objectives and organizational value.

Question 112: The PRIMARY difference between IT compliance and IT assurance is that assurance:

Replaces the need for formal compliance programs
Is performed exclusively by internal staff rather than external parties
Provides independent confidence that controls are effective, beyond just checking conformance (Correct answer)
Focuses only on technical security controls

Correct answer: Provides independent confidence that controls are effective, beyond just checking conformance

Assurance goes beyond verifying that rules are followed; it independently validates that controls actually work and that stakeholders can rely on them.

Question 113: A business has outsourced IT operations to several third-party providers, but service level agreements (SLAs) are not clearly defined in all cases. Which of the following is the GREATEST risk to the business?

Costs are not measurable.
The scope of work is not clearly defined.
Third parties could provide overlapping services.
Quality of services is not enforceable. (Correct answer)

Correct answer: Quality of services is not enforceable.

Explanation: Without clearly defined SLAs, the business lacks a formal agreement specifying the expected level of service quality, performance metrics, and remedies for failure to meet these standards. This ambiguity can lead to inconsistent service delivery, disputes over service quality, and difficulties in holding the third-party providers accountable.

Question 114: A 'leading indicator' in IT governance performance measurement BEST helps to:

Report historical IT spending trends
Audit completed IT projects for compliance
Predict future governance outcomes so corrective action can be taken proactively (Correct answer)
Compare actual costs to vendor quotes

Correct answer: Predict future governance outcomes so corrective action can be taken proactively

Leading indicators signal future performance, allowing governance bodies to intervene before problems fully materialize.

Question 115: Stakeholder resistance to IT governance initiatives MOST often stems from:

Lack of clear communication about the purpose and benefits of governance (Correct answer)
Overly complex technology selections
Insufficient IT budget allocation
Inadequate vendor support contracts

Correct answer: Lack of clear communication about the purpose and benefits of governance

When stakeholders don't understand why governance exists or how it benefits them, resistance is a natural response to perceived bureaucracy.

Question 116: Which IT governance practice BEST demonstrates proactive compliance management?

Conducting compliance assessments every three years
Delegating all compliance responsibilities to IT staff
Continuously monitoring regulatory changes and updating controls before deadlines (Correct answer)
Responding to compliance findings only after an external audit

Correct answer: Continuously monitoring regulatory changes and updating controls before deadlines

Proactive compliance management means staying ahead of regulatory changes and updating controls before requirements take effect, not reacting after audits.

Question 117: Which EA framework is MOST widely recognized in US enterprises for structuring IT governance architecture?

ITIL v4
PMBOK
TOGAF (The Open Group Architecture Framework) (Correct answer)
Six Sigma

Correct answer: TOGAF (The Open Group Architecture Framework)

TOGAF is the most widely adopted enterprise architecture framework globally, providing a structured approach to designing and governing IT architecture.

Question 118: A governance committee discovers that 40% of the IT portfolio is unaligned with current business strategy. The BEST immediate action is to:

Hire additional IT staff to accelerate all existing projects
Conduct a strategic portfolio review and realign or exit misaligned investments (Correct answer)
Continue all investments since they are already funded
Transfer the misaligned investments to a separate budget

Correct answer: Conduct a strategic portfolio review and realign or exit misaligned investments

A strategic portfolio review is required to assess each misaligned investment and decide whether to re-align, deprioritize, or exit, freeing resources for strategic work.

Question 119: Which of the following is PRIMARILY achieved through performance measurement?

Benefit realization
Transparency
Process improvement (Correct answer)
Cost efficiency

Correct answer: Process improvement

Explanation: Performance measurement allows organizations to assess the effectiveness and efficiency of their processes. By measuring key performance indicators (KPIs), organizations can identify areas where processes can be optimized, streamlined, or redesigned to improve efficiency, reduce waste, and enhance overall effectiveness. Process improvement is directly facilitated by performance measurement because it provides the data and insights necessary to identify areas for improvement and track progress over time.

Question 120: An enterprise's board of directors can BEST manage enterprise risk by:

requiring the establishment of an enterprise risk management (ERM) framework. (Correct answer)
mandating board-approved enterprise risk management (ERM) modifications.
ensuring the cost-effectiveness of the internal control system.
requiring the establishment of an enterprise-wide program management office.

Correct answer: requiring the establishment of an enterprise risk management (ERM) framework.

Explanation: Establishing an enterprise risk management (ERM) framework enables the board of directors to systematically identify, assess, manage, and monitor risks across the organization. This approach helps in aligning risk management practices with strategic objectives and ensures comprehensive oversight of risks affecting the enterprise.

Question 121: Which US regulation MOST directly requires IT governance controls over financial reporting systems?

Sarbanes-Oxley Act (SOX) (Correct answer)
General Data Protection Regulation (GDPR)
Health Insurance Portability and Accountability Act (HIPAA)
Federal Information Security Management Act (FISMA)

Correct answer: Sarbanes-Oxley Act (SOX)

SOX Section 404 requires organizations to establish and certify internal controls over financial reporting, including IT systems that support those reports.

Question 122: In a successful enterprise that is profitable in its marketplace and consistently growing in size, the non-IT workforce has grown by 50% in the last two years. The demand for IT staff in the marketplace is more than the supply, and the enterprise is losing staff to rival organizations. Due to the rapid growth, IT has struggled to keep up with the enterprise, and IT procedures and associated job roles are not well-defined. The MOST critical activity for reducing the impact caused by IT staff turnover is to:

outsource the IT operation.
document processes and procedures. (Correct answer)
increase compensation for IT staff.
hire temporary staff.

Correct answer: document processes and procedures.

Explanation: Documenting processes and procedures is crucial because it ensures that knowledge is captured and transferred effectively within the IT department. This documentation helps new hires understand their roles, responsibilities, and how tasks should be performed, thereby reducing the learning curve and minimizing the disruption caused by turnover.

Question 123: An IT governance board wants to improve benefits tracking. Which tool is MOST appropriate?

IT incident management system
Vendor performance dashboard
Network monitoring platform
Benefits realization register with periodic status updates (Correct answer)

Correct answer: Benefits realization register with periodic status updates

A benefits realization register provides a structured record of expected benefits, owners, timelines, and actual results for periodic review.

Question 124: Which CGEIT concept describes the governance practice of regularly reviewing the IT investment portfolio against changing business priorities?

Portfolio rebalancing (Correct answer)
Vendor contract renegotiation
Project scope creep management
IT change freeze

Correct answer: Portfolio rebalancing

Portfolio rebalancing is the practice of periodically adjusting the mix of IT investments to reflect shifts in business strategy, emerging risks, or changing value expectations.

Question 125: The PRIMARY reason IT value delivery governance requires executive sponsorship is that:

External auditors require executive signoff on all IT deliverables
Technology vendors insist on executive-level contract approval
Business outcomes require business authority to drive organizational changes beyond IT (Correct answer)
IT cannot manage its own projects without executive oversight

Correct answer: Business outcomes require business authority to drive organizational changes beyond IT

Realizing IT value often requires organizational changes — process redesign, behavior change, adoption — that only business executives have the authority to drive.

Question 126: Which approach BEST supports ongoing stakeholder engagement in IT governance?

Limiting governance communication to annual board reports
Regular governance forums with structured reporting and feedback mechanisms (Correct answer)
Delegating all stakeholder communication to the IT helpdesk
Sending quarterly email updates without response options

Correct answer: Regular governance forums with structured reporting and feedback mechanisms

Regular forums with structured reporting and feedback create two-way engagement, keeping stakeholders informed and enabling them to influence governance.

Question 127: When a new regulation affecting IT data retention is enacted, the FIRST governance action should be to:

Wait for an external audit to identify specific gaps
Assess the regulation's impact on existing IT controls and data management practices (Correct answer)
Immediately rebuild all data storage systems
Delegate compliance entirely to the legal department

Correct answer: Assess the regulation's impact on existing IT controls and data management practices

Impact assessment identifies which systems, data, and controls are affected by the new regulation so governance can plan a targeted and timely response.

Question 128: A 'RACI matrix' in IT governance is PRIMARILY used to:

Clarify who is Responsible, Accountable, Consulted, and Informed for governance activities (Correct answer)
Document the technical architecture of IT systems
Schedule IT maintenance windows
Rank IT projects by return on investment

Correct answer: Clarify who is Responsible, Accountable, Consulted, and Informed for governance activities

A RACI matrix defines roles and responsibilities for governance activities, preventing confusion about who makes decisions versus who provides input.

Question 129: An IT governance portfolio review identifies several projects with low strategic value and high resource consumption. The BEST governance action is to:

Add more resources to accelerate the low-value projects
Continue all projects to avoid disrupting team commitments
Terminate or deprioritize those projects to reallocate resources to higher-value investments (Correct answer)
Transfer those projects to an external vendor

Correct answer: Terminate or deprioritize those projects to reallocate resources to higher-value investments

Good portfolio governance actively reallocates resources from low-value investments to higher-priority ones to maximize overall strategic return.

Question 130: Who holds ULTIMATE accountability for benefits realization in CGEIT governance?

Business sponsor or executive owner (Correct answer)
IT architect
Project manager
External auditor

Correct answer: Business sponsor or executive owner

The business sponsor or executive owner is ultimately accountable because they authorized the investment and are responsible for the business outcomes.

Question 131: Which CGEIT principle supports ongoing benefits realization after project closure?

Transferring governance to the IT helpdesk
Post-implementation review linked to business case KPIs (Correct answer)
Archiving all project documentation
Immediate reassignment of project resources

Correct answer: Post-implementation review linked to business case KPIs

Post-implementation reviews measure actual outcomes against the business case KPIs, confirming whether benefits have been realized.

Question 132: An organization measures IT governance effectiveness solely through financial metrics. The PRIMARY risk is:

Overspending on IT governance reporting tools
Aligning too closely with external audit requirements
Missing critical performance dimensions such as risk, customer value, and organizational learning (Correct answer)
Producing reports that are too complex for executives

Correct answer: Missing critical performance dimensions such as risk, customer value, and organizational learning

Financial-only metrics create blind spots in governance effectiveness because they ignore risk exposure, stakeholder value, and capability development dimensions.

Question 133: Which outcome BEST indicates that an organization's IT governance communication is effective?

Governance meetings end ahead of schedule
Vendor satisfaction scores improve
Stakeholders make timely, informed IT-related decisions aligned with business strategy (Correct answer)
The IT department produces more governance reports

Correct answer: Stakeholders make timely, informed IT-related decisions aligned with business strategy

Effective governance communication is evidenced by stakeholders being able to make timely, strategy-aligned IT decisions using the information they receive.

Question 134: Which communication principle is MOST important when delivering negative IT governance news to stakeholders?

Transparency and timeliness, accompanied by a remediation plan (Correct answer)
Minimizing the scope of reported issues
Restricting disclosure to senior IT management only
Delaying disclosure until the situation fully resolves

Correct answer: Transparency and timeliness, accompanied by a remediation plan

Transparent and timely disclosure of governance issues, paired with a remediation plan, maintains stakeholder trust and enables corrective action.

Question 135: A 'governance maturity model' is BEST used to:

Assess the current state of governance practices and identify improvement areas (Correct answer)
Map physical data center infrastructure
Document software development lifecycle stages
Compare IT budgets against industry benchmarks

Correct answer: Assess the current state of governance practices and identify improvement areas

A maturity model evaluates how developed and effective current governance practices are, and highlights where improvements will have the most impact.

Question 136: The PRIMARY measure of IT value delivery in a governance context is:

The number of new technologies adopted in a fiscal year
The reduction in IT department headcount over time
The percentage of IT projects completed on schedule
The extent to which IT investments achieve their intended business outcomes (Correct answer)

Correct answer: The extent to which IT investments achieve their intended business outcomes

Value delivery is measured by whether IT investments actually produce the business outcomes they were intended to enable — not by project metrics or technology adoption.

Question 137: The 'demand management' function in IT portfolio governance PRIMARILY manages:

Server capacity planning for peak business periods
IT employee workload assignments
Vendor service request queues
The intake and prioritization of IT investment requests against strategic criteria (Correct answer)

Correct answer: The intake and prioritization of IT investment requests against strategic criteria

Demand management governs how IT investment requests are received, evaluated, and prioritized to ensure resources are applied to the highest-value work.

CGEIT - Certified in the Governance of Enterprise IT

The CGEIT certification, offered by ISACA, validates expertise in IT governance frameworks, risk optimization, benefits realization, and IT resource management for enterprise IT professionals.

150

Questions

240 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

isaca.org — Exam format, renewal, score validity, fees, time limit, registration, test dates, eligibility, exam information · verified Nov 2026
proctor2.psionline.com — Test delivery · verified Oct 2026