UPDATED [2026] Pass ISACA CGEIT Exam in First Attempt Guaranteed

Pass CGEIT Exam Latest Practice Questions

NEW QUESTION # 79
Which of the following domains of COBIT addresses the development of a maintenance plan that a company should adopt in order to prolong the life of an IT system and its components?

• A. Monitor and Evaluate
• B. Deliver and Support
• C. Acquire and Implement
• D. Plan and Organize

Answer: C

NEW QUESTION # 80
Which of the following is the BEST way for a CIO to ensure that IT-related training is taken seriously by the IT management team and direct employees?

• A. Research and identify training needs based on industry trends.
• B. Embed training metrics into the annual performance appraisal process.
• C. Develop training programs based on results of an IT staff survey of preferences.
• D. Promote IT-specific training awareness program.

Answer: B

Explanation:
* This is because training metrics are measurable values that indicate the effectiveness and impact of the training programs on the IT staff's knowledge, skills, and performance1. By embedding training metrics into the annual performance appraisal process, the CIO can:
* Communicate the importance and value of IT-related training to the IT management team and direct employees2
* Motivate and incentivize the IT management team and direct employees to participate in and complete the IT-related training2
* Monitor and evaluate the IT management team and direct employees' progress, achievement, and improvement in the IT-related training2
* Provide feedback and recognition to the IT management team and direct employees who excel in the IT-related training2
* Identify and address any gaps or issues in the IT-related training or its outcomes2 Embedding training metrics into the annual performance appraisal process can help to create a culture of learning, development, and accountability for IT-related training within the organization. It can also help to align the individual goals of the IT management team and direct employees with the organizational goals of IT governance.
The other options, developing training programs based on results of an IT staff survey of preferences, promoting IT-specific training awareness program, and researching and identifying training needs based on industry trends are not as effective as embedding training metrics into the annual performance appraisal process for ensuring that IT-related training is taken seriously by the IT management team and direct employees. They are more related to the design and delivery of the IT-related training, rather than its integration and evaluation. They may also not have a significant impact on the behavior and attitude of the IT management team and direct employees towards IT-related training, as they may not provide sufficient motivation, feedback, or recognition for participation or completion.

NEW QUESTION # 81
You are the project manager of the NKJ Project for your company. The project's success or failure will have a significant impact on your organization's profitability for the coming year. Management has asked you to identify the risk events and communicate the event's probability and impact as early as possible in the project.
Management wants to avoid risk events and needs to analyze the cost-benefits of each risk event in this project. What term is assigned to the low-level of stakeholder tolerance in this project?

• A. Risk utility function
• B. Risk-reward mentality
• C. Risk avoidance
• D. Mitigation-ready project management

Answer: A

Explanation:
Section: Volume B
Explanation/Reference:

NEW QUESTION # 82
A board of directors has just received a report indicating that only a small number of IT initiatives have been completed on time and within budget, A third of the projects were cancelled prior to completion, and more than half will cost almost double their original estimates. An analysis has determined that no one is held responsible for the completion of investment initiatives, and there is no consistency in execution. Which of the following would BEST help the enterprise address these problems?

• A. Establishing an IT risk management plan
• B. Assigning business management to an IT investment review board
• C. Establishing a project governance framework
• D. Aligning IT investment priorities to the business

Answer: B

NEW QUESTION # 83
An enterprise incurred penalties for noncompliance with privacy regulations. Which of the following is MOST important to ensure appropriate ownership of access controls to address this deficiency?

• A. Authenticating access to information assets based on roles or business rules.
• B. Implementing multi-factor authentication controls
• C. Granting access to information based on information architecture
• D. Engaging an audit of logical access controls and related security policies

Answer: A

Explanation:
According to the web search results, authenticating access to information assets based on roles or business rules is the most important way to ensure appropriate ownership of access controls to address privacy compliance. This is because role-based access control (RBAC) and attribute-based access control (ABAC) are two of the most common and effective methods for enforcing the principle of least privilege, which means granting users only the minimum level of access they need to perform their tasks. This can help to protect the confidentiality, integrity, and availability of information assets, as well as to comply with privacy regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). For example, one of the results1 states that "RBAC is a key component of any organization's compliance strategy, as it helps ensure that only authorized users can access sensitive data and resources". Another result2 explains that "ABAC is a logical model for access control that supports fine-grained authorization based on attributes, environment conditions, and policies". A third result3 discusses how RBAC and ABAC can help organizations achieve privacy compliance by implementing data minimization, purpose limitation, and accountability principles. References := What Is Access Control? | Microsoft Security Access Control Policy and Implementation Guides | CSRC Understanding Data Privacy - A Compliance Strategy Can Mitigate Cyber ...

NEW QUESTION # 84
An enterprise has made the strategic decision to reduce operating costs for the next year and is taking advantage of cost reductions offered by an external cloud service provider. Which of the following should be the IT steering committee's PRIMARY concern?

• A. Revising the business $ balanced store card
• B. Changing the IT steering committee charter
• C. Updating the business risk profile
• D. Calculating the cost of the current solution

Answer: C

Explanation:
A business risk profile is a document that identifies and evaluates the potential risks that can affect the performance, objectives, and strategy of an organization. A business risk profile can help to prioritize and mitigate the risks, as well as to align the risk management activities with the business goals and needs12.
If an enterprise has made the strategic decision to reduce operating costs for the next year and is taking advantage of cost reductions offered by an external cloud service provider, the IT steering committee's primary concern should be updating the business risk profile. This is because using an external cloud service provider may introduce new or increased risks for the enterprise, such as security, privacy, compliance, availability, performance, or vendor lock-in risks3 . Updating the business risk profile can help the IT steering committee to assess the impact and likelihood of these risks, to evaluate the effectiveness and adequacy of the existing controls and safeguards, to identify and implement any additional measures or actions to address the gaps or issues, and to monitor and report the risk status and outcomes12. Reference: Business Risk Profile: Definition & Examples. How to Create a Business Risk Profile. A risk assessment model for selecting cloud service providers. Cloud Computing Security for Cloud Service Providers.

NEW QUESTION # 85
When selecting a vendor to provide services associated with a critical application which of the following is the MOST important consideration with respect to business continuity planning (BCP)?

• A. Obtaining independent audit reports of the vendor's BCP
• B. Testing the vendor's BCP and analyzing the results
• C. Procuring a copy of the vendor's BCP during the contracting process
• D. Evaluating whether the vendor's BCP aligns with the enterprise's BCP

Answer: D

Explanation:
Evaluating whether the vendor's BCP aligns with the enterprise's BCP is the most important consideration when selecting a vendor to provide services associated with a critical application, because it helps to ensure that the vendor can meet the service level agreements (SLAs) and recovery objectives of the enterprise in the event of a disruption or disaster. A BCP is a plan that defines how an organization will continue its critical business processes and functions during and after a crisis1. A vendor's BCP should be compatible and consistent with the enterprise's BCP, and should address the specific risks, impacts, and requirements of the service provision2. Evaluating whether the vendor's BCP aligns with the enterprise's BCP helps to avoid any gaps, conflicts, or issues that could affect the availability, performance, and quality of the service, and to ensure that the vendor can restore the service within an acceptable time frame3. Evaluating whether the vendor's BCP aligns with the enterprise's BCP also helps to comply with the regulatory and contractual obligations, and to protect the reputation and value of the enterprise4.

NEW QUESTION # 86
Before establishing IT key nsk indicators (KRls) which of the following should be defined FIRST?

• A. IT risk and security framework
• B. IT resource strategy
• C. IT key performance indicators (KPIs)
• D. IT goals and objectives

Answer: D

Explanation:
IT goals and objectives are the desired outcomes and targets that IT aims to achieve in support of the business strategy and objectives. IT goals and objectives should be defined first before establishing IT key risk indicators (KRIs), because they provide the direction and scope for the IT risk management process. KRIs are metrics that measure and monitor the level and trend of risk exposure, and help to identify and manage potential threats or opportunities that could affect the achievement of IT goals and objectives1. Therefore, by defining IT goals and objectives first, an enterprise can ensure that its KRIs are relevant, aligned, and consistent with its IT strategy and value delivery2. := Key Risk Indicators (KRIs) - ISACA, Integrating KRIs and KPIs for Effective Technology Risk Management - ISACA.

NEW QUESTION # 87
The board of directors of a large organization has directed IT senior management to improve IT governance within the organization. IT senior management's MOST important course of action should be to:

• A. analyze IT service levels and performance.
• B. assess the current slate of IT governance within the organization.
• C. review IT strategy and direction.
• D. understand the driver that led to a desire to change.

Answer: D

Explanation:
The most important course of action for IT senior management to improve IT governance within the organization is to understand the driver that led to a desire to change. IT governance is the process of ensuring that IT supports and enables the achievement of the enterprise's goals and objectives, and delivers value to the stakeholders1. IT governance is influenced by various internal and external factors, such as business strategy, customer expectations, regulatory requirements, industry standards, best practices, and emerging technologies1. Therefore, before initiating any improvement initiatives, IT senior management should first identify and analyze the driver that prompted the board of directors to request a change in IT governance. This will help them to understand the current situation, the desired state, the gap between them, and the rationale and urgency for improvement2. By understanding the driver that led to a desire to change, IT senior management can also align their improvement efforts with the board's vision and expectations, communicate the benefits and challenges of change, and gain their support and commitment2. References: CGEIT Review Manual (Digital Version) or CGEIT Review Manual (Print Version), Chapter 1: Governance of Enterprise IT, Section 1.1: IT Governance Frameworks and Principles, Page 9-10. What is CGEIT? A certification for seasoned IT governance professionals.

NEW QUESTION # 88
An IT manager is trying to determine optimal IT service levels. Which of the following should be the PRIMARY consideration?

• A. Internal rate of return
• B. Cost-benefit analysis
• C. Resource utilization analysis
• D. Recovery time objective (RTO)

Answer: B

Explanation:
The primary consideration for determining optimal IT service levels is cost-benefit analysis. Cost-benefit analysis is a technique that compares the costs and benefits of providing a certain level of IT service to the business and the stakeholders1. It helps to identify the optimal balance between the value and the cost of IT service delivery, and to justify the investment and resources required for achieving the desired service level objectives1. Cost-benefit analysis can also help to evaluate alternative options, prioritize improvement initiatives, and measure the return on investment of IT service management1. The other options are not as relevant as cost-benefit analysis, as they do not consider both the costs and benefits of IT service levels. Internal rate of return is a financial metric that measures the profitability of an investment, but it does not account for the non-financial benefits or risks of IT service delivery2. Recovery time objective is a parameter that specifies the maximum acceptable time for restoring an IT service after a disruption, but it does not reflect the cost or value of achieving that time3. Resource utilization analysis is a technique that monitors and optimizes the usage and allocation of IT resources, but it does not assess the impact or outcome of IT service delivery on the business and the stakeholders4. Reference: Cost-Benefit Analysis in IT Service Management. Internal Rate of Return (IRR). Recovery Time Objective (RTO). Resource Utilization Analysis.

NEW QUESTION # 89
Which of the following is the BEST method for making a strategic decision to invest in cloud services?

• A. Prepare a business case.
• B. Benchmarking.
• C. Prepare a request for information (RFI),
• D. Define a balanced scorecard.

Answer: A

Explanation:
A business case is the best method for making a strategic decision to invest in cloud services, as it provides a structured and comprehensive analysis of the costs, benefits, risks, and value proposition of the proposed investment. A business case can help justify the need for cloud services, compare different options and alternatives, and align the investment with the enterprise's strategy and objectives. A request for information (RFI) is a document that solicits information from potential vendors or suppliers, but it does not provide a decision-making framework. Benchmarking is a process of comparing the performance or practices of an enterprise with those of others, but it does not evaluate the feasibility or desirability of cloud services. A balanced scorecard is a tool that measures and monitors the performance of an enterprise or a business unit against strategic goals and objectives, but it does not assess the viability or suitability of cloud services. Reference: : CGEIT Review Manual (Digital Version), Chapter 3: Benefits Realization, Section 3.2: IT Investment Management, Subsection 3.2.1: IT Investment Management Overview, Page 97 : CGEIT Review Manual (Digital Version), Chapter 3: Benefits Realization, Section 3.2: IT Investment Management, Subsection 3.2.4: IT Investment Management Process, Page 104 : How to Write a Business Case: Template & Examples1

NEW QUESTION # 90
An enterprise considering implementing IT governance should FIRST develop the scope of the IT governance program and:

• A. initiate the program using an implementation roadmap.
• B. communicate the program to stakeholders to gain consensus.
• C. establish initiatives for business and managers.
• D. acquire the resources that will be required.

Answer: B

Explanation:
Communicating the program to stakeholders to gain consensus is the first step after developing the scope of the IT governance program, as it helps to ensure that the program is aligned with the enterprise goals and objectives, and that it has the support and commitment of the key parties who have an interest or influence in the IT governance. Communication also helps to overcome resistance, address concerns, and foster collaboration among the stakeholders12. References := CGEIT Exam Content Outline, Domain 1, Subtopic A:
Governance Framework, Task 3: Ensure that stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritization and decision making; and monitoring performance and compliance against agreed-on direction and objectives.

NEW QUESTION # 91
An enterprise has decided to use third-party software for a business process which is hosted and supported by the same third party. The BEST way to provide quality of service oversight would be to establish a process:

• A. to qualify service providers.
• B. for enterprise architecture (EA) updates.
• C. for robust change management.
• D. for periodic service provider audits.

Answer: D

Explanation:
A periodic service provider audit is a process of conducting an independent and objective assessment of the service provider's performance, quality, compliance, and security in relation to the agreed service level agreement (SLA) and the enterprise's expectations and requirements. A periodic service provider audit can help provide quality of service oversight by:
Verifying and validating the service provider's claims and credentials, and ensuring that they meet the contractual obligations and standards Identifying and evaluating the strengths, weaknesses, opportunities, and threats of the service provider's services, processes, and controls Detecting and reporting any issues, gaps, or risks that may affect the quality of service delivery or the enterprise's objectives and value Recommending and implementing corrective and preventive actions to address and resolve the issues, gaps, or risks Monitoring and measuring the outcomes and effectiveness of the corrective and preventive actions, and ensuring their alignment with the SLA References:
According to the CGEIT Review Manual 20221, "Service provider audits are a key mechanism for ensuring that service providers are meeting their contractual obligations and delivering value to the enterprise. Service provider audits should be conducted periodically or as needed to assess the performance, quality, compliance, and security of the service provider's services, processes, and controls." According to the ISACA article on IT Outsourcing: Audit Considerations2, "IT outsourcing audit is a process of examining and evaluating the IT outsourcing arrangements between an enterprise and its service providers.
IT outsourcing audit aims to provide assurance that the IT outsourcing arrangements are aligned with the enterprise's strategy, objectives, and risk appetite; that the service providers are delivering the expected services in accordance with the SLAs; that the service providers are complying with the applicable laws, regulations, and standards; and that the service providers are managing and mitigating the IT outsourcing risks effectively." According to the PwC article on Service Provider Audits3, "Service provider audits are an essential tool for organizations to gain insight into their service providers' operations, controls, risks, and compliance status.
Service provider audits can help organizations ensure that their service providers are meeting their expectations and obligations; identify any areas of improvement or concern; enhance their relationship and communication with their service providers; and optimize their IT outsourcing strategy."

NEW QUESTION # 92
Which of the following is a process that occurs due to mergers, outsourcing or changing business needs?

• A. Involuntary exit
• B. Outplacement
• C. Plant closing
• D. Voluntary exit

Answer: A

NEW QUESTION # 93
Which of the following is a family of ISO standards for Total Quality Management (TQM)?

• A. ISO 9000
• B. ISO 38500
• C. ISO 27001
• D. ISO 20000

Answer: A

Explanation:
Section: Volume C

NEW QUESTION # 94
An enterprise wants to address the human factors of social engineering risk within the organization. From a governance perspective, which of the following is the BEST way to mitigate this risk?

• A. Restrict access to social media.
• B. Distribute the social media information security policy to staff.
• C. Mandate security requirements be included in employee contracts.
• D. Mandate annual security awareness training.

Answer: D

Explanation:
This is the best way to mitigate the human factors of social engineering risk within the organization from a governance perspective, as it helps to educate and empower the employees to recognize and prevent social engineering attacks. Social engineering attacks are malicious attacks that use deception and manipulation to exploit human behavior and trick people into revealing sensitive information, clicking malicious links, or opening malicious files1. These attacks can cause serious damage to the organization, such as financial loss, data breach, reputation harm, or legal liability1. Therefore, it is essential to address the human factors of social engineering risk, which are the psychological and emotional vulnerabilities that make people susceptible to these attacks, such as curiosity, greed, fear, urgency, or trust2. By mandating annual security awareness training, the organization can raise the level of knowledge and awareness among the employees about the common types, techniques, and indicators of social engineering attacks, as well as the best practices and policies to avoid them2. Security awareness training can also help to foster a culture of security and responsibility among the employees, and to reinforce their role and accountability in protecting the organization's assets and interests2. The other options are not as effective as mandating annual security awareness training, as they do not address the human factors of social engineering risk directly. Distributing the social media information security policy to staff may help to inform them about the rules and expectations for using social media platforms, but it does not ensure that they understand or follow them. Restricting access to social media may help to reduce the exposure to potential social engineering attacks, but it does not prevent them from occurring through other channels or mediums. Mandating security requirements be included in employee contracts may help to enforce compliance and deter violations, but it does not prevent them from happening due to ignorance or negligence.

NEW QUESTION # 95
Which of the following is MOST important to have in place to ensure a business continuity plan (BCP) can be executed?

• A. Defined roles
• B. Replicated systems
• C. A risk register
• D. Budget allocation

Answer: A

Explanation:
In Governance of Enterprise IT (EGIT), execution risk often fails not because the plan or technology is missing, but because accountability and decision rights are unclear during a disruption. A BCP is only executable when the enterprise has defined roles, clear responsibilities, and explicit authority (who declares an incident, who triggers failover, who communicates to regulators/customers, who approves emergency changes, etc.). COBIT's governance system guidance emphasizes defining accountability through roles and responsibilities so critical processes are not compromised and people know what must happen and who is responsible.
A risk register helps identify and track risks, but it does not by itself ensure coordinated action under stress.
Budget allocation is necessary for capability building, yet a funded plan can still fail if nobody is empowered to act. Replicated systems support continuity/availability, but replication alone does not ensure the organization will correctly invoke recovery procedures, manage priorities, and communicate effectively.
ISACA guidance on continuity-related practices highlights that roles/responsibilities should be explicitly documented and approved to support continuity execution.
========

NEW QUESTION # 96
IT maturity models measure:

• A. capabilities.
• B. performance.
• C. outcome.
• D. value.

Answer: A

NEW QUESTION # 97
During an IT strategy review, a new CIO determined that numerous important internal processes have not been updated for several years and should be reexamined. Which of the following would be the BEST approach to address this concern?

• A. Map the processes to a capability maturity model.
• B. Assemble a project review team
• C. Verify that the processes are still needed
• D. Implement a process review policy.

Answer: A

Explanation:
The best approach to address the concern of outdated internal processes is to map the processes to a capability maturity model (CMM). A CMM is a framework that describes the levels of maturity and capability of a process, from initial to optimized. Mapping the processes to a CMM can help the CIO to assess the current state and performance of the processes, as well as identify and prioritize the areas for improvement. Mapping the processes to a CMM can also help align the processes with the IT strategy and goals, as well as ensure compliance with standards and best practices. Software Capability Maturity Model (CMM) | IT Governance UK provides an overview of the CMM framework and its benefits.
Implementing a process review policy, assembling a project review team, and verifying that the processes are still needed are also possible steps to take to address the concern of outdated internal processes, but they are not the best approach. Implementing a process review policy is a measure that defines the frequency, scope, criteria, and methods for reviewing and updating the processes. Implementing a process review policy can help ensure the consistency and quality of the process review activities, as well as prevent future obsolescence or inefficiency of the processes. Assembling a project review team is a task that involves selecting and assigning the roles and responsibilities of the people who will conduct or participate in the process review activities.
Assembling a project review team can help ensure the availability and suitability of the resources and skills for the process review activities, as well as facilitate the collaboration and communication among the stakeholders. Verifying that the processes are still needed is a question that evaluates the relevance and value of the processes for the enterprise's objectives and operations. Verifying that the processes are still needed can help eliminate or simplify any unnecessary or redundant processes, as well as optimize or integrate any overlapping or interdependent processes.

NEW QUESTION # 98
Which of the following is the MOST effective approach to ensure senior management sponsorship of IT risk management?

• A. Integrate IT risk into enterprise risk management (ERM).
• B. Benchmark the risk framework against best practices.
• C. Calculate financial impact for each IT risk finding.
• D. Periodically review the IT risk register entries.

Answer: A

Explanation:
Governance of Enterprise IT (EGIT) requires that I&T risk is not managed as a silo, but treated as an integral component of how the enterprise sets direction, makes decisions, and supervises performance. The most effective way to secure senior management sponsorship is to integrate IT risk into enterprise risk management (ERM) so that technology-related risk is evaluated alongside strategic, operational, financial, and compliance risks using the same language, reporting cadence, and decision forums. This integration increases executive visibility, clarifies ownership, and ensures IT risk is explicitly considered in prioritization and resource allocation-key governance behaviors for risk optimization. ISACA/COBIT guidance stresses that risk governance and management should be embedded in overall enterprise governance and risk practices, rather than treated as a separate technical activity.
The other choices can support risk management, but are less effective for sponsorship: calculating financial impact (A) helps communicate severity but does not establish executive accountability; benchmarking (B) validates maturity but doesn't create governance buy-in; periodic risk register review (D) is necessary operational hygiene yet still can occur without true executive ownership. Integrating into ERM is the structural mechanism that consistently anchors IT risk in senior leadership attention and enterprise decision- making.
========

NEW QUESTION # 99
Which of the following is a non repetitive set of tasks that lead to the achievement of a new objective?

• A. Tactics
• B. Techniques
• C. Strategy
• D. Plan

Answer: D

NEW QUESTION # 100
Which of the following is the MOST valuable input when quantifying the loss associated with a major risk event?

• A. Business impact analysis (BIA) report
• B. IT environment threat modeling
• C. Key risk indicators (KRIs)
• D. Recovery time objectives (RTOs)

Answer: C

NEW QUESTION # 101
Which of the following steps of IT governance program decides on the highest priority projects that will help to improve the management and governance of the significant gap areas?

• A. Define target areas
• B. Develop improvement strategies
• C. Measure results
• D. Understand and define the risks

Answer: B

NEW QUESTION # 102
A large bank has completed several acquisitions in the last few years that have resulted in redundant IT applications. To align with the strategic initiative of providing integrated services to customers, the IT steering committee has decided to share data and integrate applications. Which of the following would be MOST important to review in this situation?

• A. IT risk register
• B. Enterprise architecture
• C. IT strategic plan
• D. Balanced scorecard measures

Answer: B

NEW QUESTION # 103
......

The CGEIT certification exam is rigorous and requires significant preparation. Candidates are encouraged to take advantage of the resources provided by ISACA, including study materials, training courses, and practice exams. By successfully passing the CGEIT certification exam, candidates can demonstrate their commitment to professional development and their ability to effectively manage IT resources to support business objectives.

 

ISACA CGEIT Study Guide Archives : https://www.testsimulate.com/CGEIT-study-materials.html