Isaca CGEIT Online Practice Questions and Exam Preparation

Isaca CGEIT Online Questions & Answers

• Question 301:

  A financial services company has implemented the use of a cloud-based centralized customer relationship management (CRM) system. The company has decided to go multi- national. Which of the following should be the enterprise risk management (ERM) committee's PRIMARY consideration?

  A. Security issues
  B. Vendor capability
  C. Return on investment (ROI)
  D. Compliance issues
  D. Compliance issues

  ---

  Compliance issues should be the primary consideration for the ERM committee because using a cloud-based CRM system in a multi-national context may involve different legal and regulatory requirements regarding data privacy, protection, localization, and transfer. The ERM committee should ensure that the company and the cloud service provider comply with the applicable laws and standards of each country where they operate, as well as the industry-specific regulations such as PCI DSS or GDPR. Compliance issues may also affect the security, vendor capability, and ROI of the cloud-based CRM system, as non- compliance may result in fines, penalties, reputational damage, or loss of customers.

• Question 302:

  Executive management is concerned that IT has not achieved its performance targets. At the end of the fiscal year, it was noted the reason was largely due to insufficient spending on key IT initiatives. Which of the following would help to alleviate the issue for the coming year?

  A. Key risk indicators (KRIs)
  B. Stage gate reviews
  C. Lag indicators
  D. Lead indicators
  D. Lead indicators

  ---

  Lead indicatorsare proactive metrics that provide early signals of performance, enabling timely action before outcomes are realized. In this case, insufficient investment led to missed targets--a lead indicator could help forecast spending trends or progress toward milestones before year-end. Lag indicators (e.g., annual performance) show outcomes after the fact. KRIs and stage gates are valuable but are not direct predictors of performance outcomes related to investment levels. CGEIT Review Manual: Domain 3 ?Benefits Realization:";Lead indicators are essential for performance forecasting and timely intervention." COBIT 2019: BAI09 (Manage Performance and Capacity).

• Question 303:

  Which of the following is the BEST approach to assist an enterprise in planning for IT- enabled investments?

  A. Enterprise architecture (EA).
  B. IT process mapping
  C. Task management
  D. Service level management
  A. Enterprise architecture (EA).

  ---

  The best approach to assist an enterprise in planning for IT-enabled investments is enterprise architecture (EA). EA is a holistic and integrated view of the current and future state of the business, IT, and their alignment. EA helps to identify and prioritize the business needs andobjectives, and to design and deliver the IT solutions that support them. EA also helps to optimize the IT resources and processes, and to ensure that they are aligned with the business strategy and goals. EA also helps to measure and monitor the IT performance and outcomes, and to evaluate the value and benefits of the IT investments. EA also helps to manage the risks, costs, and complexity of the IT investments, and to ensure that they comply with the legal and regulatory requirements. IT process mapping, task management, and service level management are not as comprehensive or effective as EA in assisting an enterprise in planning for IT-enabled investments. IT process mapping is a visual representation of a process that shows the steps and their relationships. It can help to understand how a process works, but it does not provide a strategic or architectural view of the business or IT. Task management is a process of managing individual or group tasks to achieve goals. It can help to track and delegate work, but it does not address the alignment or optimization of IT with the business. Service level management is a process of defining, documenting, and agreeing on service levels within an IT service management system. It can help to ensure that services are delivered at an agreed level, but it does not cover the design or delivery of IT solutions that meet the business needs. Therefore, EA is the best approach to assist an enterprise in planning for IT-enabled investments.

• Question 304:

  Which of the following is the BEST way to address the risk associated with new IT investments?

  A. Develop security best practices to protect applications.
  B. Integrate security requirements at the beginning of projects
  C. Establish an enterprise-wide incident response process.
  D. Implement an enterprise-wide security awareness program.
  B. Integrate security requirements at the beginning of projects

  ---

  The best way to address the risk associated with new IT investments is to integrate security requirements at the beginning of projects. This means that security is considered as a key factor in the planning, design, development and testing phases of IT projects. By doing so, organizations can ensure that security is built into the IT solutions, rather than added as an afterthought. This can help to prevent or reduce security vulnerabilities, breaches, incidents and costs. Integrating security requirements at the beginning of projects is also consistent with the IT risk management frameworks that recommend a proactive and preventive approach to IT risk management. References: Proactive IT Risk Management in an Era of Emerging Technologies, IT Risk Management Process and Frameworks

• Question 305:

  A new chief information officer (CIO) of an enterprise recommends implementing portfolio management after realizing there is no process in place for evaluating investments prior to selection. What should be the PRIMARY strategic goal driving this decision?

  A. Maximize value from the combined investments.
  B. Standardize processes for investment evaluation.
  C. Align investments to the enterprise architecture (EA).
  D. Enable transparency within the investment process.
  A. Maximize value from the combined investments.

  ---

  Portfolio management is the process of selecting, prioritizing, monitoring and controlling the projects, programs and other related work that best align with the enterprise's strategic objectives and deliver the most value to the stakeholders. The primary strategic goal of implementing portfolio management is to maximize value from the combined investments by ensuring that they are aligned with the enterprise's vision, mission, goals and values, and that they are optimized in terms of risk, return and resource allocation. References: CGEIT Domain 2: IT Resources

• Question 306:

  Which of the following is the GREATEST benefit of using the life cycle approach to govern information assets?

  A. Overall costs are optimized
  B. Operational costs are maintained
  C. Information availability is improved
  D. Compliance with regulatory requirements is ensured
  A. Overall costs are optimized

  ---

  Using the life cycle approach to govern information assets is the greatest benefit for an organization, because it helps to optimize the overall costs associated with the creation, storage, processing, distribution, and disposition of information. The life cycle approach involves managing information according to its value, utility, and risk throughout its lifespan. By using the life cycle approach, an organization can ensure that it only collects, creates, and retains the information that is relevant, accurate, and useful for its business objectives and processes. It can also ensure that it stores, protects, and disposes of the information in a cost-effective and secure manner, complying with the legal and regulatory requirements. The life cycle approach also helps to improve the performance, availability, and accessibility of the information, as well as its quality and integrity. By using the life cycle approach, an organization can reduce the operational costs, storage costs, compliance costs, and risk exposure costs associated with its information assets. Therefore, using the life cycle approach to govern information assets is the greatest benefit for an organization. References: What is Information Lifecycle Management (ILM)?, Information Lifecycle Management: A Comprehensive Guide, Information Lifecycle Management (ILM) - Gartner IT Glossary, The Comprehensive Guide to Information Lifecycle Management.

• Question 307:

  An enterprise has made the strategic decision to begin a global expansion program which will require opening sales offices in countries across the world. Which of the following should be the FIRST consideration with regard to the IT service desk which will remain centralized?

  A. The effect of regional differences on service delivery
  B. Identification of IT service desk functions that can be outsourced
  C. Enforcement of a standardized policy across all regions
  D. Availability of adequate resources to provide support for new users
  A. The effect of regional differences on service delivery

  ---

  The first consideration with regard to the IT service desk that will remain centralized is the effect of regional differences on service delivery. This is because regional differences can pose various challenges and opportunities for the IT service desk, such as: Language and cultural barriers: The IT service desk staff should be able to communicate effectively and respectfully with customers from different countries and backgrounds, and understand their needs, preferences, and expectations. This may require hiring multilingual staff, providing language training, using translation tools, or outsourcing some services to local providers. Time zone differences: The IT service desk should be able to provide timely and consistent support to customers across different time zones, and avoid delays or disruptions in service delivery. This may require extending the service hours, implementing shift work, using automation tools, or outsourcing some services to local providers. Legal and regulatory differences: The IT service desk should be aware of and comply with the local laws and regulations that apply to the IT services they provide, such as data protection, privacy, security, taxation, and consumer rights. This may require conducting a risk assessment, obtaining legal advice, implementing policies and procedures, or outsourcing some services to local providers. Technical and operational differences: The IT service desk should be able to adapt to the technical and operational requirements and challenges of the different regions they serve, such as network connectivity, bandwidth, infrastructure, devices, software, standards, and best practices. This may require conducting a feasibility study, investing in technology upgrades, implementing quality assurance measures, or outsourcing some services to local providers. The other options, identification of IT service desk functions that can be outsourced, enforcement of a standardized policy across all regions, and availability of adequate resources to provide support for new users are also important considerations for the IT service desk that will remain centralized, but they are not the first one. They are more related to the implementation and execution of the IT service desk strategy, rather than its design. They are also influenced by the regional differences factor, as they depend on the level of variation and complexity that the IT service desk faces in different regions. References: Five Ways to Provide a World Class Service Desk Experience, How to Run an IT Service Desk in a Hybrid or Remote World - Gartner, Best Practices for Building a Service Desk | Atlassian, The Top 18 Help Desk Metrics and Best Practices -HubSpot Blog

• Question 308:

  A new CIO has been charged with updating the IT governance structure. Which of the following is the MOST important consideration to effectively influence organizational and process change?

  A. Obtaining guidance from consultants
  B. Aligning IT services to business processes
  C. Redefining the IT risk appetite
  D. Ensuring the commitment of stakeholders
  D. Ensuring the commitment of stakeholders

  ---

  Ensuring the commitment of stakeholders is the most important consideration to effectively influence organizational and process change, as it involves engaging and communicating with the key parties who have an interest or influence in the IT governance structure. Stakeholder commitment can help to overcome resistance, gain support, and ensure alignment and collaboration among the enterprise units. Stakeholder commitment can also facilitate theadoption and implementation of the IT governance framework, policies, and standards . References: CGEIT Exam Content Outline, Domain 1, Subtopic A: Governance Framework, Task 3: Ensure that stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritization and decision making; and monitoring performance and compliance against agreed-on direction and objectives.

• Question 309:

  Which of the following is MOST important to ensure that IT project selections meet the enterprise's business requirements?

  A. Development of an enterprise architecture (EA).
  B. Business participation in the selection of IT projects.
  C. Implementation of project stage gates.
  D. Creation of thorough business cases prior to IT project selection.
  B. Business participation in the selection of IT projects.

• Question 310:

  Which of the following should be the MAIN governance focus when implementing a newly approved bring your own device (BYOD) policy?

  A. Recommending mobile applications that will increase business productivity
  B. Training employees on the enterprise's chosen mobile device management system
  C. Educating employees on the increased IT security risk to the enterprise
  D. Understanding knowledge gaps of IT employees to support different mobile platforms
  C. Educating employees on the increased IT security risk to the enterprise

  ---

  The main governance focus when implementing a newly approved BYOD policy is to educate employees on the increased IT security risk to the enterprise. BYOD introduces various challenges and threats to the enterprise's data and network security, such as device loss or theft, unauthorized access, malware infection, data leakage, and compliance violations. Therefore, it is essential to raise the awareness and understanding of employees on the potential risks and their responsibilities in protecting the enterprise's assets and information. Educating employees on the IT security risk can also help to foster a culture of security and compliance, and to promote best practices for BYOD usage, such as following the acceptable use policy, installing security software, and reporting incidents. References: The Ultimate Guide to BYOD Security: Definition and More - Digital Guardian; Enterprise mobility and security: How to build a BYOD policy; Bring Your Own Device for Executives | Cyber.gov.au