ISACA CGEIT Exam Questions and Answers

dumps2021-11-09T06:18:49+08:00

ISACA CGEIT exam questions and answers are good enough for you to pass the test. CGEIT certification is for those aspiring for executive positions. There are 150 multiple-choice questions in real ISACA CGEIT exam, and you have 4 hours to complete all the questions. The available languages of CGEIT exam are Chinese and English. Free ISACA certification CGEIT exam questions and answers are available below.

Page 1 of 13

1. Which of the following is MOST important for the effective design of an IT balanced scorecard?

On-demand reporting and continuous monitoring

Consulting with the CIO

Emphasizing the financial results

Identifying appropriate key performance indicators (KPls)

2. An enterprise incurred penalties for noncompliance with privacy regulations .

Which of the following is MOST important to ensure appropriate ownership of access controls to address this deficiency?

Granting access to information based on information architecture

Engaging an audit of logical access controls and related security policies

Implementing multi-factor authentication controls

Authenticating access to information assets based on roles or business rules

3. An independent consultant has been hired to conduct an ad hoc audit of an enterprise’s information security office with results reported to the IT governance committee and the board.

Which of the following is MOST important to provide to the consultant before the audit begins?

Acceptance of the audit risks and opportunities

The scope and stakeholders of the audit

The organizational structure of the security office

The policies and framework used by the security office

4. Which of the following should be the PRIMARY goal of implementing service level agreements (SLAs) with an outsourcing vendor?

Gaining a competitive advantage

Establishing penalties for not meeting service levels

Achieving operational objectives

Complying with regulatory requirements

5. When evaluating the process for acquiring third-party IT resources, management identified several suppliers with repeated downtime issues impacting the enterprise .

Which of the following is the BEST approach to help ensure future service delivery in accordance with business objectives?

Establish key performance indicators (KPls)

Appoint a procurement oversight committee

Establish key risk indicators (KRIs).

Implement contract monitoring.

6. The CEO of an organization is concerned that there are inconsistencies in the way information assets are classified across the enterprise .

Which of the following is be the BEST way for the CIO to address these concerns?

Include data assets in the IT inventory.

Identify data owners across the enterprise.

Require enterprise risk assessments.

Implement enterprise data governance.

7. Due to continually missed service level agreements (SLAs), an enterprise plans to terminate its contract with a vendor providing IT help desk services. The enterprise s IT department will assume the help desk-related responsibilities .

Which of the following would BEST facilitate this transition?

Requiring the enterprise architecture (EA) be updated

Validating that the balanced scorecard is still meaningful

Ensuring IT will operate at a lower cost than the vendor

Ensuring a change management plan is in place

8. An enterprise's information security function is making changes to its data retention and backup policies .

Which of the following presents the GREATEST risk?

Business data owners were not consulted.

The new policies Increase the cost of data backups.

Data backups will be hosted at third-party locations.

The retention period for data backups is Increased.

9. To enable the development of required IT skill sets for the enterprise, it is MOST important to define skill requirements based on:

training needs.

one set of skills applicable to all IT staff.

a best practices framework.

each role within the IT department.

10. Which of the following components of a policy BEST enables the governance of enterprise IT?

Disciplinary actions

Regulatory requirements

Roles and responsibilities

Terms and definitions

Page 2 of 13

11. Which of the following should be the MOST important consideration when designing an implementation plan for IT governance?

Principles and policies

Roles and responsibilities

Risk tolerance levels

Organizational culture

12. Which of the following is MOST critical for the successful implementation of an IT process?

Process framework

Service delivery process model

Objectives and metrics

IT process assessment

13. Prior to decommissioning an IT system, it is MOST important to:

assess compliance with environmental regulations.

assess compliance with the retention policy.

review the media disposal records.

review the data sanitation records.

14. Which of the following is the MOST important benefit of developing an information architecture model consistent with enterprise strategy?

It identifies information architecture priorities.

It support and facilitates decision making.

It enables information architecture roadmap updates.

It optimizes information delivery and storage costs.

15. The risk committee is overwhelmed by the number of false positives included in risk reports .

What action would BEST address this situation?

Conduct a risk assessment

Evaluate key risk indicators (KRIs).

Change the reporting format.

Adjust the IT balanced scorecard

16. Which of the following should be identified FIRST when determining appropriate IT key risk indicators (KRIs)?

IT-related risk

IT controls

IT threats

IT objectives

17. A healthcare enterprise that is subject to strict compliance requirements has decided to outsource several key IT services to third-party providers .

Which of the following would be the BEST way to assess compliance and avoid reputational damage?

Require quarterly reports from the providers demonstrating compliance.

Require documentation that the providers have adequate controls in place.

Exercise the right to perform an audit.

Impose monetary penalties for noncompliance.

18. Senior management wants to expand offshoring to include IT services as other types of business offshoring have already resulted in significant financial benefits for the enterprise. The CIO is currently midway through a successful five-year strategy that relies heavily on internal IT resources .

What should the CIO do NEXT?

Reevaluate the offshoring strategy.

Abandon the current IT strategy.

Continue with the existing IT strategy.

Reevaluate the current IT strategy.

19. An enterprise has made the strategic decision to reduce operating costs for the next year and is taking advantage of cost reductions offered by an external cloud service provider.

Which of the following should be the IT steering committee's PRIMARY concern?

Revising the business $ balanced storecard

Updating the business risk profile

Changing the IT steering committee charter

Calculating the cost of the current solution

20. Which of the following provides the BEST assurance on the effectiveness of IT service management processes?

Performance of incident response

Continuous monitoring

Key risk indicators (KRIs)

Compliance with internal controls

Page 3 of 13

21. Senior management is reviewing the results of a recent security incident with significant business impact .

Which of the following findings should be of GREATEST concern?

Significant gaps are present m the incident documentation.

The incident was not logged in the ticketing system.

Response decisions were made without consulting the appropriate authority.

Response efforts had to be outsourced due to insufficient internal resources.

22. Which of the following BEST reflects mature risk management in an enterprise?

A regularly updated risk register

Ongoing risk assessment

Ongoing investment in risk mitigation

Responsive risk awareness culture

23. Which of the following should be the PRIMARY input when developing IT strategy?

Vision statement

Process and capability maturity

Governance objectives

Balanced scorecard

24. A business is considering a policy to anonymize personal data in enterprise systems.

Before making a decision, which of the following is MOST important for the IT steering committee to consider?

Business impact analysis (BIA) results

Regulatory requirements

Sustainability costs to the enterprise

Potential implementation barriers

25. An enterprise decides to accept the IT risk of a subsidiary located in another country even though it exceeds the enterprise's risk appetite .

Which of the following would be the BEST justification for this decision?

Risk framework alignment

Local market common practices

Compliance with local regulations

Technical gaps among subsidiaries

26. Which of the following MOST effectively prevents an IT system from becoming technologically obsolete before its planned return on investment (ROi)?

Requesting periodic third-party assessments of the system throughout its life

Obtaining long-term support commitments from the system platform vendors)

Obtaining independent assurance that the system will conform to future business requirements

Ensuring that the system is maintained in compliance with enterprise architecture (EA) standards

27. An airline wants to launch a new program involving the use of artificial intelligence (Al) and machine learning. The mam objective of the program is to use customer behavior to determine new routes and markets.

Which of the following should be done NEXT?

Consult with the enterprise privacy function

Define the critical success factors (CSFs)

Present the proposal to the IT strategy committee

Perform a business impact analysis (BIA)

28. Which of the following is the MOST effective way of assessing enterprise risk?

Business impact analysis (BIA)

Business vulnerability assessment

Likelihood of threat analysis

Operational risk assessment

29. An enterprise wants to reduce the complexity of its data assets while ensuring impact to the business is minimized during the transition .

Which of the following should be done FIRST?

Remove applications that are not aligned with the information architecture.

Review the information classification and retention policies

Review the information architecture.

Assess current information ownership.

30. The BEST way to decide how to prioritize issues identified in an IT risk and control self-assessment (CSA) is to understand the risk and:

impact to the enterprise.

criticality of IT services affected.

number of IT systems affected.

funds required for remediation.

Page 4 of 13

31. The MOST effective way to ensure that IT supports the agile needs of an enterprise is to:

perform process modeling.

outsource infrastructure management.

develop a robust enterprise architecture (EA).

implement open source systems.

32. An enterprise is planning to replace multiple enterprise resource planning (ERP) systems at various regions with one company-wide ERP system. The main objective of this change is to achieve economies of scale efficiencies resulting in cost reductions.

To meet this objective, what is the BEST approach in the planning phase of the project?

Implement an ERP system on shared resources with the lowest cost.

Minimize customization by standardizing ERP processes across regions.

Adopt a best in breed web-based architecture for the ERP system.

Use a service provider to evaluate and implement the new ERP processes.

33. Which of the following roles should be responsible for data normalization when it is found that a new system includes duplicates of data items?

Business system owner

Data steward

Database administrator (DBA)

Application manager

34. A data governance strategy has been defined by the IT strategy committee which includes privacy objectives related to access controls, authorized use. and data collection .

Which of the following should the committee do NEXT?

Mandate data privacy training for employees.

Establish a data privacy budget

Perform a data privacy impact assessment.

Mandate the creation of a data privacy policy.

35. An enterprise has lost an unencrypted backup tape of archived customer data. A data breach report is not mandatory in the relevant jurisdiction.

From an ethical standpoint, what should the enterprise do NEXT?

Initiate disciplinary proceedings against relevant employees.

Mandate a review of backup tape inventory procedures.

Communicate the breach to customers.

Require an evaluation of storage facility vendors.

36. Senior management wants to promote investment in IT, but is uncertain that associated risks are being properly identified.

The BEST way to address this concern is to:

engage an external consultant to develop risk scenarios.

appoint an IT representative to the business risk committee.

assign an IT cost controller to the finance department.

ensure business cases are developed by I

37. An IT strategy committee wants to ensure that a risk program is successfully implemented throughout the enterprise .

Which of the following would BEST support this goal?

A risk management framework

Mandatory risk awareness courses for staff

A risk recognition and reporting policy

Commitment from senior management

38. An enterprise has identified a number of plausible risk scenarios that could result in economic loss associated with major IT investments .

Which of the following is the BEST method to assess the risk?

Cost-benefit analysis

Qualitative analysis

Business impact analysis (BIA)

Quantitative analysis

39. Which of the following is the BEST outcome measure to determine the effectiveness of IT nsk management processes?

Frequency of updates to the IT risk register

Time lag between when IT risk is identified and the enterprise's response

Number of events impacting business processes due to delays in responding to risks

Percentage of business users satisfied with the quality of risk training

40. After shifting from lease to purchase of IT infrastructure and software licenses, an enterprise has to pay for unexpected lease extensions causing significant cost overruns. The BEST direction for the IT steering committee would be to establish;

an end-of-life program to remove aging infrastructure from the environment.

budget cuts to compensate for the cost overruns.

a program to annually review financial policy on overruns.

a policy to consider total cost of ownership (TCO) in investment decisions.

Page 5 of 13

41. Individual business units within an enterprise have been designing their own IT solutions without consulting the IT department.

From a governance perspective, what is the GREATEST issue associated with this situation?

Security controls may not meet IT requirements.

The enterprise does not have the skills to manage the solutions.

The solutions conflict with IT goals and objectives.

The solution may conflict with existing enterprise goals.

42. Which of the following is the MOST important aspect of business ethics?

Ensuring fair and consistent vendor management practices

Providing equal opportunities to employees

Protecting stakeholders' interests

Complying with legal and regulatory requirements

43. When considering an IT change that would enable a potential new line of business, the FIRST strategic step for IT governance would be to ensure agreement among the stakeholders regarding:

objectives to achieve goals.

metrics to measure effectiveness

a vision for the future state,

a change response plan

44. A board of directors is concerned that a major IT implementation has the potential to significantly disrupt enterprise operations .

Which of the following would be MOST helpful in identifying the extent of the potential impact of the disruption?

An analysis of the current enterprise risk appetite

An earned value analysis (EVA) of the implementation

A risk assessment of the implementation

A review of lessons learned from previous implementations

45. A strategic systems project was implemented several months ago .

Which of the following is the BEST reference for the IT steering committee as they evaluate its level of success?

Stakeholder satisfaction surveys B The project's net present value (NPV)

The project's business case

Operating metrics of the new system

46. From a governance perspective, the PRIMARY goal of an IT risk optimization process should be to ensure:

IT risk thresholds are defined in the enterprise architecture (EA).

the IT risk mitigation strategy is approved by management.

IT risk is mapped to the balanced scorecard.

the impact of IT risk to the enterprise is managed.

47. An IT audit report indicates that a lack of IT employee risk awareness is creating serious security issues in application design and configuration .

Which of the following would be the BEST key risk indicator (KRI) to show progress in IT employee behavior?

Number of IT employees attending security training sessions

Results of application security testing

Number of reported security incidents

Results of application security awareness training quizzes

48. Which of the following should be the ClO's GREATEST consideration when making changes to the IT strategy'?

Has the impact to the enterprise architecture (EA) been assessed?

Has the investment portfolio been revised?

Have key stakeholders been consulted?

Have IT risk metrics been adjusted?

49. The PRIMARY reason for implementing an IT governance program in an enterprise is to

balance the demand for information and the ability to deliver.

comply with regulatory requirements

reduce risks due to improved compensating controls.

decrease the scale of investment in information systems due to budgetary controls.

50. Acceptance of an enterprise's newly implemented IT governance initiatives has been resisted by a functional group requesting more autonomy over technology choices .

Which of the following is MOST important to accommodate this need for autonomy?

Continuous improvement processes

Documentation of key management practices

An exception management process

A change control process

Page 6 of 13

51. Which of the following represents the GREATEST challenge to implementing IT governance?

Determining the best practice to follow

Planning the project itself

Developing a business case

Applying behavioral change management

52. An enterprise is evaluating a possible strategic initiative for which IT would be the main driver. There are several risk scenarios associated with the initiative that have been identified .

Which of the following should be done FIRST to facilitate a decision?

Define the risk mitigation strategy.

Assess the impact of each risk.

Establish a baseline for each initiative.

Select qualified personnel to manage the project.

53. An enterprise plans to expand into new markets in countries lacking data privacy regulations, increasing risk exposure .

Which of the following is the BEST course of action for the CIO?

Identify business risk appetite and tolerance levels.

Quantify the risk impact and evaluate possible countermeasures.

Limit the personal data available to the high-risk countries.

Mandate the strengthening of user access controls.

54. An IT investment review board wants to ensure that IT will be able to support business initiatives. Each initiative is comprised of several interrelated IT projects .

Which of the following would help ensure that the initiatives meet their goals?

Review of project management methodology

Review of the business case for each initiative

Establishment of portfolio management

Verification of initiatives against the architecture

55. Which of the following is the MOST valuable input when quantifying the loss associated with a major risk event?

Key risk indicators (KRIs)

IT environment threat modeling

Business impact analysis (BIA) report

Recovery time objectives (RTOs)

56. When developing an IT governance framework, it is MOST important for an enterprise to consider:

information technology risk.

framework development cost.

information technology strategy.

stakeholders' support.

57. A review of the effectiveness of IT governance within an enterprise has revealed that several innovation improvement initiatives are failing. An analysis shows a lack of stakeholder buy-in to the improvements.

Implementing which of the following would have prevented this problem?

An IT project roadmap

An IT risk management program

A change management program

A service delivery framework

58. Which of the following is the MOST effective way to manage risks within the enterprise?

Assign individuals responsibilities and accountabilities for management of risks.

Make staff aware of the risks in their area and risk management techniques.

Provide financial resources for risk management systems.

Document procedures and reporting processes.

59. Which of the following aspects of the transition from X-rays to digital images would be BEST addressed by implementing information security policy and procedures?

Establishing data retention procedures

Training technicians on acceptable use policy

Minimizing the impact of hospital operation disruptions on patient care

Protecting personal health information

60. In an enterprise that has worldwide business units and a centralized financial control model, which of the following is a barrier to strategic alignment of business and IT?

Each business unit has its own steering committee for IT investment and prioritization.

Uniform portfolio management is in place throughout the business units.

IT is the exclusive provider of IT services to the business units.

The enterprise's CIO is a member of the executive committee.

Page 7 of 13

61. A chief technology officer (CTO) wants to ensure IT governance practices adequately address risk management specific to mobile applications.

To create the appropriate risk policies for IT, it is MOST important for the CTO to:

understand the enterprise's risk tolerance.

create an IT risk scorecard.

map the business goals to IT risk processes.

identify the mobile technical requirements.

62. In a large enterprise, which of The following is the MOST effective way to understand the business activities associated with the enterprise's information architecture?

Reviewing IT design with business process managers

Reviewing business strategy with senior management

Mapping business processes within a framework

Aligning business objectives to organizational strategy

63. From a governance perspective, which of the following roles is MOST important for an enterprise to keep in-house?

Information auditor

Information architect

Information steward

Information analyst

64. When developing effective metrics for the measurement of solution delivery, it is MOST important to:

establish project controls and monitoring objectives.

perform an objective analysis of the project roadmap.

establish the objectives and expected benefits.

specify quantitative measures for solution delivery.

65. Which of the following should be the FIRST consideration for an enterprise faced with a pandemic situation resulting in a mandatory remote work environment?

Reviewing and testing disaster recovery plans (DRPs)

Ensuring staff has the necessary technology to be productive

Ensuring remote work policies are updated and communicated

Revising IT performance monitoring metrics

66. An IT steering committee is concerned that enterprise technologies have grown stagnant and are outdated .

Which of the following is the BEST strategy to invest in modern technology?

Decrease spending on steady state and increase spending on modernization and enhancements.

Redefine the target architecture to define new technologies that can be incorporated into the infrastructure.

Create a new investment category for innovation that becomes a new way for tracking investment decisions.

Update the IT human resource management plan to require training and development for emerging technologies.

67. To ensure that information can be traced to the originating event and accountable parties, an enterprise should FIRST:

capture source information and supporting evidence.

improve business process controls.

review information event logs tor potential incidents.

review retention requirements for source information.

68. Which of the following is the BEST way to ensure new systems can be adequately supported once in production?

Establish a resource management framework.

Evaluate the operational requirements of the business stakeholders.

Identify key performance indicators (KPIs).

Require operational management be identified in the business case.

69. An enterprise has finalized a major acquisition and a new business strategy in line with stakeholder needs has been introduced. To help ensure continuous alignment of IT with the new business strategy the CiO should FIRST

review the existing IT strategy against the new business strategy

revise the existing IT strategy to align with the new business strategy

establish a new IT strategy committee for the new enterprise

assess the IT cultural aspects of the acquired entity

70. In a successful enterprise that is profitable in its marketplace and consistently growing in size, the non-IT workforce has grown by 50% in the last two years. The demand for IT staff in the marketplace is more than the supply, and the enterprise is losing staff to rival organizations. Due to the rapid growth. IT has struggled to keep up with the enterprise, and IT procedures and associated job roles are not well-defined.

The MOST critical activity for reducing the impact caused by IT staff turnover is to:

document processes and procedures.

outsource the IT operation.

increase compensation for IT staff

hire temporary staff.

Page 8 of 13

71. While assessing the feasibility of introducing new IT practices and standards into the IT governance framework, it is CRITICAL to understand an organization's:

culture.

level of outsourcing.

enterprise architecture (EA).

maturity of IT processes.

72. An enterprise has developed a new digital strategy to improve fraud detection .

Which of the following is MOST important to consider when updating the information architecture?

Resource constraints related to implementing the digital strategy.

The business use cases supporting the digital strategy

Changes to the legacy business and data architectures

The history of fraud incidents and their root causes

73. An enterprise is initiating efforts to improve system availability to mitigate IT risk to the business .

Which of the following results would be MOST important to report to the CIO to measure progress?

Incident severity and downtime trend analysis

Probability and seventy of each IT risk

Financial losses and bad press releases

Customer and stakeholder complaints over time

74. Which of the following should be the FIRST step in planning an IT governance implementation?

Assign decision-making responsibilities.

Obtain necessary business funding.

Define key business performance indicators.

Identify business drivers.

75. Enterprise IT has overseen the implementation of an array of data services with overlapping functionality leading to business inefficiencies .

Which of the following is the MOST likely cause of this situation?

insufficient information architecture

Ineffective project management

An outdated service level agreement (SLA)

An incomplete cost-benefit analysis

76. Of the following, who should be responsible for ensuring the regular review of quality management performance against defined quality metrics?

Process owners

Risk management team

Internal auditors

Executive management

77. A board of directors wants to ensure the enterprise is responsive to changes in its environment that would directly impact critical business processes .

Which of the following will BEST facilitate meeting this objective?

Scheduling frequent threat analyses

Monitoring key risk indicators (KRIs)

Regularly reviewing the enterprise risk appetite

Implementing a competitive intelligence tool

78. When establishing an enterprise data model, the BEST way to ensure the integrity of data is to:

classify information using an agreed-upon schema.

implement the highest level of protection to data across the enterprise.

establish a privileged access management platform.

implement a data loss prevention (DLP) program.

79. The BEST way to manage continuous improvement of governance-related processes is to:

assess existing process resource capacities.

define accountability based on roles and responsibilities.

apply effective quality management practices.

require third-party independent reviews.

80. An enterprise is determining the objectives for an IT training improvement initiative from a governance prosoectic. it would be MOST important to ensure that:

policies and processes address both enterprise requirements and professional growth

courses of instruction that will maximize employee productivity are identified

several different training strategies are created for final approval by the CIO

IT employees are surveyed and interviewed to identify development needs

Page 9 of 13

81. Which of the following BEST indicates the success of an enterprise's IT governance framework after implementation?

A high percentage of business owners involved with the approval of the IT strategic plan

A high percentage of IT systems complying with corporate information security standards

A high percentage of IT projects delivered on time and on budget

A high percentage of IT investments delivering expected benefits

82. A marketing enterprise is considering procuring customer information to more accurately target customer communications and increase sales. The data has a very high cost to the enterprise .

Which of the following would provide the MOST comprehensive view into the potential value to the organization?

Investment services board review

Net present value {NPV) calculation

Risk assessment results

Cost-benefit analysis results

83. An enterprise has a zero-tolerance policy regarding security. This policy is causing a large number of email attachments to be blocked and is a disruption to enterprise .

Which of the following should be the FIRST governance step to address this email issue?

Direct the development of an email usage policy.

Obtain senior management input based on identified risk.

Recommend business sign-off on the zero-tolerance policy.

Introduce an exception process.

84. Which of the following should be management's GREATEST consideration when trying to optimize the use of benefits from IT?

Value delivery

Quality management

Process improvement

Alignment of business to IT

85. A CIO must determine if IT staff have adequate skills to deliver on key strategic objectives .

Which of the following will provide the MOST useful information?

Employee performance metrics

Project risk reports

Gap analysis results

Training program statistics

86. A strategic IT-enabled investment is failing due to unforeseen technology problems .

What should be the board of directors' FIRST course of action?

Terminate the investment.

Assess the business risk and options.

Approve an investment budget increase.

Revise the investment selection process.

87. To generate value for the enterprise, it is MOST important that IT investments are:

aligned with the IT strategic objectives.

approved by the CF

consistent with the enterprise's business objectives.

included in the balanced scorecard.

88. An enterprise is implementing a new IT governance program .

Which of the following is the BEST way to increase the likelihood of its success?

The IT steering committee approves the implementation efforts.

The CIO communicates why IT governance is important to the enterprise.

Implementation follows an IT audit recommendation.

The CIO issues a mandate for adherence to the program.

89. An enterprise can BEST assess the benefits of a new IT project through its life cycle by:

calculation of the total cost of ownership.

periodic review of the business case.

periodic measurement of the project slip rate.

calculation of the net present value (NPV).

90. An enterprise is developing an ethics program, and the ethical standards have been defined .

Which of the following should the enterprise do NEXT?

Establish a training and awareness program focused on ethics.

Implement an enterprise-wide employee monitoring program.

Develop key performance indicators (KPIs) for program implementation.

Outline and document consequences for noncompliance.

Page 10 of 13

91. A root-cause analysis indicates a major service disruption due to a lack of competency of newly hired IT system administrators.

Who should be accountable for resolving the situation?

HR training director

HR recruitment manager

Chief information officer

(CIO) Business process owner

92. Six months ago, an enterprise's CIO reorganized IT to improve service delivery to the business .

Which of the following would BEST demonstrate the effectiveness of the reorganization?

The number of help desk calls

A balanced scorecard

A survey of IT staff

IT cost reduction

93. The MAIN responsibility of the board of directors regarding the management of enterprise risk is to:

ensure a risk process exists which addresses the risk appetite.

sustain investment in staff training regarding IT risk.

promote a benefits-driven culture throughout the enterprise.

maintain awareness of IT risk to the business.

94. Which of the following roles should approve major IT purchases to help prevent conflicts of interest?

IT steering committee

Chief information officer (CIO)

Chief compliance officer

Project management office (PMO)

95. When developing an IT training plan, which of the following is the BEST way to ensure that resource skills requirements are identified?

Extract training requirements from deficiencies reported in customer service satisfaction surveys.

Ask managers to determine IT training requirements annually.

Determine training needs based on the capabilities to support the IT strategy.

Survey employees for IT skills requirements based upon technology trends.

96. Which of the following is the GREATEST impact to an enterprise that has ineffective information architecture?

Poor desktop service delivery

Data retention

Redundant systems

Poor business decisions

97. To benefit from economies of scale, a CIO is deciding whether to outsource some IT services .

Which of the following would be the MOST important consideration during the decision-making process?

IT staff morale

Core IT processes

Outsourcer's reputation

New service level agreements (SLAs)

98. The BEST time to identity metrics to measure the performance of an IT-enabled investment is during:

system implementation

project initiation

investment feasibility analysis

business case development.

99. An enterprise's chief information officer (CIO) has been receiving complaints from business executives regarding the amount their units are being charged for IT services. To maintain a good relationship with business peers, the CIO wants to be responsive to these complaints.

To address this issue, the FIRST step should be to:

agree to reduce charge rates and improve relationship management with the business.

look into outsourcing of support functions to drive down the cost structure.

ask the chief financial officer (CFO) about budget revisions for the business units' IT expenditures.

quantify consumption and service level agreement (SLA) achievements per business unit.

100. IT has launched new portfolio management policies and processes to improve the alignment of IT projects with enterprise goals. The latest audit report indicates that no improvement has been made due to confusion in the decision-making process .

Which of the following is the BEST course of action for the CIO?

Deliver prioritization and facilitation training.

Implement a performance management framework.

Create an IT portfolio management risk framework.

Develop and communicate an accountability matrix.

Page 11 of 13

101. Which of the following is the BEST way for a CIO to secure support for a strategy to achieve long-term IT objectives?

Make the necessary strategic decisions and notify staff accordingly.

Develop tactics to implement the strategy and share with stakeholders.

Develop a communication plan for distribution of information to staff.

Meet with stakeholders to explain the strategy and incorporate feedback.

102. Which of the following BEST demonstrates the effectiveness of enterprise IT governance?

An IT balanced scorecard is used.

Business objectives are achieved.

Business objectives are defined.

IT processes are measured.

103. Which of the following is MOST important to consider when planning to implement a cloud-based application for sharing documents with internal and external parties?

Cloud implementation model

User experience

Information ownership

Third-party access rights

104. An enterprise has established a new department to oversee the life cycle of activities that support data management objectives .

Which of the following should be done NEXT?

Develop a business continuity plan (BCP).

Assess the current data business model.

Review data privacy requirements.

Establish a RACI chart

105. Which of the following is the BEST way to ensure all enterprise employees understand the corporate code of business conduct?

Conduct scheduled and random compliance audits.

Mandate annual ethics training that includes an exam.

Require external business activities be documented and reported.

Distribute a copy of the code and require a signature.

106. A global financial enterprise has been experiencing a substantial number of information security incidents that have directly affected its business reputation .

Which of the following should be the IT governance board's FIRST course of action?

Require revisions to how security incidents are managed by the IT department.

Request an IT security assessment to identify the main security gaps.

Execute an IT maturity assessment of the security process.

Mandate an update to the enterprise's IT security policy.

107. Which of the following is the PRIMARY purpose of an effective set of key risk indicators (KRIs)?

Identifying possible future adverse impacts on the enterprise

Evaluating existing technology for risk monitoring capabilities

Establishing executive level buy-in of the risk program

Quantifying the productivity of the risk management team

108. Which of the following will BEST enable an IT steering committee to monitor the achievement of overall IT objectives on a continuous basis?

Defined service level agreements (SLAs)

Project portfolio dashboards

Key performance indicators (KPIs)

IT user survey results

109. A newly hired CIO has been told the enterprise has an established IT governance process, but finds it is not being followed.

To address this problem, the CIO should FIRST

gain an understanding of the existing governance process and corporate culture.

replace the current governance process with one the CIO has successfully used before.

establish personal relationships with executive-level peers to leverage goodwill,

engage audit to review current governance processes and validate the ClO's concerns.

110. An enterprise's executive team has recently released a new IT strategy and related objectives .

Which of the following would be the MOST effective way for the CIO to ensure IT personnel are supporting the new strategy's objectives?

Measure progress towards IT objectives and communicate the results to IT staff.

Incorporate IT objectives into individual performance evaluations.

Develop communication materials to promote the new IT strategy and objectives.

Require IT managers to assign activities aligned to the IT objectives.

Page 12 of 13

111. A retail enterprise has cost reduction as its top priority.

From a governance perspective, which of the following should be the MOST important consideration when evaluating different IT investment options?

Support for increased sales

Risk associated with each option

Industry best practices

Business value impact

112. A large enterprise has decided to use an emerging technology that needs to be integrated with the current IT infrastructure .

Which of the following is the BEST way to prevent adverse effects to the enterprise resulting from the new technology?

Develop key performance indicators (KPIs).

Update the risk appetite statement

Develop key risk indicators (KRIs).

Implement service level agreements (SLAs)

113. When implementing an IT governance framework, which of the following would BEST ensure acceptance of the framework?

Factoring in the effects of enterprise culture

Using subject matter experts

Using industry-accepted practices

Complying with regulatory requirements

114. The PRIMARY objective of IT resource planning within an enterprise should be to:

determine risk associated with IT resources.

maximize value received from I

determine IT outsourcing options.

finalize service level agreements (SLAs) for IT

115. Which of the following is the BEST indication of effective IT-business strategic alignment?

Business management is involved as IT strategies are developed.

IT senior management is required to report to the board.

Business strategy is documented to allow IT architecture to be designed quickly.

IT-business collaboration results in a strategy focused on IT cost reduction.

116. An IT steering committee is evaluating whether a third-party supplier is delivering the correct level of service Reviewing which of the following will provide the BEST information to the committee?

Key performance indicators (KPIs)

Service portfolio management

Vendor status reports

Operational cost reduction reports

117. Which of the following is MOST important to the successful implementation of enterprise architecture (EA)?

Developing data modeling tools

Managing the challenge of change

Reducing the cost of IT investments

Establishing key performance indicators (KPIs)

118. When assessing the impact of a new regulatory requirement, which of the following should be the FIRST course of action?

Update affected IT policies.

Assess the budget impact of the new regulation.

Map the regulation to business processes.

Implement new regulatory requirements.

119. To ensure IT risk is managed in a consistent manner, it is MOST important for IT governance to establish a:

risk management committee to identify IT-related risks.

risk management framework.

balanced scorecard that includes IT risks.

risk management reporting tool to ensure compliance.

120. An analysis of an organization s security breach is complete. The results indicate that the quality of the code used for updates to its primary customer-facing software has been declining and security flaws were introduced.

The FIRST IT governance action to correct this problem should be to review:

compliance with the user testing process.

the change management control framework.

the qualifications of developers to write secure code.

the incident response plan.

Page 13 of 13

121. An enterprise's service center is experiencing long delays in fulfilling !T service requests and very low customer satisfaction.

The BEST way to determine if staff competency is the root cause of these performance problems is to compare required staff competencies with:

certification requirements.

current skills inventory.

training program completions.

hiring and staffing practices.

122. An enterprise will be adopting wearable technology to improve business performance.

Which of the following would be the BEST way for the CIO to validate IPs preparedness for this initiative?

Request an enterprise architecture (EA) review.

Request reprioritization of the IT portfolio.

Perform a baseline business value assessment

Identify the penalties for noncompliance.

123. An enterprise's decision to move to a virtualized architecture will have the GREATEST impact on:

system life cycle management.

asset classification.

vendor management

vulnerability management.

124. A large enterprise that is diversifying its business will be transitioning to a new software platform, which is expected to cause data changes .

Which of the following should be done FIRST when developing the related metadata management process?

Require an update to enterprise data policies.

Request an impact analysis.

Review documented data interdependence.

Validate against existing architecture.

ISACA CGEIT Exam Questions and Answers

ISACA CGEIT Exam Questions and Answers

Share this post

Leave a Reply Cancel reply