ISACA CGEIT Practice Test

Answer choices

1. A. Create a governance scorecard first so policy effectiveness can be measured once implementation begins, and review the outcome at the next approved decision gate.
2. B. Identify and reconcile the relevant internal and external requirements, stakeholder needs and decision constraints before setting governance objectives and policies.
3. C. Draft a comprehensive policy set from the strictest external requirement and use exceptions for business needs that cannot comply.
4. D. Ask technology management to identify the highest operational risks and use those risks as the sole basis for the governance framework.

Wrong-answer review

• A. Create a governance scorecard first so policy effectiveness can be measured once implementation begins, and review the outcome at the next approved decision gate.: Incorrect. Metrics are important after governance objectives are defined; a scorecard cannot compensate for undefined or misaligned objectives.
• C. Draft a comprehensive policy set from the strictest external requirement and use exceptions for business needs that cannot comply.: Incorrect. Using the strictest requirement as the default may over-control some areas and still miss nonregulatory stakeholder needs; it bypasses requirements analysis.
• D. Ask technology management to identify the highest operational risks and use those risks as the sole basis for the governance framework.: Incorrect. Operational risk is one input, not the complete set of governance drivers such as strategy, legal obligations, culture and stakeholder expectations.

Answer choices

1. A. Fund the highest-ROI proposal first and use remaining capital in descending ROI order, while retaining the current monitoring and reporting cadence.
2. B. Give each major business unit one funded proposal so enterprise investment remains balanced across stakeholders, with the rationale documented for governance review.
3. C. Approve all positive-ROI proposals and let management sequence them as resources become available, subject to the existing exception and escalation process.
4. D. Select the energy-trading investments with common criteria for strategic value, risk, return, dependencies and scarce capacity instead of approving every positive standalone case.

Answer choices

1. A. Let the program with the higher expected ROI determine the transition state and require the other program to adapt.
2. B. Pause all projects until the target architecture is fully implemented as a single enterprise release, subject to the existing exception and escalation process.
3. C. Establish and govern an integrated sequencing plan that coordinates dependencies, transition states and investment timing across the portfolio.
4. D. Require each project to publish a more detailed solution architecture so incompatibilities can be detected earlier, and review the outcome at the next approved decision gate.

Answer choices

1. A. Evaluate the net change in risk across relevant scenarios, including new vulnerabilities, dependencies and business impacts, before concluding that the control improves the risk posture.
2. B. Credit the control because any reduction in threat likelihood represents positive risk treatment, while retaining the current monitoring and reporting cadence.
3. C. Reject the control because a mitigation that introduces any new risk is inconsistent with risk optimization, with the rationale documented for governance review.
4. D. Evaluate only the residual risk for the original threat because secondary effects belong in a separate operational assessment.

Answer choices

1. A. Raise utilization targets further so managers are forced to eliminate hidden inefficiency before requesting more capacity, subject to the existing exception and escalation process.
2. B. Use capacity measures that balance efficiency with required resilience and strategic demand, including headroom for variability where business outcomes justify it.
3. C. Remove utilization from governance reporting because efficiency metrics inherently conflict with agility, and review the outcome at the next approved decision gate.
4. D. Create a central emergency pool funded outside the portfolio so utilization targets do not need to change.

Answer choices

1. A. Keep the original risk rating unchanged because insurance does not reduce likelihood, with the rationale documented for governance review.
2. B. Treat the risk as fully mitigated for governance reporting but track operational concerns in business continuity, subject to the existing exception and escalation process.
3. C. Reassess the remaining likelihood and nontransferred impacts, and keep the risk governed until residual exposure is within authorized tolerance or otherwise treated.
4. D. Close the risk because risk transfer is an accepted response strategy and the insurer now bears the financial consequence.

Answer choices

1. A. Use continuous management monitoring for timely oversight and risk-based independent assurance for critical assertions, with the governing body evaluating both sources when judging performance and conformance.
2. B. Replace management monitoring entirely with internal audit so every governance metric is independent from the process owner.
3. C. Allow management to monitor itself without independent assurance as long as all metrics are automated and retained for audit.
4. D. Have the governing body directly operate the monitoring controls so neither management nor internal audit controls the evidence.

Answer choices

1. A. Measure only gross savings and let finance handle cost reallocations through internal chargebacks, with results reported against the current governance baseline.
2. B. Use the sponsoring unit’s savings because it owns the approved business case and should be measured on controllable results.
3. C. Measure net enterprise benefit across affected units and include transferred costs and disbenefits rather than crediting one sponsor’s local savings as total value.
4. D. Count the receiving unit’s additional labor as a separate operational issue so benefit ownership remains simple, while retaining the current monitoring and reporting cadence.

Answer choices

1. A. Require active-active deployment in multiple providers because critical services should not depend on one supplier or region.
2. B. Purchase outage insurance and treat the concentration as financially transferred, with results reported against the current governance baseline.
3. C. Accept the risk because provider resilience is contractually guaranteed and the infrastructure is outside enterprise control, and review the outcome at the next approved decision gate.
4. D. Evaluate the concentration against business continuity requirements and risk appetite, then implement or consciously accept an appropriate diversification, failover or recovery strategy.

Answer choices

1. A. Divide the work equally between employees and contractors to balance flexibility and knowledge retention, and review the outcome at the next approved decision gate.
2. B. The capability’s strategic importance, required capacity, time horizon, knowledge-retention risk and sourcing alternatives before deciding the appropriate employee/contractor mix.
3. C. Use contractors because speed to capacity should take precedence when a strategic program is already approved, while retaining the current monitoring and reporting cadence.
4. D. Prefer permanent employees for strategically important capabilities because internal ownership reduces long-term dependency and knowledge-retention risk.