[UPDATED 2026] Free ISACA CGEIT Exam Questions Self-Assess Preparation [Q357-Q379]

Rate this post

[UPDATED 2026] Free ISACA CGEIT Exam Questions Self-Assess Preparation

CGEIT Free Sample Questions to Practice One Year Update

ISACA CGEIT certification exam consists of four domains that cover various aspects of IT governance. These domains include governance of IT, strategic management, benefits realization, and risk optimization. CGEIT exam is designed to test an individual’s understanding of these domains and their ability to apply them in real-world scenarios. CGEIT exam consists of 150 multiple-choice questions that must be completed within four hours.

NEW QUESTION 357
IT senior management has just received a survey report indicating that more than one third of the organization’s key IT staff plan to retire within the next 12 months. Which of the following is the MOST important governance action to prepare for this possibility?

Engage human resources (HR) for recruitment of new staff.

Request the development of a succession plan.

Review motivation drivers for key IT staff.

Evaluate lower-level staff as succession candidates.

NEW QUESTION 358
Risk management strategies are PRIMARILY adopted to:

avoid risks for business and IT assets.

take necessary precautions for claims and losses.

achieve acceptable residual risk levels.

achieve compliance with legal requirements.

NEW QUESTION 359
Which of the following is the MOST important attribute of an information steward?

The information steward manages the systems that process the relevant data.

The information steward has expertise in managing data quality systems.

The information steward is closely aligned with the business function.

The information steward is part of the information architecture group.

NEW QUESTION 360
A board of directors has just received a report indicating that only a small number of IT initiatives have been completed on time and within budget, A third of the projects were cancelled prior to completion, and more than half will cost almost double their original estimates. An analysis has determined that no one is held responsible for the completion of investment initiatives, and there is no consistency in execution. Which of the following would BEST help the enterprise address these problems?

Establishing a project governance framework

Assigning business management to an IT investment review board

Establishing an IT risk management plan

Aligning IT investment priorities to the business

A project governance framework is a set of principles, policies, roles, responsibilities, and processes that guide, direct, and control the initiation, planning, execution, monitoring, and closure of IT projects. A project governance framework can help the enterprise address the problems of poor project performance, lack of accountability, and inconsistency in execution by:
Providing a clear and consistent structure for managing IT projects across the enterprise Aligning IT projects with the strategic objectives and priorities of the enterprise Defining the roles and responsibilities of the project stakeholders, including the board of directors, senior management, project sponsors, project managers, project teams, and end-users Establishing the criteria and methods for selecting, prioritizing, approving, and funding IT projects Setting the standards and expectations for project planning, execution, quality, risk management, communication, and reporting Implementing the mechanisms and tools for monitoring, controlling, evaluating, and reviewing IT project performance and outcomes Ensuring the accountability and transparency of IT project decisions and results Reference:
According to the CGEIT Review Manual 2022, “Project governance is a subset of IT governance that provides a framework for managing IT projects. Project governance ensures that IT projects are aligned with business objectives; are delivered on time, within budget, and with acceptable quality; and are managed in a consistent and transparent manner.”1 According to the ISACA article on Project Governance: An Essential Element of Project Management Success2, “Project governance is an empowering aspect of the project management office (PMO) infrastructure management. It enables effective decision making by providing clarity on roles and responsibilities; it also provides a framework for escalation management.” According to the PMI article on Project Governance: What You Need to Know3, “Project governance is a critical element of any project since it provides a framework for accountabilities and responsibilities associated with an organization’s capital investments (projects). It is defined as an integrated framework of processes and tools that address matters essential to successful project delivery.”

NEW QUESTION 361
Of the following, who is PRIMARILY responsible for applying frameworks for the governance of IT to balance the need for security controls with business requirements?

Data scientists

Data stewards

Data analysts

Data processors

NEW QUESTION 362
Which of the following is the MOST effective way for a CIO to govern business unit deployment of shadow IT applications in a cloud environment?

Implement controls to block the installation of unapproved applications.

Educate the executive team about the risk associated with shadow IT applications.

Provide training to the help desk to identify shadow IT applications.

Review and update the application implementation process.

NEW QUESTION 363
Which of the following is the MOST important aspect of business ethics?

Ensuring fair and consistent vendor management practices

Providing equal opportunities to employees

Protecting stakeholders’ interests

Complying with legal and regulatory requirements

NEW QUESTION 364
Which of the following would BEST help to improve an enterprise’s ability to manage large IT investment projects?

Creating a change management board

Reviewing and evaluating existing business cases

Implementing a review and approval process for each phase

Publishing the IT approval process online for wider scrutiny

NEW QUESTION 365
Which of the following is the PRIMARY objective of quantum computing architecture when addressing complex problems in a short amount of time using specialized algorithms?

To increase revenue

To optimize efficiency

To reduce cyberattacks

To minimize operating costs

NEW QUESTION 366
Which of the following would be of MOST concern regarding the effectiveness of risk management processes?

Key risk indicators (KRIs) are not established.

Risk management requirements are not included in performance reviews.

The plans and procedures are not updated on an annual basis.

There is no framework to ensure effective reporting of risk events.

According to the web search results, one of the most important aspects of risk management is the timely and accurate reporting of risk events, which are incidents or occurrences that have a negative impact on the objectives, operations, or reputation of an organization1. A framework to ensure effective reporting of risk events can help to identify, analyze, communicate, and respond to risks in a systematic and consistent manner2. Without such a framework, the organization may fail to capture, escalate, and learn from risk events, and may expose itself to greater losses, liabilities, and regulatory sanctions3. Therefore, the lack of a framework to ensure effective reporting of risk events would be of most concern regarding the effectiveness of risk management processes.
The other options are less concerning than option D, although they may also indicate some weaknesses in the risk management processes. Key risk indicators (KRIs) are metrics that measure the likelihood or impact of potential or actual risks4. While they are useful for monitoring and managing risks, they are not essential for the effectiveness of risk management processes. Risk management requirements are criteria or standards that define the expectations and responsibilities for managing risks. Including them in performance reviews can help to align the incentives and behaviors of employees with the risk appetite and strategy of the organization. However, they are not the only way to ensure accountability and compliance with risk management processes. The plans and procedures are documents that describe the objectives, scope, roles, activities, and outputs of risk management processes. Updating them on an annual basis can help to reflect the changes in the internal and external environment that affect the risks faced by the organization. However, they are not the only source of guidance and information for risk management processes.
Reference:
Risk Event – Definition from KWHS
Risk Management – Overview, Importance and Processes
Transforming risk efficiency and effectiveness | McKinsey
Key Risk Indicators (KRIs) – Definition from KWHS
[Risk Management Requirements – an overview | ScienceDirect Topics]
[Risk Management Requirements – an overview | ScienceDirect Topics]
[Risk Management Plan – an overview | ScienceDirect Topics]
[Risk Management Plan – an overview | ScienceDirect Topics]

NEW QUESTION 367
Senior management is concerned about an increase in cybersecurity risk to the enterprise. Which of the following would be MOST helpful in establishing an early warning system to determine which potential threats should be escalated to senior management?

Agreed-upon risk thresholds

A risk appetite statement

Key performance indicators (KPIs)

Patch management logs

NEW QUESTION 368
The board directed the CIO to ensure that required IT resources are available to execute a new enterprise strategy. Which of the following should be done FIRST to support this initiative?

Implement an IT capability strategy

Perform a gap analysis

Develop a capacity management plan

Develop a resource management plan

NEW QUESTION 369
Which of the following should be the FIRST step in updating an IT strategic plan?

Revise the enterprise architecture (EA).

Review IT performance objectives and indicators.

Evaluate IT capabilities and resources.

Identify changes in enterprise goals.

NEW QUESTION 370
Which of the following roles is used to ensure that the confidentiality, integrity, and availability of the services are maintained to the levels approved on the Service Level Agreement (SLA)?

The Service Level Manager

The Configuration Manager

The IT Security Manager

The Change Manager

NEW QUESTION 371
To benefit from economies of scale, a CIO is deciding whether to outsource some IT services. Which of the following would be the MOST important consideration during the decision-making process?

IT staff morale

Core IT processes

Outsourcer’s reputation

New service level agreements (SLAs)

NEW QUESTION 372
Which of the following BEST supports enterprise decision making for IT resource allocation?

IT-related regulatory requirements

Enterprise IT strategy

Enterprise IT risk assessment

IT balanced scorecard

NEW QUESTION 373
Which of the following should be the FIRST step for executive management to take in communicating what is considered acceptable use with regard to personally owned devices for company business?

Require employees to read and sign a disclaimer.

Develop and disseminate an applicable policy.

Post awareness messages throughout the facility.

Provide training on how to protect data on personal devices.

NEW QUESTION 374
An enterprise has identified potential environmental disasters that could occur in the area where its data center is located. Which of the following should be done NEXT?

Implement an early warning detection and notification system.

Assess the likelihood and impact on the data center.

Relocate the data center to minimize the threat.

Assess how the data center is protected against the threat.

NEW QUESTION 375
A strategic systems project was implemented several months ago. Which of the following is the BEST reference for the IT steering committee as they evaluate its level of success?

Stakeholder satisfaction surveysB The project’s net present value (NPV)

The project’s business case

Operating metrics of the new system

NEW QUESTION 376
An IT governance committee wants to ensure there is a clear description of the “data owner” in the enterprise data policy. Which of the following would BEST define the owner of data stored in an external cloud?

The contract manager who monitors the security of the cloud provider

The vendor who submits the data to the organization via online forms

The business leader who is most impacted by the loss of data

The risk manager who is responsible for protecting data stored in the cloud

NEW QUESTION 377
Which of the following is the GREATEST advantage of earned value management when used for evaluating benefits from the implementation of blockchain projects for IT contracts management?

It automates project progress reporting to business executives.

It provides a measure of project progress that is easy to understand.

It eliminates potential risks related to project earnings.

It enables accurate forecasts of the number of blocks to be completed.

NEW QUESTION 378
Which of the following should be the PRIMARY consideration when implementing IT governance in a small, newly established organization?

Approving enterprise architecture and standards

Defining IT project management methodology

Assigning a budget for IT governance applications

Assigning IT roles and responsibilities

NEW QUESTION 379
An enterprise embarked on an aggressive strategy requiring the implementation of several large IT projects impacting multiple business processes across all departments. Initially employees were supportive of the strategy, but there is growing fatigue and frustration with the ongoing new capabilities which must be learned.
Which of the following would be the BEST action performed by senior management?

Incorporate an organizational change management program.

Establish “Reward and Recognition” efforts to boost employee morale.

Improve the system development life cycle (SDLC) process.

Assess current business and IT competencies.

This is because an organizational change management program is a systematic approach to managing the human side of change and ensuring that the people affected by the change are ready, willing, and able to adopt it1. An organizational change management program can help to address the fatigue and frustration of the employees by providing them with clear communication, stakeholder engagement, training and coaching, leadership support, and feedback mechanisms2. An organizational change management program can also help to increase the success rate and benefits realization of the IT projects by reducing resistance, enhancing collaboration, and improving performance3.
The other options are less effective than option A, as they do not address the root cause of the problem or provide a comprehensive solution. Establishing “Reward and Recognition” efforts to boost employee morale may be helpful, but not sufficient, to overcome the fatigue and frustration of the employees. Rewards and recognition can motivate and appreciate the employees for their efforts and achievements, but they do not necessarily help them to cope with the changes or learn the new capabilities4. Improving the system development life cycle (SDLC) process may be useful, but not relevant, to address the fatigue and frustration of the employees. The SDLC process is a framework that defines the tasks and activities involved in developing, testing, deploying, and maintaining IT systems. While improving the SDLC process can enhance the quality and efficiency of IT systems, it does not directly affect the employees’ readiness or willingness to adopt them. Assessing current business and IT competencies may be important, but not enough, to address the fatigue and frustration of the employees. Assessing competencies can help to identify the gaps and needs of the employees in terms of knowledge, skills, and abilities required for their roles. However, assessing competencies alone does not provide any solutions or support for closing those gaps or meeting those needs.