CertArea
All ISACA exams

Free Certified in the Governance of Enterprise IT (CGEIT) practice test: 30 questions with answers

30 original questions for Certified in the Governance of Enterprise IT (CGEIT), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Certified in the Governance of Enterprise IT (CGEIT) exam guide: topics, cost and format

All 30 Certified in the Governance of Enterprise IT (CGEIT) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Governance of Enterprise IT (8 questions)

  1. Question 1

    Which governance principle requires that IT decisions involve business leadership, so that they share ownership of IT value?

    1. AAnnual budget freezes that prevent any IT investment from proceeding, regardless of the business need for it
    2. BTechnical autonomy, where the IT function alone decides which investments are made without business input
    3. CProcurement-only control, where purchasing rules replace all other governance decisions for the enterprise
    4. DStakeholder engagement, where business leaders co-own IT decisions and the value they are expected to deliver
    Show answer and explanation
    Correct answer: D

    Stakeholder engagement means business leaders share ownership of IT decisions and value. Technical autonomy, procurement-only control and budget freezes each remove the business from governance decisions.

  2. Question 2

    What is the main role of an enterprise IT governance framework?

    1. ATo replace the enterprise's business strategy with an IT-specific plan that the IT function writes alone
    2. BTo list every software product the enterprise has ever purchased, kept for historical reference only
    3. CTo set the decision rights, accountability and oversight mechanisms that align IT with enterprise objectives
    4. DTo assign IT staff to the most visible projects each quarter, so that their work is noticed by leaders
    Show answer and explanation
    Correct answer: C

    A governance framework sets decision rights, accountability and oversight that align IT with enterprise objectives. Product lists, replacing strategy and visibility-based staffing are not its role.

  3. Question 3

    Which element links IT strategy to the enterprise's business strategy?

    1. AThe vendor list used by the purchasing team for hardware, with each vendor's contact details for ordering
    2. BThe network diagram of the head office showing each cable run in the building for the facilities team
    3. CThe staff roster of the IT service desk for the coming year, showing the shift patterns of each team
    4. DEnterprise architecture and an IT strategy that can be traced to business goals and their measures
    Show answer and explanation
    Correct answer: D

    Enterprise architecture and an IT strategy traceable to business goals link the two strategies. Diagrams, rosters and vendor lists do not link strategies.

  4. Question 4

    A board asks how it will know that IT governance is working. Which approach answers this best?

    1. ADefined governance KPIs, such as strategic alignment and value delivery, reported regularly to the board
    2. BThe number of meetings the IT committee held during the year, shown as the main output of governance
    3. CThe number of IT staff who passed certification exams in the last year, taken as the measure of capability
    4. DThe age of the IT asset inventory spreadsheet, which indicates how recently the governance team reviewed it
    Show answer and explanation
    Correct answer: A

    Defined KPIs such as strategic alignment and value delivery, reported regularly, show whether governance is effective. Meeting counts, certification numbers and spreadsheet age measure activity rather than outcomes.

  5. Question 5

    Which governance responsibility sits with the board rather than with IT management?

    1. AApproving the enterprise's IT risk appetite and overseeing IT-related risk across the organisation
    2. BWriting the change tickets for each server patch in the data centre as part of the routine work
    3. CSelecting the monitoring tool for the service desk each year, based on the team's preferred vendor
    4. DSetting the password length for the help desk's internal accounts, which is an operational decision
    Show answer and explanation
    Correct answer: A

    The board approves risk appetite and oversees IT risk. Change tickets, tool selection and password settings are management and operational responsibilities.

  6. Question 6

    Which TWO are valid outputs of an effective IT governance function? (Choose two.)

    1. AClear decision rights and accountability for the major IT investments the enterprise makes
    2. BUnreviewed exceptions to every IT policy, approved informally by any manager who is available at the time
    3. CDocumented IT policies and standards approved by the governing body on the enterprise's behalf
    4. DGovernance decisions made only by the vendor's account team, based on the products it wants to sell
    5. EStrategy that changes every week, without any stated business rationale recorded for the change
    Show answer and explanation
    Correct answer: A, C

    Clear decision rights and approved policies are core governance outputs. Informal exceptions, vendor-made decisions and unexplained weekly strategy changes all undermine governance.

  7. Question 7

    Which TWO are benefits of a benefits realisation approach in IT governance? (Choose two.)

    1. AInvestments are tracked against expected outcomes after delivery, not only against their budget
    2. BBenefits are claimed at approval time and are never measured again after the investment has been made
    3. CProjects with no measurable benefit are stopped earlier in their life cycle, saving the funds involved
    4. DBusiness owners are excused from the outcomes of the projects they sponsor, so the team can focus on delivery
    5. EReporting shifts from outputs to activity counts, so that the number of tasks completed becomes the headline
    Show answer and explanation
    Correct answer: A, C

    Tracking outcomes after delivery and stopping projects without measurable benefit both improve value. Benefits claimed only at approval, excused sponsors and activity-based reporting all weaken governance.

  8. Question 8

    Which committee typically oversees IT investment priorities across business units?

    1. AAn IT steering or investment committee, with business and IT representation and approved decision criteria
    2. BA single developer who chooses which projects to build next based on personal interest in the work
    3. CThe help desk supervisor, who decides priorities based on the order in which the calls are received each day
    4. DThe vendor's account team, which allocates the enterprise's investment budget across the business units
    Show answer and explanation
    Correct answer: A

    An investment committee with business and IT representation and defined criteria sets priorities. A developer, help desk supervisor or vendor account team lacks enterprise authority over investment priorities.

Risk Optimization (8 questions)

  1. Question 9

    What does risk optimisation in IT governance aim to achieve?

    1. ARecording IT risks without deciding how to respond to any of them, so that the register remains complete
    2. BEliminating every IT risk, regardless of the cost of doing so or the value that is forgone as a result
    3. CTransferring all IT risk to the vendor without any review of its ability to carry that risk in practice
    4. DBalancing IT risk and opportunity, so that risk is kept within appetite while value is pursued
    Show answer and explanation
    Correct answer: D

    Risk optimisation balances risk and opportunity within appetite. Eliminating all risk, transferring it without review and recording without response do not optimise risk.

  2. Question 10

    Which element defines how much IT risk the enterprise is willing to accept?

    1. AThe number of firewalls installed at the enterprise's sites during the year, as recorded in the inventory
    2. BThe IT risk appetite and tolerance, approved by the governing body on behalf of the enterprise
    3. CThe vendor's standard warranty period for each hardware item the enterprise has bought in the period
    4. DThe size of the IT department, measured in headcount, for the year in which the budget was approved
    Show answer and explanation
    Correct answer: B

    The risk appetite and tolerance, approved by the governing body, define acceptable risk. Firewall counts, warranty periods and headcount do not define risk acceptance.

  3. Question 11

    Which approach keeps IT risk information current for decision makers?

    1. AReplacing risk reporting with a summary of cost savings alone, which is easier for executives to read
    2. BProducing a risk report only once every three years, for the archive of the enterprise's records
    3. CSharing the risk register only with the IT staff who created it, so that it stays within the team
    4. DRegular risk reporting with key risk indicators, trends and the status of each treatment action
    Show answer and explanation
    Correct answer: D

    Regular reporting with KRIs, trends and treatment status keeps decision makers informed. Triennial reports, team-only registers and cost-only summaries do not.

  4. Question 12

    What is a key input to IT risk assessment for governance purposes?

    1. AThe enterprise's objectives and critical processes, with the threats and vulnerabilities affecting them
    2. BThe colour of the risk team's branding on the internal intranet site used by the staff each week
    3. CThe number of cups of coffee consumed by the team during the risk workshop held on the first day
    4. DThe personal social media accounts of the IT staff, reviewed to check for any public comments on work
    Show answer and explanation
    Correct answer: A

    Objectives, critical processes, threats and vulnerabilities are the core inputs to risk assessment. Branding, coffee and personal social media are not inputs.

  5. Question 13

    Which situation should trigger a review of IT risk treatment?

    1. AA staff member changing their desk location within the same building, without any change to their role
    2. BA new coffee machine being installed in the office kitchen next door to the team's main floor area
    3. CA material change to the business, technology, regulation or the threat landscape the enterprise faces
    4. DA routine change in the colour of the risk register's header row, made to update the template each year
    Show answer and explanation
    Correct answer: C

    Material changes to business, technology, regulation or threats should trigger a treatment review. Coffee machines, desk moves and header colours are not material risk changes.

  6. Question 14

    Which role is accountable for IT risk in an enterprise governance model?

    1. AThe external auditor, who owns the risk decisions that are taken during the course of the year for the client
    2. BThe vendor's account manager, who is responsible for all risk across the enterprise on behalf of the buyer
    3. CThe business and risk owners who accept and manage IT risk within their own areas of responsibility
    4. DThe most junior analyst in the IT team, who is responsible for each treatment decision made by the function
    Show answer and explanation
    Correct answer: C

    Business and risk owners are accountable for accepting and managing IT risk in their areas. Vendors, external auditors and junior analysts do not own enterprise risk decisions.

  7. Question 15

    Which TWO are appropriate risk responses for an IT risk? (Choose two.)

    1. AIgnoring the risk because it has not yet caused an incident in the enterprise to date
    2. BCreating the risk deliberately to test the controls, without any approval from the governance body
    3. CMitigating the risk by implementing controls that reduce its likelihood or its impact on the enterprise
    4. DHiding the risk from the board so that it does not affect the investment decisions made by the board
    5. EAccepting the risk formally within appetite, with a named owner and a scheduled review date for it
    Show answer and explanation
    Correct answer: C, E

    Mitigation through controls and formal acceptance within appetite with an owner and review date are valid responses. Ignoring, creating risk without approval and hiding risk from the board are not valid responses.

  8. Question 16

    Which governance practice best supports the integration of IT risk into enterprise risk management?

    1. AKeeping IT risk in a separate register that is never shared with the enterprise risk committee or its members
    2. BUsing common risk criteria and reporting structures, so that IT risk is assessed alongside other enterprise risks
    3. CTreating IT risk as a technical matter only, to be reported to the executive team in a single annual meeting
    4. DLetting each business unit decide whether its IT risks are included in the enterprise risk process each year
    Show answer and explanation
    Correct answer: B

    Common criteria and structures integrate IT risk with enterprise risk management. Separate unshared registers, technical-only treatment and optional inclusion prevent integration.

Benefits Realization (7 questions)

  1. Question 17

    What is benefits realisation in IT governance?

    1. AThe practice of recording each IT benefit once, at project approval, and then closing the project file
    2. BThe process of identifying, planning, tracking and realising the value that IT investments are expected to deliver
    3. CCounting the number of features delivered by a project without assessing whether those features create value
    4. DReducing all of the benefits of IT to a single cost-saving figure for the annual budget discussion
    Show answer and explanation
    Correct answer: B

    Benefits realisation is the process of identifying, planning, tracking and realising the expected value. Recording benefits once, counting features and reducing benefits to one figure do not track value.

  2. Question 18

    Which element should be defined at the start of an IT investment?

    1. AThe list of vendor logos to be used in the project's presentations to the steering committee members
    2. BThe colour of the project's status board in the programme office on the floor of the business
    3. CThe expected benefits, their measures and the owners responsible for realising them
    4. DThe name of the project manager's favourite lunch venue, to help the team plan its meetings
    Show answer and explanation
    Correct answer: C

    Expected benefits, their measures and owners should be defined at the start. Board colours, logos and lunch venues do not define benefits.

  3. Question 19

    When should the benefits of an IT project be reviewed after it delivers?

    1. AAt agreed points after go-live, comparing actual benefits with the business case
    2. BNever, since the benefits are assumed to appear automatically once a system has gone live for the users
    3. COnly if the project was late or over budget at the point it was delivered to the business
    4. DOn the day the project closes, before any users have started to use the system in their daily work
    Show answer and explanation
    Correct answer: A

    Reviews at agreed points after go-live compare actual benefits with the business case. Never reviewing, reviewing only when problems occur and reviewing before users start do not measure realised benefit.

  4. Question 20

    Which risk most often prevents IT benefits from being realised?

    1. ALack of business adoption and change management, so that new systems are not used as intended
    2. BA slow internet connection for the staff's personal devices at home, used outside the working day
    3. CUsing too many colours in the project's slide deck for the steering committee meetings each month
    4. DToo many meetings held with the business sponsors each month, which reduces the time for delivery
    Show answer and explanation
    Correct answer: A

    Poor adoption and weak change management are the most common causes of unrealised benefits. Home connections, slide colours and meeting counts are not typical causes.

  5. Question 21

    Which action helps ensure that a benefit is realised rather than only assumed?

    1. ARemoving the measure so that the benefit cannot be challenged later when the results are reviewed
    2. BRecording the benefit in the minutes of the kick-off meeting and then not returning to it afterwards
    3. CAssigning a business owner who is accountable for the benefit and for measuring it
    4. DLetting the vendor define the benefit in its own marketing material for the product's launch to customers
    Show answer and explanation
    Correct answer: C

    A named business owner accountable for the benefit and its measurement makes realisation a managed outcome. Minutes, removing measures and vendor-defined benefits do not ensure realisation.

  6. Question 22

    What should happen when a benefit becomes at risk during a project?

    1. AThe benefit is quietly dropped from the report without any decision being recorded for the governance record
    2. BThe risk is hidden from the steering committee until the project has been completed and closed off
    3. CThe risk is escalated, a treatment is agreed and the business case is updated as needed
    4. DThe project is extended indefinitely without any change to the benefit plan or to the business case
    Show answer and explanation
    Correct answer: C

    Escalating the risk, agreeing a treatment and updating the business case keeps governance informed and decisions recorded. Hiding, dropping silently and extending indefinitely all avoid accountability.

  7. Question 23

    Which TWO are valid measures of IT benefit realisation? (Choose two.)

    1. AThe number of user logins to a new system in its first week, with no link to the business outcome sought
    2. BTime saved in a business process compared with the baseline measured before the change was introduced
    3. CThe number of hours the project team logged on the timesheet, regardless of the results it achieved for the business
    4. DThe count of tickets closed by the team in the quarter, which has no connection to the investment itself
    5. ERevenue or cost changes attributable to the investment, compared with the agreed baseline for the process
    Show answer and explanation
    Correct answer: B, E

    Time saved and attributable revenue or cost change against baseline measure realised benefit. Logins, timesheet hours and ticket counts measure activity rather than benefit.

IT Resources (7 questions)

  1. Question 24

    Which resource category covers the skills and competencies the enterprise needs from its IT staff?

    1. AThe physical floor space of the data centre, measured in square metres for the facilities team's planning
    2. BThe human resources domain of IT, including skills, competencies and workforce planning for the function
    3. CThe internet bandwidth contract with the carrier, measured in megabits per second for the connection
    4. DThe software licence key register kept by the finance team for the accounting records of the enterprise
    Show answer and explanation
    Correct answer: B

    The human resources domain covers skills, competencies and workforce planning. Floor space, bandwidth contracts and licence registers are other resource categories.

  2. Question 25

    Which practice helps optimise the use of IT resources?

    1. ARunning every application on its own dedicated hardware regardless of its load, to keep the systems separate
    2. BBuying the largest capacity available regardless of demand, to avoid any shortage at a later date in the year
    3. CLeaving unused licences assigned to former staff indefinitely, in case they return to the enterprise later on
    4. DCapacity planning linked to demand forecasts, with periodic review of utilisation against those forecasts
    Show answer and explanation
    Correct answer: D

    Capacity planning linked to demand, with utilisation review, optimises resource use. Oversizing, retaining unused licences and dedicating hardware regardless of load all waste resources.

  3. Question 26

    Which element helps manage third-party IT service providers effectively?

    1. AVerbal agreements with the vendor's account manager, made during meetings and not written down afterwards
    2. BService levels, performance reporting and audit rights defined in the contract with the provider
    3. CChoosing providers only by the lowest annual price, regardless of the service levels they are able to offer
    4. DIgnoring vendor performance unless the service desk receives a complaint from one of its users about it
    Show answer and explanation
    Correct answer: B

    Defined service levels, reporting and audit rights in the contract allow effective oversight. Verbal agreements, price-only selection and ignoring performance all weaken control.

  4. Question 27

    What is the purpose of an IT asset inventory in governance?

    1. ATo know which assets exist, who owns them and their value, to support decisions and risk management
    2. BTo count the number of desktop wallpapers used across the organisation, for the team's branding review
    3. CTo list only the assets bought in the previous financial year, for the annual accounts of the company
    4. DTo track the colours of the hardware for the facilities team, so that equipment matches the office decor
    Show answer and explanation
    Correct answer: A

    An asset inventory records what exists, who owns it and its value, which underpins governance decisions. Wallpaper counts, purchase-year lists and hardware colours are not governance purposes.

  5. Question 28

    Which approach supports sound sourcing decisions for IT services?

    1. AOutsourcing automatically whatever the business case or the risk profile of the service might say
    2. BComparing in-house and outsourced options on cost, risk, control and strategic fit
    3. CKeeping every service in-house regardless of its capability needs or the cost of running it internally
    4. DSelecting the supplier whose sales team sent the most emails to the decision makers last month
    Show answer and explanation
    Correct answer: B

    Comparing options on cost, risk, control and strategic fit supports sound sourcing. Automatic outsourcing, fixed in-house sourcing and email-driven choice ignore the evidence.

  6. Question 29

    Which statement about IT infrastructure investment is most accurate?

    1. AInfrastructure never needs a lifecycle plan once it has been installed in the rack and switched on for use
    2. BInfrastructure should be planned against the enterprise's needs and its lifecycle, rather than bought ad hoc
    3. CInfrastructure decisions should be made by the most junior staff member, to keep the approval process quick
    4. DInfrastructure is always cheaper to buy each time than to plan for in advance, so planning is unnecessary
    Show answer and explanation
    Correct answer: B

    Planning infrastructure against needs and lifecycle avoids ad hoc spending and risk. The other statements ignore lifecycle, decision authority and cost.

  7. Question 30

    Which TWO are typical IT resource risks that governance should address? (Choose two.)

    1. ASingle points of failure in critical infrastructure, with no tested recovery path for the affected services
    2. BA well-documented skills matrix that is updated each year by the human resources and IT teams together
    3. CKey-person dependency for critical IT skills, with no succession plan in place for the roles involved
    4. DRegular vendor performance reviews, with agreed actions tracked to completion by the governance body
    5. EA tested capacity plan with headroom for growth, which is reviewed against the forecast demand regularly
    Show answer and explanation
    Correct answer: A, C

    Single points of failure and key-person dependency are typical resource risks governance must address. Skills matrices, vendor reviews and capacity plans are controls that reduce risk.