Isaca CGEIT Online Practice Questions and Exam Preparation

Isaca CGEIT Online Questions & Answers

• Question 131:

  An enterprise is planning to migrate its IT infrastructure to a cloud-based solution but does not have experience with this technology Which of the following should be done FIRST to reduce the risk of IT service disruptions when using this new technology?

  A. Implement key performance indicators (KPIs).
  B. Reflect the change in the enterprise architecture (EA).
  C. Evaluate the sourcing options.
  D. Engage an experienced IT consultant to perform the migration.
  D. Engage an experienced IT consultant to perform the migration.

  ---

  An enterprise that is planning to migrate its IT infrastructure to a cloud-based solution but does not have experience with this technology should first engage an experienced IT consultant to perform the migration, because this would reduce the risk of IT service disruptions when using this new technology. An experienced IT consultant can help the enterprise to assess the feasibility, benefits, and risks of the cloud migration, design and implement a suitable cloud architecture, and ensure a smooth transition and integration of the existing and new IT systems. An experienced IT consultant can also provide guidance and training to the enterprise's IT staff on how to manage and operate the cloud-based solution effectively and securely. References: ISACA, CGEIT Review Manual, 7th Edition, 2019, page 65-66.

• Question 132:

  The BEST way for a CIO to justify maintaining and supporting social media platforms is by demonstrating:

  A. how social media technology fits into the IT investment management process.
  B. that service level agreements (SLAs) for social media technologies have been met.
  C. the IT performance Of social media technologies.
  D. the value derived from investment in social media technologies.
  D. the value derived from investment in social media technologies.

  ---

  The best way for a CIO to justify maintaining and supporting social media platforms is by demonstrating the value derived from investment in social media technologies. Social media platforms are not just tools for communication and entertainment, but also strategic assets that can create and deliver value to the organization and its stakeholders. Some of the potential benefits of social media platforms are: Enhancing customer engagement, loyalty, and satisfaction by providing timely, personalized, and interactive content and feedback Increasing brand awareness, reputation, and trust by showcasing the organization's values, achievements, and social responsibility Improving innovation and collaboration by facilitating the exchange of ideas, knowledge, and feedback among employees, customers, partners, and experts Supporting decision making and problem solving by providing access to relevant data, insights, and analytics Reducing costs and increasing efficiency by streamlining processes, automating tasks, and optimizing resources

• Question 133:

  The MOST successful IT performance metrics are those that:

  A. measure financial results.
  B. measure all areas.
  C. are approved by the stakeholders.
  D. contain objective measures.
  D. contain objective measures.

  ---

  The most successful IT performance metrics are those that contain objective measures that can be quantified and verified. Objective measures are more reliable, consistent, and repeatable than subjective measures, which may vary depending on the perspective or opinion of the stakeholders. Objective measures also help to align IT performance goals with business goals and to communicate the value of IT to the rest of the organization. According to one source1, a good metric is linear, reliable, repeatable, easy to use, consistent and independent. References: ISACA, CGEIT Review Manual, 27th Edition, 2020, page 11; Performance Measurement Metrics for IT Governance

• Question 134:

  Which of the following is the BEST way to implement effective IT risk management?

  A. Align with business risk management processes.
  B. Establish a risk management function.
  C. Minimize the number of IT risk management decision points.
  D. Adopt risk management processes.
  A. Align with business risk management processes.

  ---

  Effective IT risk management is not a standalone process, but rather a part of the overall business risk management framework. IT risks are interrelated with business risks, and they can affect the achievement of business objectives and strategies. Therefore, IT risk management should align with business risk management processes, such as identifying, assessing, prioritizing, treating, monitoring, and reporting risks. Aligning IT risk management with business risk management processes can help ensure that IT risks are considered in the context of the business environment, that IT risk appetite and tolerance are consistent with the business risk appetite and tolerance, that IT risk responses are aligned with the business risk responses, and that IT risk performance is communicated to the relevant stakeholders. Aligning IT risk management with business risk management processes can also help optimize the use of resources, enhance the value of IT investments, and improve the governance and accountability of IT risks.

• Question 135:

  The PRIMARY objective of IT resource planning within an enterprise should be to:

  A. determine risk associated with IT resources.
  B. maximize value received from IT.
  C. determine IT outsourcing options.
  D. finalize service level agreements (SLAs) for IT
  B. maximize value received from IT.

  ---

  IT resource planning is the process of identifying, allocating, and managing the IT resources needed to support the enterprise's objectives and strategies. The primary objective of IT resource planning should be to maximize the value received from IT, which means ensuring that the IT resources are aligned with the business needs, optimized for efficiency and effectiveness, and delivering the expected benefits and outcomes. IT resource planning should also consider the risks, costs, and opportunities associated with IT resources, as well as the service level agreements (SLAs) and outsourcing options that may affect the quality and availability of IT services. References: CGEIT Exam Content Outline | ISACA1, CGEIT Review Manual (Digital Version), What are the Objectives of Resource Management? | Kantata2, What Is Resource Planning: A Comprehensive Guide3

• Question 136:

  In which of the following situations is it MOST appropriate to use a quantitative risk assessment?

  A. There is a lack of accurate and reliable past and present risk data.
  B. The risk assessment needs to be completed in a short period of time.
  C. The objectivity of the risk assessment is of primary importance.
  D. The risk assessment is needed for an IT project business case.
  C. The objectivity of the risk assessment is of primary importance.

  ---

  Quantitative risk assessment is more objective than qualitative risk assessment because it uses numeric values and calculations to estimate the likelihood and impact of risks. Quantitative risk assessment is more appropriate when the risk assessment needs to be unbiased and consistent. References: ISACA, CGEIT Review Manual, 7th Edition, 2019, p. 90-91.

• Question 137:

  Senior management wants to promote investment in IT, but is uncertain that associated risks are being properly identified. The BEST way to address this concern is to:

  A. engage an external consultant to develop risk scenarios.
  B. appoint an IT representative to the business risk committee.
  C. assign an IT cost controller to the finance department.
  D. ensure business cases are developed by IT.
  B. appoint an IT representative to the business risk committee.

  ---

  Appointing an IT representative to the business risk committee is the best way to address senior management's concern about IT investment risks, as it would ensure that IT risks are properly identified, assessed, and communicated to the business stakeholders. The IT representative would also be able to align IT risk management with the enterprise's risk appetite and strategy, and provide input and feedback on the IT investment decisions. The other options are not as effective, as they do not involve direct collaboration and communication between IT and business on risk matters. References: CGEIT Review Manual (Digital Version), Chapter 4: Risk Optimization, Section 4.3: IT Risk Management, Subsection 4.3.1: IT Risk Management Overview, Page 153 : CGEIT Review Manual (Digital Version), Chapter 4: Risk Optimization, Section 4.3: IT Risk Management, Subsection 4.3.2: IT Risk Management Process, Page 156 :CGEIT Review Manual (Digital Version), Chapter 4: Risk Optimization, Section 4.3: IT Risk Management, Subsection 4.3.5: Roles and Responsibilities for IT Risk Management, Page 161

• Question 138:

  A large organization with branches across many countries is in the midst of an enterprise resource planning (ERP) transformation. The IT organization receives news that the branches in a country where the impact to the enterprise is to be

  greatest are being sold.

  What should be the NEXT step?

  A. Update the ERP business case and re-evaluate the ROI.
  B. Cancel the ERP transformation and re-allocate project funds.
  C. Adjust the ERP implementation plan and budget.
  D. Continue with the ERP migration according to plan.
  C. Adjust the ERP implementation plan and budget.

  ---

  The next step for the IT organization when they receive news that the branches in a country where the impact to the enterprise is to be greatest are being sold is to adjust the ERP implementation plan and budget. This means that the IT organization should assess the implications of the sale on the ERP transformation objectives, scope, timeline, resources, costs, and risks. The IT organization should also communicate with the relevant stakeholders, such as the business units, the vendors, and the buyers, to coordinate and align the ERP activities with the sale process. The IT organization should then revise the ERP implementation plan and budget to reflect the changes and ensure that the ERP transformation delivers value to the remaining enterprise

• Question 139:

  Which of the following is a PRIMARY responsibility of the CIO when an enterprise plans to replace its enterprise resource applications?

  A. Reviewing the IT application portfolio
  B. Evaluating and selecting application vendors
  C. Ensuring IT architecture requirements are considered
  D. Establishing software quality criteria
  C. Ensuring IT architecture requirements are considered

  ---

  The CIO is the chief information officer of an enterprise, who oversees and optimizes the use of information technology (IT) to achieve the business objectives and strategy. One of the primary responsibilities of the CIO is to ensure that IT architecture requirements are considered when an enterprise plans to replace its enterprise resource applications (ERAs). ERAs are integrated software systems that support various business functions, such as finance, accounting, human resources, supply chain, etc. IT architecture requirements are the specifications and standards that define how the IT systems and platforms should be designed, developed, deployed, and maintained to support the ERAs and their users. IT architecture requirements include aspects such as performance, scalability, security, reliability, interoperability, usability, etc. The CIO should ensure that IT architecture requirements are considered when an enterprise plans to replace its ERAs, because they can affect the quality, efficiency, and effectiveness of the ERAs and their alignment with the business needs and goals. The CIO should also ensure that the IT architecture requirements are consistent with the enterprise's IT strategy and vision, and that they comply with the relevant policies, regulations, and best practices.

• Question 140:

  An enterprise has decided to adopt cloud services. Which of the following should be established FIRST?

  A. Service level agreements (SLAs)
  B. Business continuity plan (BCP)
  C. Risk tolerance levels
  D. Third-party management framework
  C. Risk tolerance levels

  ---

  Before adopting cloud services, it is critical to establish the organization's risk tolerance levels. This ensures that decisions regarding the use of cloud services align with the enterprise's ability and willingness to accept risk, such as data exposure or operational disruptions. Risk tolerance informs the creation of SLAs, third-party management frameworks, and BCPs, making it a foundational step. References: ISACA Cloud Computing Governance guidelines, CGEIT Exam Manual.