View Full Isaca CGEIT Exam Dumps and Practice Test Dumps.

 

Question 301

An enterprise is revising its corporate strategy and expects significant changes in its technology portfolio. What should IT governance do FIRST?

1. Assess the impact of the revised strategy on IT objectives, investments, and governance priorities.
2. Cancel all existing technology initiatives.
3. Increase the IT budget before reviewing the strategy.
4. Transfer strategic planning entirely to the IT department.

Correct Answer: 1

Explanation

Changes in enterprise strategy can affect technology priorities, investment decisions, resource requirements, risk exposure, and expected business outcomes. Governance should first assess how the revised strategy affects existing IT objectives and the current portfolio. This provides a structured basis for determining which initiatives remain aligned, which require modification, and where new capabilities may be needed. Automatically canceling initiatives or increasing budgets before completing an assessment can lead to poor resource allocation. Strategic planning should remain connected to enterprise leadership rather than being delegated entirely to IT. A governance assessment ensures technology decisions continue to support the organization’s updated strategic direction.

Question 302

A portfolio contains several IT projects competing for the same specialized resources. Which governance action is MOST appropriate?

1. Allow project managers to negotiate resources independently.
2. Prioritize resource allocation based on enterprise objectives, value, risk, and dependencies.
3. Assign resources equally to every project.
4. Give priority to projects with the largest technical teams.

Correct Answer: 2

Explanation

When multiple initiatives compete for scarce resources, governance should make allocation decisions from an enterprise perspective. Prioritization should consider strategic alignment, expected value, risk, dependencies, regulatory requirements, urgency, and organizational capacity. Allowing project managers to negotiate independently can result in decisions based on local priorities rather than enterprise needs. Equal distribution may not maximize value because strategically critical initiatives may require more resources. Team size is also not an appropriate measure of investment importance. Portfolio governance provides the structure needed to resolve resource conflicts and direct limited skills and funding toward initiatives that best support organizational objectives.

Question 303

An organization has established IT governance policies, but employees are unclear about who is responsible for approving exceptions. What should be improved?

1. Add more technical controls.
2. Increase the number of policy documents.
3. Define exception decision rights, approval authority, and escalation responsibilities.
4. Remove the exception process from the policy framework.

Correct Answer: 3

Explanation

An effective governance framework must clearly define who has authority to make decisions, including decisions involving exceptions. Employees should understand who can approve, reject, or escalate deviations from established policies. Clearly documented decision rights improve accountability and prevent inconsistent handling of exceptions. Adding technical controls or producing more policy documents does not resolve unclear authority. Removing the exception process could encourage informal or unauthorized deviations and increase organizational risk. Governance should establish appropriate approval thresholds based on the significance and risk of the exception. Clear responsibilities also make monitoring and subsequent review easier, ensuring that exceptions remain controlled and appropriately justified.

Question 304

A proposed technology investment has a strong business case but introduces risks that exceed the organization’s approved risk appetite. What should governance do?

1. Approve the investment because its financial benefits are high.
2. Ignore the risk because the business sponsor accepts it.
3. Transfer all responsibility for the risk to the implementation team.
4. Require the risk to be reduced, formally accepted by authorized leadership, or otherwise addressed before approval.

Correct Answer: 4

Explanation

Risk appetite establishes the level and types of risk an organization is willing to accept while pursuing its objectives. If a proposed investment creates exposure beyond that tolerance, governance should not simply approve it based on expected financial benefits. The risk should be mitigated, the investment redesigned, or the residual exposure formally accepted by an appropriately authorized decision-maker if organizational policy permits such acceptance. A project team or business sponsor cannot necessarily accept enterprise-level risk without delegated authority. Governance must ensure that investment decisions balance value and risk. This approach supports disciplined decision-making and prevents unauthorized exposure beyond established risk boundaries.

Question 305

An enterprise wants to determine whether its IT investments are producing the benefits originally approved. Which governance practice is MOST appropriate?

1. Establish ongoing benefit ownership, measures, targets, and post-implementation reviews.
2. Measure only whether projects were delivered on schedule.
3. Close investment oversight immediately after deployment.
4. Evaluate benefits only when the annual budget is prepared.

Correct Answer: 1

Explanation

Benefits realization requires more than completing a project on time and within budget. Governance should establish accountable benefit owners, measurable outcomes, targets, and mechanisms for tracking results throughout the investment lifecycle. Post-implementation reviews can determine whether expected benefits were achieved and identify reasons for any shortfalls. Measuring only schedule performance evaluates delivery efficiency rather than business value. Ending oversight at deployment may miss adoption and process-change issues that affect benefits. Waiting until annual budgeting also delays corrective action. Continuous benefit monitoring enables governance to identify gaps early and improve future investment decisions, business cases, accountability, and portfolio prioritization.

Question 306

A critical IT service depends on a single external provider, creating significant concentration risk. What should governance evaluate?

1. Whether the provider can advertise additional services.
2. Whether alternative sourcing, contingency, or exit arrangements can reduce the dependency.
3. Whether the provider can increase its contract price.
4. Whether internal employees can access the provider’s marketing materials.

Correct Answer: 2

Explanation

Dependence on a single provider can create operational, financial, security, and continuity risks. Governance should evaluate whether alternative sourcing arrangements, contingency capabilities, contractual protections, transition plans, or exit strategies can reduce the organization’s exposure. The objective is not necessarily to eliminate every single-provider relationship, but to understand and manage the associated concentration risk. Provider marketing capabilities and unrelated contract considerations do not address the primary governance concern. A resilient sourcing strategy should consider the criticality of the service, switching difficulty, provider viability, geographic dependencies, data portability, and recovery requirements. Governance can then determine whether the current dependency remains within acceptable risk levels.

Question 307

An IT governance committee receives reports that focus heavily on technical activity but provide little information about business outcomes. What should be done?

1. Add more infrastructure utilization statistics.
2. Increase the technical detail in executive reports.
3. Replace all reporting with project schedules.
4. Redesign reporting to connect IT performance and investments with business objectives and outcomes.

Correct Answer: 4

Explanation

Governance reporting should support strategic decision-making by showing how technology contributes to enterprise objectives. Technical measures can be useful, but they should be connected to business outcomes such as service availability, customer experience, operational efficiency, revenue enablement, risk reduction, or regulatory compliance. Adding more technical detail may make reports more complex without improving decision usefulness. Project schedules primarily describe delivery progress rather than realized value. Governance should therefore redesign reporting so that decision-makers can understand performance, investment outcomes, risks, and strategic contribution. This creates a stronger connection between IT activities and enterprise priorities and supports more informed governance decisions.

Question 308

A business unit proposes a new application that duplicates functionality already available through an enterprise platform. What should governance consider FIRST?

1. Whether the business unit prefers a different user interface.
2. Whether the proposed application has a larger technical team.
3. Whether the existing enterprise capability can satisfy the requirement with reasonable changes or configuration.
4. Whether the new application can be implemented before the enterprise platform.

Correct Answer: 3

Explanation

Before approving a duplicate capability, governance should determine whether an existing enterprise platform can meet the business requirement. Reusing established capabilities can reduce costs, integration complexity, security exposure, support requirements, and technical debt. A different user interface or larger project team does not necessarily justify a new application. Implementation speed should also be considered only after evaluating enterprise architecture, business requirements, and total value. Governance should encourage rational reuse while allowing exceptions where the existing capability cannot adequately satisfy legitimate needs. This approach supports resource optimization and enterprise architecture objectives while reducing unnecessary duplication across the technology portfolio.

Question 309

A major IT initiative is progressing according to schedule, but its expected business benefits have declined because market conditions changed. What should governance do?

1. Reassess the business case and determine whether the initiative should continue, change scope, or be stopped.
2. Continue funding because the project remains on schedule.
3. Ignore the market change until project completion.
4. Measure only the technical milestones.

Correct Answer: 1

Explanation

Investment governance should consider whether an initiative continues to provide sufficient value under current conditions. Changes in market demand can materially affect expected benefits, costs, risks, and strategic relevance. Governance should therefore reassess the business case and determine whether the initiative should continue, be modified, reprioritized, or terminated. Schedule performance alone does not demonstrate that an investment remains worthwhile. Ignoring changed assumptions can lead to continued spending on an initiative whose expected value has deteriorated. Technical milestones remain useful for delivery monitoring, but investment governance must also evaluate whether the overall business rationale remains valid throughout the initiative lifecycle.

Question 310

An organization is establishing an enterprise-wide IT governance committee. Which characteristic is MOST important for effective decision-making?

1. Membership limited exclusively to IT technical specialists.
2. Representation of relevant business stakeholders with clearly defined authority and accountability.
3. Membership determined solely by organizational seniority.
4. Meetings held only when major incidents occur.

Correct Answer: 2

Explanation

Enterprise IT governance decisions often involve business priorities, investment value, risk, compliance, resources, and technology. Effective governance therefore requires appropriate representation from relevant business and technology stakeholders. Members should have clearly defined authority, responsibilities, and accountability so that decisions can be made and followed through. A committee composed only of technical specialists may overlook important business considerations. Seniority alone does not guarantee the knowledge or authority needed for specific decisions. Governance should also operate proactively rather than meeting only during major incidents. Appropriate stakeholder representation strengthens alignment, transparency, accountability, and the quality of enterprise technology decisions.

Question 311

An organization has identified a significant gap between its current IT governance capabilities and its desired maturity level. What should be developed NEXT?

1. A detailed roadmap containing prioritized governance improvement initiatives.
2. A plan to replace all governance personnel.
3. A requirement to implement every possible governance practice immediately.
4. A strategy to eliminate governance assessments.

Correct Answer: 1

Explanation

A maturity gap assessment identifies where governance capabilities fall short of the desired state, but improvement requires prioritization and implementation planning. A governance roadmap should identify initiatives, priorities, responsible parties, dependencies, resources, milestones, and expected outcomes. Replacing personnel is not automatically necessary and may not address the actual capability gaps. Implementing every possible practice simultaneously can overwhelm the organization and reduce adoption. Eliminating assessments would remove the mechanism for measuring progress. A structured roadmap enables incremental improvement based on business priorities and risk. Progress can then be monitored using defined measures and periodic reassessments to determine whether governance capability is improving as intended.

Question 312

A new regulatory requirement affects an outsourced IT service. What should governance verify?

1. That the provider’s marketing strategy has changed.
2. That the provider has increased its staffing levels.
3. That contractual obligations, controls, monitoring, and service requirements address the new regulatory expectations.
4. That all internal IT policies are removed.

Correct Answer: 3

Explanation

Regulatory obligations remain important even when a service is outsourced. Governance should verify that the provider’s contractual obligations, controls, monitoring arrangements, reporting requirements, and service commitments adequately address the new requirements. Outsourcing operational responsibility does not eliminate the enterprise’s need for oversight. Staffing increases may be useful but do not demonstrate regulatory compliance, while marketing strategy is unrelated to the core requirement. Removing internal policies would not address the regulatory change and could create additional control gaps. Governance should assess the regulatory impact, determine whether contract amendments or additional controls are necessary, and establish appropriate monitoring to confirm ongoing compliance.

Question 313

An enterprise has several IT policies covering similar subjects with inconsistent requirements. What should governance do?

1. Allow employees to select whichever policy they prefer.
2. Consolidate or harmonize the policies and establish clear ownership and precedence.
3. Create additional policies for every department.
4. Remove all policy monitoring activities.

Correct Answer: 2

Explanation

Conflicting or overlapping policies create ambiguity and increase the likelihood of inconsistent compliance. Governance should review the policies, identify duplication and contradictions, and consolidate or harmonize them where appropriate. Clear ownership and precedence should also be established so employees understand which requirements apply when policies overlap. Allowing employees to choose a preferred policy undermines governance and can create inconsistent risk treatment. Creating additional departmental policies may increase complexity rather than resolve it. Removing monitoring would make compliance problems harder to identify. A coherent policy framework improves clarity, accountability, consistency, and the organization’s ability to communicate and enforce governance requirements.

Question 314

A proposed IT investment requires significant organizational change, but business stakeholders have not agreed on how the new processes will operate. What should governance require before approval?

1. Agreement on key business process changes, responsibilities, and expected outcomes.
2. Immediate technical development to identify the requirements.
3. Approval based only on the technology architecture.
4. Transfer business process decisions to the vendor.

Correct Answer: 1

Explanation

When expected investment benefits depend on organizational change, unresolved business process decisions create substantial implementation and benefits-realization risk. Governance should ensure that relevant stakeholders agree on the major process changes, responsibilities, adoption expectations, and intended outcomes before committing significant resources. Beginning technical development without business agreement can result in rework and solutions that do not support the intended operating model. Architecture is important but cannot replace business ownership of process decisions. Vendors may provide implementation expertise but should not automatically determine how the enterprise operates. Clear business agreement improves accountability, adoption, requirements quality, and the likelihood that the investment will achieve its approved benefits.

Question 315

An enterprise wants to ensure that governance decisions remain transparent to stakeholders. Which practice is MOST appropriate?

1. Keep all governance decisions confidential.
2. Communicate only decisions that involve financial spending.
3. Maintain documented decisions, rationale, accountability, and appropriate communication to affected stakeholders.
4. Allow each committee member to communicate decisions independently.

Correct Answer: 3

Explanation

Transparency requires stakeholders to understand significant governance decisions, the rationale behind them, and who is accountable for implementation. Maintaining appropriate records of decisions, supporting analysis, approvals, and responsibilities provides an auditable governance trail. Communication should be tailored to affected stakeholders while protecting information that must remain confidential. Keeping all decisions secret reduces transparency, while communicating only financial decisions ignores important technology, risk, architecture, and compliance decisions. Allowing individual committee members to communicate independently can result in inconsistent messages. A structured decision-recording and communication process strengthens accountability, consistency, and stakeholder confidence in the governance framework.

Question 316

An organization is evaluating a new cloud service for a critical workload. Which governance consideration is MOST important?

1. Whether the provider uses the most popular brand name.
2. Whether the service meets enterprise requirements for security, resilience, compliance, cost, and business value.
3. Whether the provider offers the largest number of optional features.
4. Whether other companies have adopted the service without further analysis.

Correct Answer: 2

Explanation

A critical workload requires a comprehensive governance assessment of the proposed cloud service. The evaluation should consider security, resilience, regulatory and contractual requirements, data management, costs, service performance, portability, dependency risk, and expected business value. Popularity or brand recognition does not guarantee suitability for the enterprise’s specific requirements. A large feature set can also introduce unnecessary complexity or cost. Other organizations’ adoption may provide useful market information but cannot replace the enterprise’s own risk and value assessment. Governance should ensure that cloud adoption supports business objectives while remaining within acceptable risk levels and providing appropriate contractual and operational protections.

Question 317

A governance committee discovers that an important IT decision was made outside the established governance process. What should be done?

1. Ignore the decision because it has already been implemented.
2. Automatically reverse the decision regardless of its impact.
3. Document and assess the decision, determine the reason for bypassing governance, and address the process gap.
4. Eliminate the governance process that was bypassed.

Correct Answer: 3

Explanation

A decision made outside established governance can indicate weaknesses in decision rights, urgency procedures, communication, or accountability. Governance should document and assess the decision, determine whether it created unacceptable risk, and understand why the established process was bypassed. The organization may need to ratify the decision, implement corrective actions, or revise emergency decision procedures where appropriate. Automatically reversing every such decision may create unnecessary business disruption, while ignoring the issue allows governance weaknesses to persist. Eliminating the governance process would remove oversight rather than address the underlying problem. The objective should be to restore accountability and strengthen the decision-making framework.

Question 318

A company is reviewing its IT sourcing strategy because several critical services have become increasingly dependent on external providers. What should governance evaluate?

1. Provider dependency, concentration risk, service criticality, internal capabilities, and viable sourcing alternatives.
2. Only the current vendor contract price.
3. Only the number of vendors used by competitors.
4. Whether all services can be moved internally immediately.

Correct Answer: 1

Explanation

A sourcing strategy should consider the enterprise’s overall dependency on external providers and the risks associated with those relationships. Governance should evaluate service criticality, provider concentration, contractual protections, internal capabilities, switching costs, resilience, regulatory requirements, and alternative sourcing options. Focusing only on price can overlook significant operational and strategic risks. Competitor practices may provide context but do not establish the appropriate sourcing model for the organization. Immediately bringing all services in-house may also be impractical or economically inefficient. A balanced sourcing assessment helps determine which capabilities should be retained internally, outsourced, diversified, or supported through contingency arrangements.

Question 319

An IT governance framework includes many approval steps that have created significant delays without materially reducing risk. What should governance do?

1. Add additional approval levels.
2. Remove every approval requirement.
3. Delegate all decisions to project teams.
4. Review the controls and streamline low-value approval steps while preserving necessary oversight.

Correct Answer: 4

Explanation

Governance should provide appropriate oversight without creating unnecessary bureaucracy. If approval steps cause significant delays without materially reducing risk, the organization should assess their purpose, effectiveness, and risk contribution. Low-value or duplicative approvals can potentially be removed, combined, or delegated while retaining controls that address significant risks and accountability requirements. Adding more approvals would increase inefficiency, while removing every approval requirement could weaken governance. Delegation may be appropriate for lower-risk decisions but should operate within defined authority and escalation thresholds. Streamlining governance based on risk and value can improve decision speed while preserving the controls needed for responsible enterprise technology management.

Question 320

An enterprise wants to strengthen accountability for IT governance outcomes. Which action is MOST effective?

1. Increase the number of governance meetings.
2. Define accountable owners for governance decisions, risks, investments, and expected outcomes.
3. Publish more technical reports.
4. Delegate all accountability to the CIO.

Correct Answer: 2

Explanation

Accountability is strengthened when ownership is explicitly assigned to individuals or roles with appropriate authority. Governance should define accountable owners for significant decisions, investments, risks, benefits, policies, and expected outcomes. This makes it clear who is responsible for action and follow-through. More meetings or technical reports may improve communication but do not inherently establish accountability. Assigning all accountability to the CIO is also inappropriate because many outcomes depend on business executives, service owners, investment sponsors, risk owners, and other stakeholders. Clearly defined accountability supports effective escalation, performance monitoring, benefits realization, and governance transparency while ensuring responsibilities are distributed according to organizational authority.