Isaca CGEIT Online Practice Questions and Exam Preparation

Isaca CGEIT Online Questions & Answers

• Question 1:

  Which of the following roles has PRIMARY accountability for the security related to data assets?

  A. Database administrator
  B. Data owner
  C. Data analyst
  D. Security architect
  B. Data owner

  ---

  The role that has primary accountability for the security related to data assets is the data owner. A data owner is a person who is generally in a senior company position, responsible for the categorization, protection, usage, and quality of one or more data sets. The data owner must ensure that the information within their domain is correctly maintained across various platforms and business processes, and that it is secured from unauthorized access and misuse. The data owner also has the authority to grant or revoke access rights to the data, and to define and enforce data security policies and standards. Therefore, the data owner is the primary accountable role for the security related to data assets. References: Data Owners vs. Data Stewards vs. Data Custodians - CPO Magazine2, CISSP domain 2: Asset security - Infosec Resources

• Question 2:

  An interna! health organization has been notified that a data breach has resulted in patient records being published online. Which of the following is MOST important consideration when determining the process for meeting the organization's legal and regulatory obligations?

  A. Organizational structure, including accountable partes
  B. Data classification and related security policy
  C. Context of the breach, including data ownership and location
  D. Details of how the breach occurred and related incident response efforts
  C. Context of the breach, including data ownership and location

  ---

  When determining the process for meeting an internal health organization's legal and regulatory obligations following a data breach, the most important consideration is the context of the breach, including data ownership and location. Understanding who owns the breached data and where it was stored or processed is crucial for determining jurisdictional and regulatory requirements. This context informs the organization's legal obligations, such as notification requirements and potential liabilities. While organizational structure, data classification, security policy, and details of the breach and incident response efforts are relevant, the context of the breach is paramount in guiding the legal and regulatory response.

• Question 3:

  The use of an enterprise architecture (EA) framework BEST supports IT governance by providing:

  A. key information for IT service level management.
  B. reference models to align IT with business.
  C. IT standards for application development
  D. business information for IT capacity planning.
  B. reference models to align IT with business.

  ---

  An enterprise architecture (EA) framework is a set of principles, guidelines, standards, and tools that help design, plan, implement, and govern the IT architecture of an enterprise. One of themain benefits of using an EA framework is that it provides reference models to align IT with business, such as the Business Architecture, the Information Systems Architecture, and the Technology Architecture. These models help define the business vision, goals, processes, information, and technology requirements of the enterprise, and ensure that they are consistent and coherent across the organization. By using an EA framework, IT governance can ensure that IT supports the business strategy, delivers value, manages risks, and optimizes resources. References: What is enterprise architecture? A framework for transformation TOGAF | opengroup.org

• Question 4:

  A global financial enterprise has been experiencing a substantial number of information security incidents that have directly affected its business reputation. Which of the following should be the IT governance board's FIRST course of action?

  A. Require revisions to how security incidents are managed by the IT department.
  B. Request an IT security assessment to identify the main security gaps.
  C. Execute an IT maturity assessment of the security process.
  D. Mandate an update to the enterprise's IT security policy.
  B. Request an IT security assessment to identify the main security gaps.

  ---

  Requesting an IT security assessment to identify the main security gaps is the IT governance board's first course of action, as it helps to understand the root causes and the extent of the information security incidents that have affected the enterprise's business reputation. An IT security assessment can also provide recommendations and best practices for improving thesecurity posture and reducing the risks of future incidents. References: CGEIT Exam Content Outline, Domain 4, Subtopic B: IT Risk Management, Task 1: Ensure that an IT risk management framework exists to identify, analyze, mitigate, manage, monitor, and communicate IT-related business risk, and that the framework for IT risk management is in alignment with the enterprise risk management (ERM) framework.

• Question 5:

  Forensic analysis revealed an attempted breach of a personnel database containing sensitive data. A subsequent investigation found that no one within the enterprise was aware of the breach attempt, even though logs recorded the unauthorized access actions. To prevent a similar situation in the future, what is MOST important for IT governance to require?

  A. Periodic analyses of logs and databases for unusual activity
  B. A review of the information security and risk management frameworks
  C. The creation of a comprehensive data management and storage policy
  D. The implementation of an intrusion detection and reporting process
  D. The implementation of an intrusion detection and reporting process

• Question 6:

  Which of the following is the BEST way for a CIO to assess the consistency of IT processes against industry benchmarks to determine where to focus improvement initiatives?

  A. Utilizing a capability maturity model
  B. Evaluating the current balanced scorecard
  C. Reviewing key performance measures
  D. Reviewing IT process audit results
  A. Utilizing a capability maturity model

  ---

  Utilizing a capability maturity model is the best way for a CIO to assess the consistency of IT processes against industry benchmarks and determine where to focus improvement initiatives. Capability maturity models provide a structured framework for evaluating the maturity of an organization's processes in comparison to industry best practices. This approach helps identify areas of strength and opportunities for improvement, guiding strategic decisions on where to allocate resources for process enhancements. While balanced scorecards, key performance measures, and IT process audit results are useful, a capability maturity model offers a comprehensive assessment specifically designed for process improvement.

• Question 7:

  Senior management is concerned about the unauthorized use of third-party data that is stored within the enterprise's data repositories. Which of the following is the BEST way to address this concern?

  A. Communicate consequences for staff who misuse third-party data.
  B. Ensure all third-party data in transit is encrypted.
  C. Establish data ownership with clear accountabilities.
  D. Establish optimal retention periods for third-party data.
  C. Establish data ownership with clear accountabilities.

• Question 8:

  When determining the optimal IT service levels to support business, which of the following is MOST important?

  A. IT capacity utilization and availability.
  B. Cost/benefit to the business.
  C. Available IT budget.
  D. Business user requests
  B. Cost/benefit to the business.

  ---

  When determining the optimal IT service levels to support business, the most important factor is the cost/benefit to the business. This means that the IT service levels should be aligned with the business objectives, needs, and expectations, and that the benefits of providing a certain level of IT service should outweigh the costs of delivering it. The cost/benefit analysis should consider both the direct and indirect costs and benefits of IT service levels, such as the impact on customer satisfaction, revenue, productivity, quality, risk, compliance, innovation, and competitive advantage. A cost/benefit analysis can help IT managers justify their IT service level decisions and communicate them effectively to the business stakeholders. References: IT cost/benefit analysis: Why it matters and how to do it right, IT Support Levels Clearly Explained: L1, L2, L3 and More, IT support levels: definition, tiers and advantages, The Importance of Adopting Formal IT Service Management

• Question 9:

  Which of the following should be considered FIRST when migrating data to a cloud environment?

  A. Disaster recovery plan (DRP).
  B. Skills matrix.
  C. Information architecture.
  D. Data structure.
  C. Information architecture.

• Question 10:

  Which of the following is MOST important to ensure when aligning IT and enterprise resource management processes?

  A. IT sourcing processes are in place
  B. IT provides input for business strategy development
  C. IT resources are mapped to business priorities
  D. IT resource monitoring and oversight is in place
  C. IT resources are mapped to business priorities

  ---

  Themost critical factor in aligning IT and enterprise resource managementis ensuring thatIT resources are mapped to business priorities. This guarantees that resource allocation supports strategic objectives and delivers maximum value. Without this alignment, IT efforts may be misdirected, underutilized, or not supporting enterprise goals--even if sourcing and monitoring are in place. CGEIT Review Manual: Domain 2 ?IT Resources COBIT 2019: APO07 (Manage Human Resources), BAI01 (Manage Programs and Projects).