Question bank
ISACA CGEIT
42 ISACA CGEIT questions with the correct answer and a written explanation, organised across 4 exam domains.
- 42 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Benefits Realization
11 questions in this domain
- Question 1Single Choice
What does the benefits identification, analysis, and classification phase primarily transform IT proposals into?
- AValue-oriented business propositionsCorrect answer
- BCost-oriented technical initiatives
- CProject schedule baselines
- DResource allocation plans
Why this is the answer
The process converts IT proposals from cost-oriented initiatives into value-oriented business propositions, enabling prioritization, alignment, and accountability.
- Question 2Multiple Select
Which elements should a benefits profile include? Select all that apply.
- ADescription and anticipated valueCorrect answer
- BTime frame and dependenciesCorrect answer
- CAccountable benefit ownerCorrect answer
- DVendor contract terms
Why this is the answer
A benefits profile documents description, value, time frame, assumptions, dependencies, and owner; vendor contract terms are not part of this profile.
- Question 3Interactive
Based on the exhibit, which benefit record lacks an accountable business owner and should not be treated as valid?
- AB01Correct answer
- BB02
- CB03
- DAll records
Why this is the answer
B01 has no named owner; each benefit must be linked to a single accountable business executive.
- Question 4Single Choice
Which benefit classification determines the valuation technique applied to a benefit?
- ATangible versus intangibleCorrect answer
- BProject location
- CDatabase platform
- DVendor preference
Why this is the answer
Tangible and intangible benefits use different valuation tools: financial metrics for tangible, scoring or multi-criteria methods for intangible.
- Question 5Multiple Select
Which practices help identify potential benefits before investment approval? Select all that apply.
- AStructured stakeholder interviewsCorrect answer
- BValue-stream analysisCorrect answer
- CBenchmarking studiesCorrect answer
- DFinal project status report
Why this is the answer
Interviews, value-stream analysis, and benchmarking are identification techniques; a final status report is created after project delivery.
- Question 6Interactive
In the exhibit, which item is a business outcome rather than an IT output?
- A15% increase in conversionCorrect answer
- BCRM module
- CDashboard
- DProject go-live
Why this is the answer
Outcomes are measurable business results, while CRM module and dashboard are outputs or deliverables.
- Question 7Single Choice
Who should be accountable for achieving a benefit in the benefits realization plan?
- ABusiness executive benefit ownerCorrect answer
- BProject manager
- CIT architect
- DVendor relationship manager
Why this is the answer
Each benefit is owned by a business executive; the project manager and IT team are responsible for deliverables, not outcome ownership.
- Question 8Multiple Select
Which statements about the benefits register are true? Select all that apply.
- AIt consolidates benefits across projects or the IT portfolioCorrect answer
- BIt gives governance bodies a view of total expected valueCorrect answer
- CIt helps identify duplication or contradictions among benefitsCorrect answer
- DIt replaces the need for named benefit owners
Why this is the answer
The register is a consolidated repository that supports portfolio decisions, but it does not substitute for ownership.
- Question 9Interactive
According to the exhibit, what issue does the portfolio-level benefits view reveal?
- ADuplicate benefit claimCorrect answer
- BMissing baseline
- CNo strategic objective
- DExcess funding
Why this is the answer
The portfolio view reveals two projects claiming the same cost-saving benefit, which requires governance arbitration.
- Question 10Single Choice
Which appraisal technique is considered most theoretically sound for valuing future cash flows?
- ANet present valueCorrect answer
- BPayback period
- CTotal cost of ownership
- DBreak-even analysis
Why this is the answer
NPV discounts future cash flows to present value and is considered the most sound appraisal technique.
- Question 11Multiple Select
Which elements should a business case include? Select all that apply.
- AProblem or opportunityCorrect answer
- BAlternative solution optionsCorrect answer
- CCosts, benefits, risks, and time frameCorrect answer
- DOnly the preferred technical solution
Why this is the answer
A business case analyzes the problem, alternatives, costs, benefits, risks, and time frame; it is not limited to one solution.
Governance of Enterprise IT
16 questions in this domain
- Question 12Single Choice
In the CGEIT framework, what is the primary purpose of enterprise governance of IT for the whole organization?
- AAlign IT with enterprise objectivesCorrect answer
- BPerform daily IT support tasks
- CWrite application code
- DConfigure network devices
Why this is the answer
EGIT aligns IT with enterprise goals through decision rights, accountability, and performance monitoring, not operational IT execution.
- Question 13Multiple Select
Which components are considered part of enterprise governance of IT in ISACA's global CGEIT framework?
- ADecision rightsCorrect answer
- BAccountability structuresCorrect answer
- CServer maintenance schedules
- DPerformance measurement mechanismsCorrect answer
Why this is the answer
EGIT includes decision rights, accountability, and performance measurement. Server maintenance is operational management, not governance.
- Question 14Interactive
Review the decision logic in the code block. Which missing condition creates a governance gap in the scenario?
- AStrategy approved but not monitoredCorrect answer
- BIT executes daily operations
- CKPI dashboard exists
- DManagement plans projects
Why this is the answer
Governance requires both approval and monitoring. Missing board monitoring of KPIs leaves accountability without oversight.
- Question 15Single Choice
In ISACA guidance, which activity belongs to governance rather than to management in enterprise IT?
- AEvaluating IT needsCorrect answer
- BBuilding an application
- CRunning IT services
- DPlanning a project
Why this is the answer
Governance is evaluating, directing, and monitoring. Building, running, and planning are management responsibilities.
- Question 16Multiple Select
Which responsibilities are typically held by the board of directors in enterprise governance of IT?
- AApproving IT strategyCorrect answer
- BDefining risk appetiteCorrect answer
- CMonitoring executive decisionsCorrect answer
- DFixing system outages
Why this is the answer
Board sets direction, risk appetite, and monitors executives. System outage repair is operational management.
- Question 17Interactive
Analyze the code block. Which pair of actions best demonstrates effective governance of enterprise IT?
- ABoard approves, CIO implementsCorrect answer
- BCIO decides and implements
- CBusiness unit approves and runs
- DAudit reports after completion
Why this is the answer
Governance integrates board direction with management implementation. Board approval paired with CIO implementation reflects governance.
- Question 18Single Choice
What does the term 'accountable' mean in the context of CGEIT IT governance roles?
- AAnswerable for outcomesCorrect answer
- BResponsible for doing tasks
- CConsulted before decisions
- DInformed after decisions
Why this is the answer
Accountability means being answerable for outcomes and cannot be delegated; responsibility is task execution.
- Question 19Multiple Select
Which elements are essential for achieving strategic alignment of IT with enterprise objectives and goals?
- AUnderstanding stakeholder needsCorrect answer
- BTranslating goals through a cascadeCorrect answer
- CMonitoring benefits realizationCorrect answer
- DDeploying technology first
Why this is the answer
Alignment starts with stakeholder needs, uses goal cascade, and confirms realized benefits. Deploying technology first is not governance.
- Question 20Interactive
Review the goals cascade code. What should guide the IT objectives and funded project portfolio?
- AStakeholder needs and enterprise goalsCorrect answer
- BLatest technology trends
- CVendor product roadmaps
- DIndividual manager preferences
Why this is the answer
The code shows enterprise goals cascading to IT objectives, then to funded projects. Stakeholder needs are the source.
- Question 21Single Choice
Who should be considered stakeholders in enterprise IT governance according to the global CGEIT framework?
- AShareholders, regulators, customers, employeesCorrect answer
- BShareholders only
- CIT vendors only
- DExecutive management only
Why this is the answer
Stakeholders include board, executives, regulators, customers, employees, partners, and society, not any single group.
- Question 22Multiple Select
Which items are examples of value drivers that justify IT investment in the CGEIT governance model?
- ARevenue growthCorrect answer
- BCustomer satisfactionCorrect answer
- CRegulatory complianceCorrect answer
- DServer CPU usage
Why this is the answer
Value drivers include revenue, customer satisfaction, compliance, and reputation. Server CPU usage is an operational metric.
- Question 23Interactive
Review the portfolio code. What should a balanced IT investment portfolio include in governance practice?
- AInnovation, regulatory, and sustainment needsCorrect answer
- BOnly innovation projects
- COnly low-risk projects
- DOnly regulatory projects
Why this is the answer
Balanced portfolio includes innovation, mandatory regulatory work, and infrastructure sustainment to create long-term value.
- Question 24Single Choice
What is the first step in the COBIT governance approach according to the ISACA framework?
- AEvaluateCorrect answer
- BDirect
- CMonitor
- DBuild
Why this is the answer
The cycle begins with Evaluate to understand stakeholder needs and current state before directing and monitoring.
- Question 25Multiple Select
Which categories are the three foundational enablers of IT governance in the ISACA CGEIT framework?
- AStructuresCorrect answer
- BProcessesCorrect answer
- CRelational mechanismsCorrect answer
- DFirewall configurations
Why this is the answer
Structures, processes, and relational mechanisms are foundational enablers. Technical configurations are implementation details.
- Question 26Interactive
According to the code, which factor is necessary for effective governance in addition to structures and processes?
- ATrust and communicationCorrect answer
- BMore committees
- CLonger procedures
- DNew software
Why this is the answer
The code shows relational mechanisms like trust and communication are necessary alongside formal structures and processes.
- Question 27Single Choice
How does a governance policy differ from a supporting standard in IT governance according to the CGEIT framework?
- APolicy states intent; standard sets rulesCorrect answer
- BPolicy is technical; standard is general
- CStandard states intent; policy sets rules
- DThey are identical
Why this is the answer
Policy is board-level intent; standards provide mandatory requirements that support the policy.
IT Resources
7 questions in this domain
- Question 28Single Choice
What is the primary purpose of IT resource planning and budgeting in the CGEIT framework?
- ATo align technology investments with business strategy and risk appetiteCorrect answer
- BTo maximize the size of the IT department
- CTo eliminate all operational IT costs
- DTo document infrastructure assets for auditors
Why this is the answer
IT resource planning and budgeting is a governance mechanism that translates strategic IT objectives into prioritized, measurable resource allocations aligned with business strategy and risk appetite.
- Question 29Multiple Select
Select all statements that correctly describe operating expenditures (OpEx) and capital expenditures (CapEx) in IT budgeting.
- ACloud subscriptions are typically operational expenses.Correct answer
- BSoftware licenses with a useful life may be capitalized.Correct answer
- CSalaries and ongoing maintenance are capital investments.
- DOngoing maintenance and salaries are operational expenses.Correct answer
Why this is the answer
Cloud subscriptions and ongoing operational costs are OpEx, while software licenses with a useful life may be CapEx. Treating salaries and maintenance as capital investments is incorrect.
- Question 30Interactive
Using the code block, select the portfolio items that are categorized as regulatory compliance investments.
- AP1Correct answer
- BP2
- CP3Correct answer
- DP4
Why this is the answer
The code block labels P1 and P3 as 'compliance', which represents mandatory or regulatory investments. P2 is growth and P4 is optimization.
- Question 31Single Choice
Who is ultimately accountable for approving the enterprise IT budget and ensuring it aligns with strategy?
- ABoard of DirectorsCorrect answer
- BChief Information Officer
- CChief Financial Officer
- DIT Steering Committee
Why this is the answer
Budget approval is a governance process, and in CGEIT the board of directors retains ultimate accountability for ensuring IT resources align with enterprise strategy.
- Question 32Multiple Select
Which statements about zero-based budgeting (ZBB) and incremental budgeting are correct?
- AZBB requires every line item to be justified from zero each cycle.Correct answer
- BIncremental budgeting is easier but can perpetuate waste.Correct answer
- CZBB is the only budgeting method accepted by governance frameworks.
- DIncremental budgeting is always preferred for turbulent strategy shifts.
Why this is the answer
ZBB challenges legacy costs by justifying each item from zero, while incremental budgeting is simpler but can institutionalize waste. Neither method is universally mandatory or always preferred.
- Question 33Interactive
The code block shows a budget variance report. What type of variance does this represent?
- AUnfavorable varianceCorrect answer
- BFavorable variance
- CZero variance
- DCapital variance
Why this is the answer
Actual spend exceeds planned spend by 20%, which is an unfavorable variance that should trigger variance analysis and corrective action.
- Question 34Single Choice
Why does CGEIT consider building the IT budget incrementally from historical costs a common governance mistake?
- AIt institutionalizes the status quo and may ignore shifting business prioritiesCorrect answer
- BIt guarantees full alignment with the strategic plan
- CIt automatically includes all mandatory regulatory costs
- DIt reduces the need for board oversight
Why this is the answer
Incremental budgeting from historical costs preserves existing spending patterns and fails to reallocate funds toward emerging strategic initiatives.
Risk Optimization
8 questions in this domain
- Question 35Single Choice
According to the CGEIT playbook, what does an IT risk management framework provide to an enterprise?
- AStructured principles and governance modelCorrect answer
- BPrescriptive mandatory requirements
- CBudget and staffing plan
- DSoftware implementation standard
Why this is the answer
A framework supplies a high-level structure, roles, principles, and lifecycle phases for IT risk governance.
- Question 36Multiple Select
Based on the CGEIT material, which of the following statements about ISO 31000 are correct?
- AIt is a non-prescriptive international benchmarkCorrect answer
- BIt harmonizes risk language with enterprise riskCorrect answer
- CIt can be certified by an external body
- DIt covers only information security risk
Why this is the answer
ISO 31000 provides principles, framework, and process for any type of risk and is a non-certifiable guideline.
- Question 37Interactive
Based on the definitions in the exhibit, which term is defined as mandatory requirements or acceptance criteria?
- AStandardCorrect answer
- BFramework
- CMethodology
- DRisk appetite
Why this is the answer
A standard is prescriptive and specifies mandatory requirements or acceptance criteria against which the enterprise can be audited.
- Question 38Single Choice
According to the playbook, which governance body is accountable for approving the enterprise risk appetite statement?
- ABoard of directorsCorrect answer
- BChief Risk Officer
- CHead of Internal Audit
- DIT Steering Committee
Why this is the answer
The board owns and approves the risk appetite statement and is accountable for setting the governance tone.
- Question 39Multiple Select
According to the CGEIT material, which of the following statements about risk tolerance thresholds are correct?
- AIt is the operational expression of risk appetiteCorrect answer
- BIt can be expressed as measurable thresholdsCorrect answer
- CIt is identical to risk capacity
- DIt is set independently by the IT department
Why this is the answer
Tolerance translates risk appetite into measurable boundaries; capacity is the maximum risk the enterprise can absorb.
- Question 40Interactive
Based on the exhibit, which term refers to the maximum risk an enterprise can absorb without jeopardizing survival?
- ARisk capacityCorrect answer
- BRisk appetite
- CRisk tolerance
- DRisk culture
Why this is the answer
Risk capacity is the maximum risk the enterprise can absorb; risk appetite must always be lower than risk capacity.
- Question 41Single Choice
In the risk assessment process, risk evaluation compares the analyzed risk levels against which reference point?
- ARisk criteria and appetiteCorrect answer
- BVendor security ratings
- CHistorical audit reports
- DBenchmarks from competitors
Why this is the answer
Risk evaluation compares analyzed risk levels with risk criteria, including appetite and tolerance, to decide on treatment.
- Question 42Multiple Select
According to the playbook, which of the following characteristics apply to quantitative risk analysis?
- AUses numerical values and monetary estimatesCorrect answer
- BRequires credible loss dataCorrect answer
- CUses categorical scales such as High and Low
- DIs always faster than qualitative analysis
Why this is the answer
Quantitative analysis uses numerical values, monetary estimates, and credible data; it can be resource-intensive and complex.
Frequently asked questions
Everything about the ISACA CGEIT question bank and how to use it.