ISACA CGEIT Practice Test

Answer choices

1. A. Delegate all vulnerability prioritization to security operations and report only the number of overdue patches to governance, as the primary implementation for the described business requirement.
2. B. Translate and aggregate technology findings into business-relevant risk scenarios with accountable owners, impact, appetite/tolerance status and decision needs, within the documented operational, security, ownership, and validation requirements.
3. C. Increase committee meeting frequency so members have more time to review the vulnerability list, subject to the existing exception and escalation process, for evaluation.
4. D. Set a universal severity threshold and require management to remediate every vulnerability above it, with results reported against the current governance baseline, for this task.

Wrong-answer review

• A. Delegate all vulnerability prioritization to security operations and report only the number of overdue patches to governance, as the primary implementation for the described business requirement.: Incorrect. Operational delegation is appropriate for routine treatment, but governance still needs visibility into material aggregate risk and exceptions.
• C. Increase committee meeting frequency so members have more time to review the vulnerability list, subject to the existing exception and escalation process, for evaluation.: Incorrect. More meeting time does not transform raw findings into business risk information.
• D. Set a universal severity threshold and require management to remediate every vulnerability above it, with results reported against the current governance baseline, for this task.: Incorrect. Technical severity alone may not reflect business impact, exploitability, compensating controls or appetite.

Answer choices

1. A. Continue using the original benefit forecast so management remains accountable to the approved business case, with the accountable owner reporting any material variance, for the affected environment.
2. B. Use only actual realized benefits and ignore remaining expected benefits until the investment is fully implemented, while retaining the current monitoring and reporting cadence, when applied.
3. C. Use consistently updated expected or realized benefits and costs, clearly distinguish forecast from actual, and preserve the original baseline for variance and accountability analysis, for the required outcome.
4. D. Reset both costs and benefits to a new baseline and stop reporting variance from the original business case, for the described technical objective and its associated operational control requirements, as configured.

Answer choices

1. A. Select the platform with the broadest integration features and resolve semantic differences through transformation rules, for the described technical objective and its associated operational control requirements, in context.
2. B. Create separate analytical domains for each function so each team can preserve its existing definition of customer, under the stated technical, operational, and governance constraints.
3. C. Let the vendor’s model become the enterprise standard, then allow business units to document exceptions after implementation, for the described technical objective and its associated operational control requirements, for evaluation.
4. D. Establish enterprise information definitions, ownership and stewardship for the shared concepts, then use those decisions to guide information architecture and platform design, in the described situation.

Answer choices

1. A. Replace the supplier because any communication failure during a resilience exercise proves unacceptable third-party risk, with the accountable owner reporting any material variance, for the stated requirement.
2. B. Repeat the same exercise until participants can execute the existing plan without errors, while retaining the current monitoring and reporting cadence, within the documented operational, security, ownership, and validation requirements.
3. C. Update response/recovery plans, roles, communication paths and supplier dependencies from the exercise findings, assign corrective owners and retest the changed elements, as the selected response to the described condition.
4. D. Treat the exercise as successful because the plan steps were followed and focus remediation only on participant training, under the stated technical, operational, and governance constraints.

Answer choices

1. A. Hire specialists for all new competencies and retain current staff only for legacy operations until retirement, while retaining the current monitoring and reporting cadence, within the documented scope, ownership, and validation boundaries.
2. B. Send all IT staff to the same broad certification program so capability development is consistent across the organization, as the recommended implementation across the complete governed service lifecycle.
3. C. Delay the initiative until existing employees have developed every skill required for the target state, subject to the existing exception and escalation process, for the required outcome.
4. D. Define the future-state competencies and capacity required by the strategy, assess gaps by role, and use targeted development, hiring or sourcing plans tied to the transition timeline, within the described context.

Answer choices

1. A. Remove the delayed benefit from the business case because management cannot control regulatory approval, subject to the existing exception and escalation process, as the selected approach for the stated technical and business outcome.
2. B. Stop the entire investment because a material assumption in the original business case is no longer valid, for the described technical objective and its associated operational control requirements, in the described situation.
3. C. Leave the business case unchanged because external delays should not alter management accountability, and review the outcome at the next approved decision gate, for the described technical objective.
4. D. Reforecast the affected benefit and timing, assess the investment’s current overall value and risk, and decide whether scope, funding or targets should change while preserving the original baseline, as proposed.

Answer choices

1. A. Increase the number of mandatory controls and require quarterly attestations from all technology staff, while retaining the current monitoring and reporting cadence, for evaluation.
2. B. Reframe governance communications around stakeholder value, decision rights and business outcomes, and make accountable leaders visibly reinforce those expectations, under the described governance of enterprise it (40%) criteria.
3. C. Transfer governance communications to internal audit so messages are perceived as independent of IT management, subject to the existing exception and escalation process, within this context.
4. D. Publish more detailed procedures for every governance process and require staff to acknowledge them annually, with results reported against the current governance baseline, in the described situation.

Answer choices

1. A. The percentage of solution architects who complete the enterprise architecture training curriculum, and review the outcome at the next approved decision gate, as proposed.
2. B. The extent to which approved investments conform to or intentionally update the target architecture and sequencing plan while delivering required enterprise capabilities, for the specified implementation requirement.
3. C. The average time required for the architecture review board to approve a project design, while retaining the current monitoring and reporting cadence, for the required outcome.
4. D. The number of architecture documents updated each quarter relative to the previous year, with the rationale documented for governance review, within the documented operational, security, ownership, and validation requirements.

Answer choices

1. A. Reduce the benefit forecast by a conservative percentage and approve the initiative if the adjusted return remains positive, within the documented scope, ownership, and validation boundaries.
2. B. Evaluate the full business case dependencies, ownership, risk and funding requirements at portfolio level and approve only if the enabling changes are credibly committed, as the recommended response to this scenario.
3. C. Approve a pilot so technical feasibility can be demonstrated before the dependent business changes are funded, and review the outcome at the next approved decision gate, for the affected environment.
4. D. Approve the initiative because its standalone business case is positive and track the enabling work as separate projects, for the described technical objective and its associated operational control requirements, in this situation.

Answer choices

1. A. Expand the governance scorecard with resilience, business-outcome and risk measures tied to enterprise objectives, using cost and schedule only as supporting delivery evidence, for the described technical objective.
2. B. Harmonize project-status definitions across the utility before adding new governance measures, while keeping the existing reporting model, for the described technical objective and its associated operational control requirements, within the stated policy framework.
3. C. Have internal audit verify the reliability of project cost and schedule data before those figures are included in the board pack, for the described technical objective and its associated operational control requirements.
4. D. Increase the cadence of cost and schedule reporting so the board sees delivery variance sooner under the existing exception and escalation rules, under organization-wide implementation-governance requirements.