Free CGEIT Practice Test 2026: Full 150-Question Mock Exams

Question 1Benefits Realization

A retail chain is preparing a business case for a new customer loyalty platform. The IT department has written most of the document. Who should own the business case?

Correct answer: C. The business sponsor who will be accountable for the benefits
The business sponsor should own the business case because the business is accountable for realizing the benefits. IT, the project manager and finance contribute content, but ownership with them weakens accountability for value.

Question 2Governance of Enterprise IT

Which of the following BEST describes the purpose of the Evaluate, Direct and Monitor objectives in COBIT 2019?

Correct answer: B. They guide the governing body in setting direction and overseeing performance
Evaluate, Direct and Monitor objectives sit in the governance domain and are owned by the board and executive leadership. The other options describe management domains such as Build, Acquire and Implement or Deliver, Service and Support, which plan and execute rather than govern.

Question 3Governance of Enterprise IT

A regional logistics firm has hired a new CIO and asked for a three-year IT strategic plan. The previous plan was written by IT managers using only internal technology priorities. What should the CIO do FIRST?

Correct answer: D. Obtain a clear understanding of the enterprise strategy and business objectives
An IT strategy must be derived from enterprise direction, so understanding business objectives comes first. Process maturity assessments and benchmarks are useful inputs later, but without business objectives they cannot show which gaps matter.

Question 4Risk Optimization

A mining company manages IT risk in a separate register that the enterprise risk committee never sees. What is the GREATEST concern?

Correct answer: A. IT risks may not be considered alongside other enterprise risks in decisions
IT risk should be integrated into enterprise risk management so leaders see it alongside strategic, financial and operational risk. Formatting, workload and register size are minor compared with excluding IT risk from enterprise decisions.

Question 5IT Resources

A university's IT department spends 80 percent of its budget keeping legacy systems running and has little left for new student services the strategy calls for. What is the BEST governance action?

Correct answer: B. Rebalance the IT portfolio between run, grow and transform spending based on strategy
Rebalancing run, grow and transform spending lets leadership direct resources to strategic priorities while keeping essential operations safe. Freezing all maintenance creates operational risk without a plan for the strategic shift.

Question 6Benefits Realization

An airline's investment committee is reviewing a business case for a crew scheduling system. Which content is MOST important for the committee to evaluate?

Correct answer: A. The expected benefits, how they will be measured and who owns them
Investment decisions depend on understanding what value will be delivered, how it will be measured and who is accountable. Architecture, vendor names and sprint plans are delivery details that do not show whether the investment is worthwhile.

Question 7Governance of Enterprise IT

Which of the following BEST describes the primary purpose of an IT balanced scorecard?

Correct answer: D. To translate IT strategy into measurable objectives across several perspectives
An IT balanced scorecard links strategy to measurable objectives across perspectives such as business contribution, user orientation, operational excellence and future readiness. It complements financial measures rather than replacing them, and it is not mainly a project ranking tool.

Question 8Governance of Enterprise IT

At a regional hospital network, the board passed a resolution stating that all IT governance matters are the sole responsibility of the CIO. The board no longer reviews IT performance or major IT risks. Which of the following is the GREATEST concern?

Correct answer: A. The board has given up accountability that it cannot delegate
The board remains accountable for governance of enterprise IT even when it delegates execution to management. Staffing and benchmarking issues are management concerns and are far less serious than the board abandoning its oversight duty.

Question 9Risk Optimization

A growing fintech company has no formal risk appetite. The CEO asks who should define it. Which answer is BEST?

Correct answer: C. The board, with input from executive management
The board is responsible for setting risk appetite, informed by executive management, because it reflects how much risk the enterprise is willing to take to pursue its objectives. The CISO, audit and unit managers provide input or assurance but do not set enterprise appetite.

Question 10Benefits Realization

A utility approved a business case for a smart meter program two years ago. Costs and market conditions have changed since then. What is the BEST practice for the business case?

Correct answer: A. Update it at key stage gates and re-confirm the investment is still justified
A business case is a living document that should be updated at key points to confirm the investment still makes sense. Freezing or archiving it removes the basis for continuing, re-scoping or stopping the program.

Question 11IT Resources

A logistics company is considering outsourcing its application support. Several vendors have already sent proposals. What is the MOST important step before evaluating the proposals?

Correct answer: D. Define the business objectives and requirements the sourcing must meet
Sourcing decisions should start from clear business objectives and requirements so that proposals can be judged against what the enterprise needs. Price negotiation and site visits come later and are meaningless without agreed evaluation criteria.

Question 12Governance of Enterprise IT

A hospital network is adopting a goals cascade to connect board expectations with IT activities. Which outcome BEST shows the cascade is working as intended?

Correct answer: B. Each IT process objective can be traced to an enterprise goal and stakeholder need
A goals cascade translates stakeholder needs into enterprise goals, then into alignment goals and governance and management objectives. Traceability from IT objectives back to enterprise goals is the evidence that it works. Uniform metrics or framework references in job descriptions do not prove that link.

Question 13Governance of Enterprise IT

A logistics company plans to adopt COBIT 2019 and wants a governance system that fits its situation rather than a generic template. What should the governance team do FIRST?

Correct answer: C. Analyze design factors such as enterprise strategy and risk profile
COBIT 2019 tailors a governance system by first understanding design factors like enterprise strategy, goals, risk profile and compliance requirements. Implementing every objective at once ignores tailoring, and buying tools or benchmarking is premature before priorities are known.

Question 14Risk Optimization

Which statement BEST describes risk tolerance?

Correct answer: B. The acceptable level of variation around a specific objective or appetite
Risk tolerance is the acceptable deviation from a target or appetite level for a particular objective. The total amount the enterprise could absorb is risk capacity, and the other options describe a response type and a likelihood.

Question 15Benefits Realization

Under value management practices similar to Val IT, which statement BEST describes portfolio management?

Correct answer: D. Selecting and managing a mix of investments to optimize overall value
Portfolio management selects, prioritizes and balances a set of investments so that, together, they deliver the greatest value for the enterprise. Managing one project or tracking services are narrower activities.

Question 16IT Resources

A hospital network outsourced its data center operations to a managed service provider. After an outage, the board asks who is accountable for the impact on patient services. Which response is BEST?

Correct answer: B. The hospital remains accountable, even though the provider performs the work
Outsourcing transfers the execution of a service, not the enterprise's accountability for outcomes. The hospital must govern the provider through the contract and SLAs, while answering to its own stakeholders for service impact.

Question 17Benefits Realization

A board member asks the CIO, "Are we doing the right things with our IT investments?" Which activity BEST answers this question?

Correct answer: C. Assessing whether investments align with enterprise strategy
Doing the right things is a question of strategic alignment and investment choice. On-time delivery, procedure compliance and uptime address whether things are done well, not whether the right investments were chosen.

Question 18Governance of Enterprise IT

A retail company's marketing division plans to buy its own customer analytics platform. The platform conflicts with the approved enterprise IT strategy, which calls for a single shared data platform. What is the BEST course of action?

Correct answer: A. Refer the decision to the IT strategy or steering committee for resolution
Conflicts between business unit initiatives and the approved strategy should be resolved by the governance body that owns strategic alignment. Blocking the purchase through IT alone is a management action taken without a governance decision, and allowing it ignores the strategy.

Question 19Governance of Enterprise IT

Which of the following BEST describes a focus area in COBIT 2019?

Correct answer: D. A governance topic, such as cybersecurity, addressed by a tailored set of components
A focus area is a specific governance topic or situation, such as cybersecurity, DevOps or small and medium enterprises, that is addressed by a tailored collection of objectives and components. It is not a single objective, an organizational unit or a capability level.

Question 20Risk Optimization

At a retail bank, IT has been listed as the owner of all risks related to the online banking platform. What is the BEST improvement?

Correct answer: A. Assign ownership of those risks to the relevant business process owners
Business owners are accountable for the risks to the processes and outcomes they own, while IT manages related controls. Assigning ownership to IT, a vendor or the CISO separates accountability from the business impact.

Question 21Benefits Realization

A bank set up a digital onboarding initiative as a pure IT project, although it requires new branch processes and staff roles. What is the GREATEST concern?

Correct answer: C. The IT project may be completed without the business changes needed for benefits
Benefits from IT-enabled change depend on business changes such as new processes and roles, which a program should coordinate with the technology work. Treating it as a narrow IT project risks delivering software that produces no value.

Question 22Governance of Enterprise IT

A bank's project teams often skip the enterprise architecture review to meet tight delivery dates. Several new systems duplicate functions that already exist elsewhere. What is the GREATEST concern for governance?

Correct answer: D. Growing complexity and cost that reduce agility over time
Bypassing architecture review creates duplication and complexity that raise long-term cost and reduce the enterprise's ability to change. Staffing and vendor fees are secondary effects of the same root problem, not the main governance concern.

Question 23Governance of Enterprise IT

An insurance firm has well-written IT policies approved by executives. Reviews show that managers routinely work around the policies to meet deadlines, and leaders rarely challenge this. Which governance system component is MOST in need of attention?

Correct answer: D. Culture, ethics and behavior
The policies already exist, so the weakness is in how people behave and what leaders tolerate, which is the culture, ethics and behavior component. Rewriting policies would not help when the real problem is that behavior does not follow them.

Question 24Risk Optimization

A shipping firm is starting its first enterprise-wide IT risk assessment. What should be done FIRST?

Correct answer: B. Understand the business context and critical processes IT supports
Understanding the business context and critical processes ensures the assessment focuses on what matters to the enterprise. Scans, tools and ratings are later steps that depend on knowing what to protect and why.

Question 25IT Resources

An insurer is drafting a new service level agreement with a claims processing vendor. Which element is MOST important to include?

Correct answer: C. Measurable service levels that reflect business requirements
An SLA is only useful for governance if its service levels are measurable and tied to what the business needs. Staffing models, tool lists and meetings may support delivery, but they do not define the outcome the enterprise is paying for.

Question 26Benefits Realization

A healthcare provider has 40 proposed IT initiatives and funding for about 12. Which criteria are MOST appropriate for prioritizing them?

Correct answer: D. Strategic alignment, expected value and risk of each initiative
Prioritization should favor initiatives that best support strategy and deliver the most value at acceptable risk. Submission order, department size and IT preference do not reflect enterprise value.

Question 27Governance of Enterprise IT

An insurer wants to make sure new solutions follow its enterprise architecture standards. Which mechanism is MOST effective?

Correct answer: C. Requiring architecture board approval at defined project stage gates
Embedding architecture review into project stage gates catches deviations early, when changes are cheapest. Annual audits only find problems after systems are built, and publishing standards alone does not ensure they are applied.

Question 28Governance of Enterprise IT

A retail group is creating an IT strategy committee at board level. Which of the following should be the PRIMARY role of this committee?

Correct answer: B. Advising the board on how IT supports enterprise strategy
An IT strategy committee operates at board level and advises the board on strategic IT direction, value and risk. Ranking projects is a typical task of an executive IT steering committee, and change approvals and service desk supervision are operational management tasks.

Question 29Risk Optimization

A risk assessment at a pharmaceutical company identified a significant risk to clinical trial data. Several responses are possible. What should MOST influence the choice of response?

Correct answer: C. The risk appetite and the cost compared with the risk reduced
The choice of response should bring the risk within appetite at a cost that is justified by the reduction achieved. IT preference, competitor practice and speed may be considered but are not the main criteria.

Question 30Benefits Realization

A large insurer wants to reduce the risk of spending heavily on programs that later fail. Which funding approach is BEST?

Correct answer: A. Release funding in stages tied to reviews of value and progress
Stage-gated funding releases money as programs show continued value and progress, allowing the enterprise to stop or adjust early. Upfront full funding removes that control, and the other options do not address the risk of failed programs.

Question 31IT Resources

At a fast-growing retailer, several business units have signed up for cloud services on corporate credit cards without IT involvement. What should executive management do FIRST?

Correct answer: B. Approve a cloud strategy and policy that defines how cloud is adopted
An approved cloud strategy and policy gives direction on when and how cloud services may be used, which addresses the root cause. Blocking or repatriating services is a reactive operational step that may harm the business, and an audit only describes the problem.

Question 32Governance of Enterprise IT

Which of the following BEST describes the role of a technology roadmap in enterprise architecture governance?

Correct answer: A. It sequences the move to the target architecture by business priority
A technology roadmap shows how and when the enterprise will move from its baseline to its target architecture, ordered by business priority. Asset replacement lists and configuration records are operational artifacts and do not provide strategic direction.

Question 33Governance of Enterprise IT

A manufacturing company has more proposed IT projects than it can fund. Business units complain that the loudest executive always wins. Which of the following is the BEST way to address this?

Correct answer: C. Have an IT steering committee prioritize projects against enterprise goals
An executive IT steering committee that prioritizes investments against agreed enterprise goals brings transparency and business alignment to funding decisions. Equal splits or first-come ordering ignore value, and leaving it to the CIO removes business ownership of the choices.

Question 34Benefits Realization

A transportation authority is planning a ticketing modernization program. Which technique BEST helps link program outputs to the business benefits they are expected to produce?

Correct answer: D. A benefits dependency map
A benefits dependency map shows how enablers and business changes lead to benefits and objectives, making the value logic clear. A work breakdown structure and Gantt chart organize work, and a heat map shows risks.

Question 35Risk Optimization

A project manager at an energy utility wants to accept a high risk that exceeds the project's authority limits. What is the BEST course of action?

Correct answer: D. Escalate the decision to the level with authority to accept that risk
Risk acceptance must be made by someone with the authority to accept that level of risk, which is usually defined by appetite and delegation. Accepting it at the wrong level undermines governance, and ignoring or shifting it does not address it properly.

Question 36Benefits Realization

A hotel group's business case for a revenue management system lists five benefits but no one is named against them. What should be done FIRST?

Correct answer: A. Assign a business owner to each benefit
Each benefit needs a named business owner who is accountable for realizing and reporting it. IT cannot own business outcomes, and removing benefits or adding contingency does not create accountability.

Question 37IT Resources

A manufacturer now uses five different vendors for network, hosting, desktop support, applications and security. Incidents often bounce between vendors with no one taking ownership. Which approach would BEST address this?

Correct answer: B. Establish a service integration function to coordinate the vendors
In a multi-sourcing model, a service integration function coordinates end-to-end service across providers and owns cross-vendor issues. Replacing every vendor at once is drastic and risky, and account managers alone do not create end-to-end ownership.

Question 38Governance of Enterprise IT

A manufacturer wants to build a transition plan to modernize its application landscape. The architecture team has a list of new technologies it would like to adopt. What should be done FIRST?

Correct answer: D. Define both the baseline and target architectures to identify gaps
A transition plan depends on a gap analysis, which requires a defined baseline and target architecture. Selecting vendors, budgeting or piloting before that would be premature and could commit funds to technology that does not close real gaps.

Question 39Governance of Enterprise IT

While reviewing a RACI chart for IT investment approval, a governance consultant finds that three different executives are marked as accountable for the same decision. What should the consultant recommend?

Correct answer: C. Assign a single accountable role for the decision
A RACI chart should have exactly one accountable role for each activity or decision so that ownership is clear. Adding more accountable roles makes the ambiguity worse, and turning everyone into consulted parties leaves nobody accountable.

Question 40Risk Optimization

What is the PRIMARY purpose of key risk indicators?

Correct answer: B. To provide early warning of changes in risk exposure
KRIs give early warning that risk exposure is rising so management can act before an event happens. Process performance is measured by KPIs, and loss records are lagging data.

Question 41Benefits Realization

A marketing department wants an early signal that its new CRM system is on track to increase sales, which will take a year to measure. Which measure is the BEST leading indicator?

Correct answer: C. Percentage of sales staff actively logging opportunities in the CRM
Active use of the CRM by sales staff is a leading indicator that predicts later sales outcomes. Revenue and retention are lagging indicators, and implementation cost does not indicate benefit progress.

Question 42Governance of Enterprise IT

Which of the following BEST describes an IT standard within a policy framework?

Correct answer: A. A mandatory, specific rule that supports a policy
Standards are mandatory and make policies specific, for example by naming approved technologies or minimum settings. A high-level statement of intent is a policy, discretionary advice is a guideline, and step-by-step instructions are procedures.

Question 43Governance of Enterprise IT

A university replaced its student information system. Two years later, few of the promised benefits have appeared, and IT says its job ended at go-live. Who should be held accountable for realizing the expected benefits?

Correct answer: B. The business owner who sponsored the investment
Business owners who sponsor investments are accountable for realizing the benefits, because benefits come from changed business processes and use of the system. The project manager is accountable for delivery, not for business outcomes after go-live.

Question 44Risk Optimization

A university is selecting KRIs for its research data platform. Which characteristic is MOST important?

Correct answer: A. The indicators are leading and linked to thresholds based on appetite
Effective KRIs should signal changes in exposure early and have thresholds tied to risk appetite so they trigger action. Ease of collection matters but should not override relevance, and covering every threat is impractical.

Question 45Benefits Realization

A city council will implement a new permit system to reduce processing time. The business case claims a 50% improvement. What must be done BEFORE implementation to support that claim later?

Correct answer: C. Measure current processing times to establish a baseline
Without a baseline of current performance, the enterprise cannot later show whether processing time actually improved. Training, vendor selection and publication do not provide the measurement needed to prove benefits.

Question 46IT Resources

Business users at a telecom company complain that a hosting vendor's service has declined over the last quarter. What should the vendor manager do FIRST?

Correct answer: B. Review the vendor's actual performance against the contract and SLAs
Reviewing performance data against the agreed contract and SLAs establishes the facts and the basis for any corrective action. Withholding payment, escalating or retendering before confirming the breach could be unjustified and may damage the relationship.

Question 47Governance of Enterprise IT

A university's business units request exceptions to its IT security policy almost every week, and the requests are approved informally by IT staff. What is the BEST action?

Correct answer: D. Create a formal exception process with risk accepted by accountable owners
A formal process ensures exceptions are justified, time-bound and accepted by someone accountable for the risk. Denying all requests ignores legitimate business needs, and removing requirements without analysis may weaken necessary controls.

Question 48Governance of Enterprise IT

A payments processor learns that a new data protection law will apply to it in 18 months. The board asks the CIO what the enterprise should do. What should be done FIRST?

Correct answer: A. Determine which requirements apply and their impact on the enterprise
Understanding which requirements apply and how they affect business processes, systems and risk is the first step before any response is chosen. Buying tools, training staff or seeking certification are premature until the impact is known.

Question 49Benefits Realization

A distribution company went live with a warehouse system last week. The sponsor wants the post-implementation review done immediately. What is the BEST advice?

Correct answer: B. Schedule the review after benefits have had time to emerge
A post-implementation review should occur once the solution has operated long enough for benefits to be measured. A review right after go-live can assess delivery but not value, and skipping it loses the chance to confirm benefits.

Question 50Risk Optimization

A board receives a 60-page IT risk report listing hundreds of technical findings. Directors say they cannot see the big picture. What is the BEST improvement?

Correct answer: D. Report aggregated risk in business terms and against appetite
Boards need aggregated risk information expressed in business terms and compared with appetite so they can direct and oversee. Simply filtering findings or sending reports more often does not provide that view.

Question 51IT Resources

An online travel agency plans its infrastructure capacity each year by adding 20% to current usage. Last year, a new marketing campaign caused a major slowdown. What is the BEST improvement to the capacity planning process?

Correct answer: D. Base capacity plans on business forecasts and planned initiatives
Capacity planning should be driven by expected business demand, including campaigns and new initiatives, rather than by fixed percentages. A bigger buffer wastes money without fixing the method, and more alerts only detect problems after they occur.

Question 52Benefits Realization

What is the PRIMARY purpose of a post-implementation review for an IT-enabled investment?

Correct answer: A. To compare actual results with the benefits in the business case
The main purpose is to determine whether the investment delivered the expected value and to learn lessons. Staff performance, invoices and configuration records are not the focus of a benefits-oriented review.

Question 53Governance of Enterprise IT

A media company finds that its IT acceptable use policy and its HR employee monitoring policy give conflicting rules on reviewing staff email. What is the BEST way to resolve this?

Correct answer: C. Harmonize both policies under a single policy framework with clear ownership
Conflicting policies point to a weak policy framework, so the fix is to harmonize them under a clear hierarchy and ownership model. Letting each department apply its own rules keeps the conflict, and choosing by approval date is arbitrary.

Question 54Governance of Enterprise IT

The board of an energy utility wants confidence that IT-related legal and regulatory obligations are being met on an ongoing basis. Which of the following is the BEST approach?

Correct answer: A. Embed compliance obligations in the governance framework with ongoing monitoring
Embedding compliance obligations into the governance framework, with defined ownership, monitoring and reporting, gives the board continuing assurance. A yearly CIO statement or contract review provides only a point-in-time view, and waiting for regulators means problems are found too late.

Question 55Risk Optimization

Which statement BEST reflects a core principle of ISO 31000?

Correct answer: B. Risk management should be integrated into all organizational activities
ISO 31000 emphasizes that risk management is part of governance and integrated into all organizational activities and decisions. It does not aim to eliminate all risk and is not limited to certain risk types.

Question 56Benefits Realization

An energy company uses a balanced scorecard at the enterprise level. The IT department wants to build its own scorecard. What is MOST important?

Correct answer: B. IT scorecard objectives should link to enterprise scorecard objectives
An IT balanced scorecard is valuable when its objectives clearly support the enterprise scorecard, showing how IT contributes to business goals. Purely technical metrics or IT-only review would weaken that alignment.

Question 57Governance of Enterprise IT

An energy company launched a new IT governance program, but middle managers continue to make technology decisions outside the agreed process. What is MOST likely to improve adoption?

Correct answer: C. Visible and consistent sponsorship of the program by executive leadership
Governance changes behavior when leaders visibly support it and hold managers accountable. More procedures or tools do not address resistance, and centralizing all decisions in IT shifts accountability away from the business.

Question 58Governance of Enterprise IT

At a media company, business units keep buying their own technology platforms, and central IT keeps rejecting them as nonstandard. Disputes often reach the CEO. Which of the following would BEST resolve this conflict?

Correct answer: B. Define and communicate decision rights for technology choices
Clear decision rights establish who decides, who provides input and who is informed for technology choices, which removes repeated disputes. A full IT veto or full business freedom swings to an extreme, and escalating each case to the CEO does not fix the underlying governance gap.

Question 59IT Resources

A university wants to improve governance over its IT assets, which are spread across many faculties. Which action provides the BEST foundation?

Correct answer: D. Establish a complete and maintained inventory of IT assets
An accurate, maintained inventory is the basis for managing assets across their life cycle, including cost, risk and renewal decisions. Tagging tools, vendor standards and virtualization may help later, but they depend on knowing what assets exist.

Question 60Benefits Realization

A board asks why the enterprise should assess the capability levels of its IT processes. Which answer BEST explains the purpose?

Correct answer: A. To identify gaps between current and needed capability and plan improvement
Capability assessments show where processes fall short of the level the business needs and guide improvement priorities. Reaching the highest level everywhere is usually not cost effective, and the other options are unrelated.

Question 61Risk Optimization

COBIT discusses two perspectives on risk. Which statement BEST describes the risk function perspective?

Correct answer: C. It describes what is needed to build and sustain effective risk governance and management
The risk function perspective focuses on what an enterprise needs to build and sustain its risk governance and management capability. The risk management perspective deals with identifying and responding to specific risks.

Question 62Governance of Enterprise IT

A technology firm set up an ethics hotline for staff two years ago, but it has received almost no reports. An internal survey shows many employees have witnessed misconduct. What is the GREATEST concern?

Correct answer: A. Employees may fear retaliation for reporting concerns
Low reporting despite known misconduct usually signals a lack of trust and fear of retaliation, which undermines the ethical culture. Cost and contact details are minor issues compared with staff believing it is unsafe to speak up.

Question 63Governance of Enterprise IT

A global consumer goods company has strong regional business units with different market needs, but it also wants common security standards and shared infrastructure. Which IT governance structure BEST fits this situation?

Correct answer: D. A federated model with central standards and regional decisions on local needs
A federated model keeps enterprise-wide decisions such as security standards and shared infrastructure central while letting regions decide on local business needs. Full centralization ignores regional differences, and full decentralization defeats the goal of common standards.

Question 64Benefits Realization

Six months after a new expense system went live at a consulting firm, most staff still submit paper claims. What should the change sponsor do FIRST?

Correct answer: A. Find out why staff are not adopting the new system
Understanding the causes of resistance, such as usability issues or poor training, allows a targeted response. Mandates without understanding may harden resistance, and adding features or closing the project ignores the real problem.

Question 65Risk Optimization

A retail company is redesigning its order fulfillment around a new automated warehouse system. When should risk assessment of this IT-enabled change be performed?

Correct answer: C. As part of the business case and throughout the program
Risk related to IT-enabled change should be assessed from the business case onward so it informs the decision and is managed throughout delivery. Waiting for testing, go-live or an incident misses the chance to shape the investment.

Question 66IT Resources

A payments company relies on one senior engineer who alone understands its settlement platform. He has hinted that he may retire next year. What is the MOST important governance concern?

Correct answer: D. There is no succession or knowledge transfer plan for a critical role
Dependence on one person for a critical platform is a key person risk that threatens service continuity. A succession and knowledge transfer plan reduces that risk, while salary, language age and training status are secondary concerns.

Question 67Benefits Realization

A global manufacturer is rolling out a new ERP system that changes how every plant works. Which factor is MOST critical to organizational adoption?

Correct answer: D. Visible and active support from executive sponsors
Visible executive sponsorship signals importance, removes barriers and drives behavior change across the organization. Customizations, server speed and reporting tools may matter technically, but they do not drive adoption.

Question 68Governance of Enterprise IT

At a telecom provider, IT managers receive bonuses based only on delivering projects by their deadlines. Post-implementation reviews show recurring quality problems and benefits that are not realized. What should executive management do?

Correct answer: B. Align performance incentives with value delivery and risk outcomes
Incentives drive behavior, so rewarding deadlines alone encourages teams to sacrifice quality and value. Aligning incentives with business outcomes addresses the root cause, while extra testing or longer deadlines only treat symptoms.

Question 69Governance of Enterprise IT

Two regional banks have just merged. Each bank has its own IT steering committee, policies and investment approval process. What should the combined leadership do FIRST to govern IT during integration?

Correct answer: C. Set up an interim governance structure with clear decision rights
An interim governance structure with agreed decision rights lets the merged entity make consistent integration decisions while the long-term model is designed. Adopting one bank's policies without review or making major cuts first skips the governance step, and keeping two structures indefinitely creates conflict.

Question 70Risk Optimization

A health insurer is moving claims processing to a public cloud provider. Which governance concern should leadership address FIRST?

Correct answer: B. Understanding which controls the insurer and the provider each own
Under the shared responsibility model, some controls stay with the customer, so leadership must understand who is responsible for what. Cost, training and marketing comparisons do not address the governance gap.

Question 71Benefits Realization

An IT service organization keeps seeing the same type of incident each month, even though each one is fixed quickly. What is the BEST continuous improvement action?

Correct answer: C. Analyze the root cause and address it permanently
Continuous improvement aims to remove underlying causes so problems do not recur. Fast fixes, more staff or reclassifying incidents treat symptoms and may hide the real issue.

Question 72IT Resources

A government agency is moving many services to digital channels over the next four years. Leadership suspects current IT staff lack the needed skills. What should be done FIRST?

Correct answer: B. Assess current competencies against the skills the strategy requires
A competency assessment against future needs shows the actual skills gap and guides whether to train, hire or source. Training, hiring or outsourcing before the gap is known could waste money on the wrong skills.

Question 73Governance of Enterprise IT

Board members of a pharmaceutical company say the quarterly IT reports are hard to understand and full of technical terms. What is the BEST improvement?

Correct answer: C. Present IT performance in business terms linked to enterprise goals
Boards need information framed around business outcomes, value and risk so they can fulfill their oversight role. A glossary or technical training still leaves the board decoding operational detail instead of focusing on governance decisions.

Question 74Governance of Enterprise IT

The audit committee of a regional bank receives separate IT reports from internal audit, the risk function, compliance and the external auditor. Directors notice that some areas are reviewed by three groups while cloud services are reviewed by none. What is the BEST improvement?

Correct answer: A. Develop an assurance map so providers coordinate coverage and close gaps
An assurance map, or combined assurance approach, shows which provider covers each key risk so overlaps can be reduced and gaps such as cloud services can be closed. Adding cloud to one audit fixes a single gap but leaves the uncoordinated model that caused it.

Question 75Benefits Realization

An automation program at an insurance company frees about 20,000 staff hours a year in claims handling. One year later, headcount and operating budgets are unchanged, and no new work has been assigned to the freed time. What should the benefit owner do?

Correct answer: D. Plan how freed capacity will be redeployed or removed from budgets
Efficiency gains become real benefits only when the freed capacity is redeployed to valuable work or removed from budgets. Reporting freed hours as savings overstates value, because nothing in the enterprise's costs or outcomes has changed.

Question 76Risk Optimization

A manufacturer plans to engage a vendor that will process sensitive engineering designs. Which action is MOST important before signing the contract?

Correct answer: A. Perform risk-based due diligence on the vendor's controls and stability
Due diligence before contracting lets the manufacturer judge whether the vendor can protect sensitive data and remain viable. Price, references and invoice formats do not reveal the vendor's risk.

Question 77Governance of Enterprise IT

A government agency is creating a communication plan for its new IT governance framework. What should be done FIRST?

Correct answer: C. Identify stakeholders and analyze their interests and influence
Effective communication starts with stakeholder analysis, so messages and channels can be tailored to each group's needs and influence. Writing messages or booking meetings first risks reaching the wrong people with the wrong content.

Question 78Governance of Enterprise IT

A transport authority has launched a digital transformation program spanning ticketing, customer apps and data analytics. What is the MOST important role of governance for this program?

Correct answer: D. Ensuring the program aligns with strategy and delivers defined outcomes
Governance sets direction and monitors whether the transformation supports enterprise strategy and delivers the expected outcomes. Choosing methods, designing screens and managing backlogs are management and delivery activities.

Question 79IT Resources

A media group has more approved IT projects than its delivery teams can handle. Each executive insists their project is the most urgent. Which approach is BEST for allocating resources?

Correct answer: D. Prioritize projects through the portfolio process using value and strategic fit
A portfolio process that ranks initiatives by value, risk and strategic alignment gives a transparent basis for allocating scarce resources. Seniority, equal shares or team preference do not ensure that resources go to the initiatives that matter most to the enterprise.

Question 80Benefits Realization

A program to build a new trading platform is 60% complete. A market change means the expected benefits are now far lower than its remaining cost. What should the investment committee do?

Correct answer: B. Re-evaluate the business case and consider stopping or re-scoping
When the business case no longer justifies the remaining spend, the committee should reassess and consider stopping or re-scoping. Money already spent is a sunk cost and should not drive the decision to continue.

Question 81Risk Optimization

A board asks how it should be involved in information security. Which response BEST reflects good governance?

Correct answer: B. The board should direct a business-aligned security strategy and monitor results
The board directs and oversees information security by ensuring a strategy aligned with business objectives and monitoring outcomes. Approving firewall changes or investigating incidents is operational, and leaving it entirely to IT ignores accountability.

Question 82Governance of Enterprise IT

A consumer goods company is assigning ownership of its customer master data. Who should be the data owner?

Correct answer: D. The senior business manager accountable for customer-facing processes
Data owners should be business leaders accountable for the processes that create and use the data, because they understand its value and risk. IT roles act as custodians that implement the owner's decisions rather than owning the data.

Question 83Governance of Enterprise IT

A COBIT-based assessment rates a company's change management process at capability level 1. Which of the following BEST describes what this rating means?

Correct answer: C. The process achieves its purpose only through incomplete activities
At capability level 1 a process more or less achieves its purpose through an incomplete set of activities. Defined organization-wide standards, quantitative measurement and optimization describe higher capability levels.

Question 84Benefits Realization

A media company requires a full 40-page business case for every IT request, including $2,000 purchases. Business leaders say governance is slowing everything down. What is the BEST improvement?

Correct answer: B. Scale business case requirements to the size and risk of the investment
Governance should be proportionate, so smaller and lower-risk investments need lighter justification while major ones get full scrutiny. Removing requirements broadly or skipping review loses control, and IT authorship weakens business ownership.

Question 85IT Resources

A pharmaceutical company is about to sign a five-year outsourcing contract for its research computing. The draft contract has no termination assistance terms. What is the GREATEST concern?

Correct answer: C. The company may struggle to transition the service if the contract ends
Without exit and termination assistance terms, the enterprise may be unable to move the service to another provider or back in-house, creating lock-in and continuity risk. Price increases, reports and staffing are concerns but are usually handled in other contract clauses.

Question 86Risk Optimization

A newly hired CISO at a regional insurer has drafted an information security policy. Who should approve it?

Correct answer: A. Senior management or the board
Approval by senior management or the board shows commitment and gives the policy authority across the enterprise. Technical staff and external auditors should not approve enterprise policy.

Question 87Benefits Realization

Two programs at a bank both claim the same reduction in call center staff as their main benefit. What is the GREATEST concern for portfolio reporting?

Correct answer: B. Benefits may be counted twice, overstating portfolio value
If the same benefit is claimed by two programs, total portfolio value is overstated and investment decisions may be distorted. The other concerns are operational and do not affect the integrity of value reporting.

Question 88Governance of Enterprise IT

A legal services firm asked data owners to classify their information, but each owner applied labels differently and results are inconsistent. What should be done FIRST?

Correct answer: A. Define a classification scheme with clear criteria approved by management
Consistent classification requires an approved scheme with clear criteria that all owners apply. Automation and audits depend on those criteria existing first, and labeling everything as most restrictive wastes resources and weakens meaningful protection.

Question 89Governance of Enterprise IT

A city government started an IT governance program last year. Executives skip governance meetings, and decisions are made outside the agreed forums. Which of the following is the GREATEST threat to the program?

Correct answer: C. Lack of visible commitment from senior leadership
Governance programs depend on visible senior leadership commitment, and executives bypassing the forums undermines the program's authority. More policies, tools or training will not work while leaders signal that governance can be ignored.

Question 90Benefits Realization

A school district's case for a collaboration platform lists better teacher collaboration as the main benefit. How should this intangible benefit BEST be handled?

Correct answer: D. Define proxy measures that indicate whether collaboration improves
Intangible benefits can be tracked through proxy measures such as shared resources or survey results. Ignoring them, forcing arbitrary dollar values or accepting them without evidence weakens benefit management.

Question 91Risk Optimization

A logistics company is setting recovery priorities for its systems after a disruption. What should MOST influence these priorities?

Correct answer: D. The results of a business impact analysis
A business impact analysis identifies which processes are most critical and how quickly they must recover, which drives recovery priorities. System age, size or installation order do not reflect business impact.

Question 92IT Resources

A credit union outsources core banking to a provider whose controls are critical to regulatory compliance. Which contract clause is MOST important from a governance view?

Correct answer: A. A clause giving the credit union the right to audit the provider
A right-to-audit clause lets the credit union obtain assurance over controls it remains accountable for, including regulatory compliance. Fixed pricing and software choices do not provide that assurance, and free data center changes would weaken oversight.

Question 93Governance of Enterprise IT

A finance team at a shipping company wants to delete old transaction records to cut storage costs. The legal team insists records must be kept for several years. What is the BEST approach?

Correct answer: B. Adopt a retention schedule based on legal, regulatory and business needs
A formal retention schedule balances legal obligations with business value and cost, and it is approved by data owners with legal input. Keeping everything forever creates its own risk, and cheaper storage does not decide how long records should exist.

Question 94Governance of Enterprise IT

A gap analysis shows 14 weaknesses in an airline's IT governance. The governance office has limited budget and staff for next year. How should the improvement roadmap be built?

Correct answer: D. Prioritize gaps by their effect on enterprise goals and risk
A governance roadmap should sequence improvements by their contribution to enterprise goals and the risk they reduce, so scarce resources go where they matter most. Ordering by report position or cost alone ignores business value.

Question 95Benefits Realization

A program at a telecom company is 30% over budget, but the sponsor says the benefits are still strong. What should the governing body do?

Correct answer: C. Review the updated business case to confirm it still justifies the investment
Cost overruns change the value equation, so the business case should be re-examined to confirm the investment remains worthwhile. Automatic funding or cancellation skips that analysis, and cutting testing adds risk.

Question 96Risk Optimization

The board of a payments company wants assurance that the business continuity plan will work. What should it request?

Correct answer: A. Results of regular plan tests and the actions taken on findings
Test results and remediation actions provide evidence that the plan works and is improving. A plan document alone does not show that recovery is achievable.

Question 97Governance of Enterprise IT

Which of the following BEST describes the role of a data steward in a data governance program?

Correct answer: C. Manages day-to-day data definitions and quality on behalf of the data owner
Data stewards handle the daily work of maintaining definitions, quality rules and issue resolution for a data domain. Final accountability stays with the data owner, and running databases is a custodian function.

Question 98Governance of Enterprise IT

A retailer paid a software firm to build a custom pricing engine that gives it a market edge. The contract does not state who owns the source code or the intellectual property. What is the GREATEST concern?

Correct answer: A. The firm may reuse or sell the engine to the retailer's competitors
Without clear ownership terms, the developer may keep rights to the code and reuse it for competitors, which destroys the advantage the investment was meant to create. Higher enhancement fees are a cost issue, but losing control of a strategic asset is the greater governance risk.

Question 99Benefits Realization

An investment board notices that nearly all its IT spending goes to low-risk maintenance work, with almost nothing for innovation. What does this MOST likely indicate?

Correct answer: B. The portfolio may be unbalanced against strategic goals
A portfolio should balance investments across categories and risk levels in line with strategy. Heavy focus on maintenance may leave strategic goals unsupported, but stopping maintenance altogether would be unwise.

Question 100IT Resources

An engineering firm discovered during a vendor review that it is using far more software licenses than it purchased. What should management do FIRST to prevent this from happening again?

Correct answer: A. Establish a license management process with clear ownership
A license management process with assigned ownership addresses the root cause by tracking entitlements against use. Removing software or switching vendors is reactive, and negotiating a waiver deals only with the current finding.

Question 101Risk Optimization

Employees at a consulting firm have started using public generative AI tools to draft client reports. No guidance exists. What should leadership do FIRST?

Correct answer: C. Establish a policy defining acceptable use and risk controls for AI
A policy sets direction on acceptable use and addresses risks such as data leakage and quality, while still allowing value. Permanent bans, uncontrolled purchases or waiting for problems do not reflect balanced governance.

Question 102Benefits Realization

A conglomerate is creating an IT investment committee. What should be its PRIMARY role?

Correct answer: B. Approving, prioritizing and monitoring IT-enabled investments
An investment committee governs the portfolio by approving, prioritizing and monitoring investments for value. Daily project work, hardware standards and incident handling are management activities.

Question 103Governance of Enterprise IT

At a travel company, the sales, finance and marketing units each define an active customer differently. Executive reports show conflicting customer counts. What is the BEST long-term solution?

Correct answer: D. Establish common business definitions through an enterprise data governance body
A data governance body with business representation can agree and maintain shared definitions, such as in a business glossary. Having IT pick a definition lacks business accountability, and separate databases make the inconsistency permanent.

Question 104Governance of Enterprise IT

An engineering firm's governance system covers only the IT department. Business units handle their own data, cloud services and automation outside its scope. Which COBIT 2019 governance system principle is MOST clearly not being applied?

Correct answer: A. End-to-end governance system
The end-to-end principle says governance must cover all technology and information processing across the enterprise, wherever it happens. The firm's scope stops at the IT department, so technology used in business units is ungoverned.

Question 105IT Resources

A shipping company's key operations system runs on hardware that will reach end of vendor support in 18 months. No replacement is in the budget. What is the BEST action for the IT steering committee?

Correct answer: B. Include a refresh plan in the asset life cycle and investment process
Planning the refresh through the asset life cycle and investment process allows the decision to be funded and prioritized before support ends. Waiting for failure creates avoidable outage risk, and extensions or spare parts only delay the issue.

Question 106Benefits Realization

A hospital's new patient scheduling process cut waiting times sharply in its first six months. A year later, staff have returned to old workarounds and waiting times are rising again. What is the BEST action?

Correct answer: A. Embed the new way of working in process ownership and keep monitoring results
Benefits must be sustained after go-live, so the new process should be embedded with clear process ownership and ongoing measurement. Replacing the system or redesigning again ignores the cause, and accepting the decline gives up value already proven.

Question 107Risk Optimization

The risk register at a media company has not been updated in two years, although the business has changed. What is the BEST action?

Correct answer: D. Establish a process for regular review and update of the register
A defined review process keeps risk information current and relevant to decision making. Starting over each year loses history, auditors should not own the register, and the absence of incidents does not mean risk is unchanged.

Question 108Governance of Enterprise IT

A health insurer is decommissioning a legacy claims system. Some of its records are subject to an active litigation hold. What is the GREATEST concern?

Correct answer: A. Records under the legal hold may be destroyed with the system
Destroying records under a legal hold can bring severe legal penalties, so information lifecycle governance must protect them during decommissioning. Training, contract timing and report speed are operational matters with far less impact.

Question 109Governance of Enterprise IT

At a property management company, the CIO reports to the head of facilities. IT is discussed only in terms of cost, and the CIO is never invited to strategy sessions. Which of the following is the GREATEST concern?

Correct answer: C. IT may be excluded from shaping and supporting enterprise strategy
When IT is positioned only as a cost center and kept out of strategy, the enterprise cannot align IT with its goals or use technology to create value. Hiring difficulties and budget review frequency are lesser issues.

Question 110Benefits Realization

A software rollout at a law firm met every technical specification, yet lawyers say it does not support how they work. Which quality principle was MOST likely overlooked?

Correct answer: A. Quality must be defined by stakeholder needs and fitness for purpose
Quality should be defined by what stakeholders need, so a solution that meets specifications but not real needs is not fit for purpose. Defect counts and testing-team ownership give a narrow view of quality.

Question 111Risk Optimization

Which statement BEST describes a key limitation of using a risk heat map for board reporting?

Correct answer: D. Ratings can be subjective and may hide how related risks combine
Heat maps often rely on subjective ratings and show risks one at a time, which can hide how related risks add up. They are not limited to security risks, do not need special software and rarely show detailed financial figures.

Question 112IT Resources

A consumer goods company outsourced its service desk three years ago. User satisfaction has fallen, and executives are considering bringing it back in-house. Which factor is MOST important to evaluate?

Correct answer: B. Whether the company has the capability and capacity to run the service again
Insourcing only makes sense if the enterprise can build or regain the skills, tools and capacity to deliver the service well. Industry trends and vendor discounts may inform the discussion, but they do not show whether insourcing would actually improve outcomes.

Question 113Governance of Enterprise IT

Investors and regulators are asking a retailer to report the environmental impact of its operations, including its data centers and cloud use. The board wants IT to contribute. What should the board direct FIRST?

Correct answer: C. Include sustainability objectives and metrics for IT in the enterprise strategy and reporting
Governance starts by setting direction: sustainability objectives and metrics for IT must link to the enterprise strategy so progress can be measured and reported. Buying offsets or setting unmeasured cuts acts before the goals and baseline are defined.

Question 114Governance of Enterprise IT

Which of the following BEST describes the purpose of an IT steering committee charter?

Correct answer: B. It defines the committee's mandate, authority, membership and decision rights
A charter formally sets out why the committee exists, what it may decide, who sits on it and how it escalates issues. Project lists, technical standards and service levels are outputs or tools of governance, not the basis of the committee's authority.

Question 115Benefits Realization

A business case for a new logistics platform shows only the purchase and implementation costs. What is the MOST significant gap?

Correct answer: D. It does not include total cost of ownership over the life cycle
Investment decisions should consider full life cycle costs, including operation, support and retirement. Missing these costs makes the investment look cheaper than it is.

Question 116Risk Optimization

At a telecom company, staff often hide risk issues because they fear blame. Which action would BEST improve the risk culture?

Correct answer: B. Leaders openly discuss risks and reward early reporting
Risk culture improves when leaders model open discussion and reward people for raising issues early. Harsher penalties would increase concealment, and more controls do not change behavior.

Question 117Benefits Realization

Which statement BEST describes value management in the context of IT-enabled investments?

Correct answer: C. Making sure investments deliver optimal value at affordable cost and acceptable risk
Value management aims to optimize value from IT-enabled investments while balancing cost and risk. Cost cutting, on-time delivery and uptime are only parts of the picture.

Question 118Governance of Enterprise IT

A financial services firm's board has approved a set of responsible AI principles, including fairness and transparency. What is the BEST way to make these principles effective?

Correct answer: A. Build the principles into review checkpoints across the AI lifecycle
Principles change outcomes only when they are built into how AI systems are designed, approved, deployed and monitored. Publishing or signing the principles shows commitment but does not ensure they are applied to real decisions.

Question 119Governance of Enterprise IT

A cloud-first startup now stores customer records with a provider whose data centers are in several countries. Some customers are subject to laws that restrict where their data may be held. Which of the following should concern the board MOST?

Correct answer: D. The startup may lose control over where regulated data resides
Data residency rules create legal and regulatory exposure that the board is accountable for, so losing control over where regulated data is stored is the greatest concern. Price changes, interface updates and training needs are operational matters.

Question 120IT Resources

A food producer has approved a strategy to automate its plants over five years. HR and IT have separate hiring plans that do not reference the strategy. What is the BEST way to improve this?

Correct answer: A. Develop a workforce plan linked to the IT and business roadmap
A workforce plan tied to the strategic roadmap ensures the right skills are available when the automation program needs them. Freezing hiring, decentralizing decisions or adding fixed budget increases do not link people resources to strategic direction.

Question 121Benefits Realization

A CIO presents 85 different KPIs to the executive committee each quarter, and executives say they cannot tell how IT is performing. What is the BEST action?

Correct answer: C. Select a small set of KPIs that link to key business objectives
A focused set of KPIs aligned to business objectives helps executives understand performance and act. More charts or more frequent reports would increase overload.

Question 122Risk Optimization

Each business unit at a conglomerate reports its own IT risks as low. The board suspects the total exposure is high. What is the BEST approach?

Correct answer: D. Aggregate risks across units to understand the enterprise view
Aggregation shows how related risks across units combine into an enterprise exposure that individual reports may miss. Changing thresholds or replacing staff does not reveal the combined picture.

Question 123Governance of Enterprise IT

Business units at a property management company are signing up for cloud software services on their own credit cards. IT has no record of which services hold company data. What is the BEST response?

Correct answer: D. Set a cloud policy with an approved acquisition process and central visibility
A cloud policy with a clear acquisition path gives the enterprise visibility and control while still letting business units benefit from cloud services. Banning cloud or rejecting expenses ignores real business needs and tends to drive the activity further underground.

Question 124Governance of Enterprise IT

A grocery chain collects purchase data through its loyalty program to offer members discounts. The marketing team now proposes selling detailed purchase histories to food manufacturers as a new revenue stream. What is the GREATEST concern for the board?

Correct answer: B. Members may not have agreed to their data being used this way
Using personal data for a purpose beyond what customers agreed to can breach privacy law and damage trust, so the board must confirm the legal basis and ethics before approving data monetization. Price and platform capacity matter only once the use itself is permitted.

Question 125Benefits Realization

A new data privacy law requires a bank to change how it stores customer records. Since the investment is mandatory, a manager suggests skipping the business case. What is the BEST response?

Correct answer: C. Prepare a business case comparing options to comply cost effectively
Even mandatory investments need a business case to choose the most cost-effective way to comply and manage risk. Skipping justification can lead to overspending, and delaying invites penalties.

Question 126IT Resources

A public broadcaster has moved almost all critical services to one cloud provider. The board asks what governance concern this raises for IT resources. Which answer is BEST?

Correct answer: D. Dependence on a single provider could limit options and resilience
Heavy reliance on one provider creates concentration and lock-in concerns that affect flexibility, negotiation power and resilience. The other answers are generally untrue or overstated and do not reflect the real governance concern.

Question 127Risk Optimization

A CFO at a retail chain wants IT risk results in financial terms to compare with other investments. Which approach is BEST?

Correct answer: C. Quantitative analysis estimating potential financial impact
Quantitative analysis expresses risk in financial terms, which helps compare risk with investment decisions. Qualitative ratings and threat lists do not provide monetary values.

Question 128Governance of Enterprise IT

The board of a mid-sized retailer is considering a cloud-first strategy proposed by the CIO. What is the MOST important factor for the board to consider?

Correct answer: B. Whether the strategy supports business objectives within the risk appetite
The board's role is to ensure that strategic choices support enterprise objectives and stay within its risk appetite. Pricing, staff skills and competitor moves are relevant inputs, but they do not on their own justify the strategy.

Question 129Governance of Enterprise IT

A food distributor's IT steering committee has seven members, and six are from IT. Business units rarely attend. Which of the following is the GREATEST risk?

Correct answer: C. IT priorities may not reflect business needs and strategy
An IT steering committee exists to align IT priorities with business needs, so a committee made up almost entirely of IT staff cannot achieve that alignment. Meeting length and minutes are administrative issues.

Question 130Benefits Realization

A program sponsor is preparing a benefits realization plan for a claims automation program. Which content is MOST essential?

Correct answer: A. Each benefit's measure, target, timing and owner
A benefits realization plan sets out how and when each benefit will be measured, the target and who is accountable. Risk registers, contracts and test strategies are separate program artifacts.

Question 131Risk Optimization

A national railway wants to make IT risk discussions more concrete for executives. Which technique is MOST useful?

Correct answer: B. Developing realistic risk scenarios tied to business impacts
Risk scenarios describe how events could affect business objectives, making risk concrete for decision makers. Vulnerability lists and statistics are too technical or generic for executives.

Question 132Governance of Enterprise IT

After moving its core applications to a public cloud provider, a utility's executives assume the provider is now responsible for all security and compliance. What is the GREATEST concern?

Correct answer: A. The enterprise still remains accountable for protecting its data
Under the shared responsibility model, the enterprise remains accountable for its data and for the controls it configures. Assuming the provider covers everything leaves gaps in protection, which is far more serious than pricing or performance issues.

Question 133Governance of Enterprise IT

A chemical company just completed its first independent IT governance capability assessment. How should leadership BEST use the results?

Correct answer: C. As a baseline for targeted improvement against business priorities
A first assessment establishes a baseline that shows where improvement matters most for enterprise priorities. Using it to punish managers discourages honest assessment, and treating it as proof of completion ignores that governance needs continual improvement.

Question 134Benefits Realization

A retailer wants to explore emerging technologies but fears large failed investments. Which approach BEST balances innovation and value?

Correct answer: D. Fund small, time-boxed experiments with clear criteria to scale or stop
Small, time-boxed experiments with clear decision criteria allow learning at limited cost and support scaling only what works. The other choices either avoid innovation or lack value discipline.

Question 135IT Resources

Within COBIT 2019, which statement BEST describes the governance objective of ensuring resource optimization?

Correct answer: D. The board ensures adequate and effective resources are available to meet enterprise objectives
The governance objective focuses on directing and monitoring so that business and IT resources are adequate, effective and optimized for enterprise goals. The other options describe operational management activities, not governance.

Question 136Benefits Realization

A distributor launched a new order process supported by a new system. Sales staff are still paid commission based on the old process, so they avoid the new one. What is the BEST action?

Correct answer: A. Align sales incentives with the behaviors the new process requires
People follow the incentives they are measured on, so aligning rewards with the new process supports adoption. More training does not fix the conflicting incentive, and forcing or reporting failure does not address the cause.

Question 137Risk Optimization

A board wants to know whether IT controls are working as intended. Which source of information provides the MOST independent assurance?

Correct answer: B. Reports from internal audit
Internal audit is independent of the activities it reviews and provides objective assurance on control effectiveness. Self-assessments and status updates come from those responsible for the controls.

Question 138Governance of Enterprise IT

A food processing company has just merged with a competitor. Each company had its own IT strategy. What should be done FIRST from a governance perspective?

Correct answer: D. Reassess the IT strategy against the combined enterprise's new direction
A merger changes enterprise objectives, so the IT strategy must be reassessed against the new combined direction before major integration decisions. Picking one existing strategy or consolidating systems first risks optimizing for goals that no longer apply.

Question 139Governance of Enterprise IT

At a fashion retailer, marketing teams subscribe to dozens of software services without IT involvement to move faster. Executives value the speed but worry about data and security risk. Which approach BEST balances these concerns?

Correct answer: C. Allow business-led technology within clear governance guardrails
Guardrails such as approved criteria, data rules and registration of services let the business move quickly while risk stays visible and managed. A full ban removes the benefit of speed, and ignoring the issue leaves the risk ungoverned.

Question 140IT Resources

A technology services company has no stated principles for how IT resources should be managed, and each division decides independently. What should the board do FIRST?

Correct answer: B. Set and communicate resource management principles for the enterprise
Setting principles for resource management is a governance responsibility that gives direction to all divisions. Centralizing, cutting staff or funding infrastructure are management choices that should follow from agreed principles.

Question 141Benefits Realization

A board receives a value dashboard showing strong IT benefit results. Internal audit later finds the underlying data comes from unverified spreadsheets. What is the GREATEST concern?

Correct answer: C. The board may make decisions based on unreliable information
Value reporting is only useful if the data behind it is reliable. Unverified data could lead the board to make poor investment decisions.

Question 142Risk Optimization

A new privacy regulation will apply to an e-commerce company next year. What should the company do FIRST?

Correct answer: A. Assess the impact of the regulation on current practices
Assessing the impact shows what must change and guides the response, including resources and priorities. Hiring, buying tools or updating notices before the assessment may miss the real gaps.

Question 143Governance of Enterprise IT

An airline runs seven different database platforms, which raises support costs and skill gaps. What is the BEST governance approach to address this?

Correct answer: B. Define approved technology standards with plans to contain and retire others
Technology standards set through architecture governance, with clear lifecycle states, reduce complexity in a planned and risk-aware way. A rushed migration creates major delivery risk, and outsourcing support leaves the underlying complexity in place.

Question 144Governance of Enterprise IT

Several directors on a bank's board admit they do not understand enough about technology to challenge IT proposals. Which of the following is the BEST response?

Correct answer: A. Build board technology competence through education or expert members
The board must be able to provide informed oversight, so building its competence through education, independent advisors or directors with technology expertise is the right step. Handing decisions entirely to the CIO abandons board oversight, and delaying investments harms the enterprise.

Question 145Benefits Realization

A company delivering a product through agile releases wants to track benefits during delivery, not only at the end. What is the BEST approach?

Correct answer: C. Define measurable outcomes for releases and track them as value is delivered
Agile delivery allows value to be measured incrementally by linking releases to measurable outcomes. Story counts and velocity measure output, not business benefit.

Question 146IT Resources

A software firm's cloud spending doubled in one year, and no business unit feels responsible for the cost. Which approach BEST improves governance of cloud resources?

Correct answer: B. Make cloud costs visible to the business units that consume them
Showing consumption and cost to the business units that drive demand creates accountability and supports better decisions about value. Hard caps and fixed sizing rules can harm the business, and a single approver creates a bottleneck without addressing ownership.

Question 147Risk Optimization

A retailer bought cyber insurance and some executives now believe cyber risk is fully handled. What is the BEST response?

Correct answer: D. Explain that insurance transfers some financial impact but not accountability
Insurance can transfer some financial impact, but the enterprise remains accountable for its risk and reputation. Controls and governance are still needed.

Question 148Governance of Enterprise IT

A pension fund is developing an enterprise information architecture as part of its data governance program. What is the MOST important benefit this architecture should deliver?

Correct answer: A. Consistent, shared data structures that support integration and reuse
An information architecture defines common data models and structures so information can be shared, integrated and reused across the enterprise. Hardware inventories and processing speed belong to technology architecture and operations, not information architecture.

Question 149Governance of Enterprise IT

Which of the following is a COBIT 2019 principle for a governance framework, rather than a principle for a governance system?

Correct answer: B. Aligned to major standards
COBIT 2019 lists three governance framework principles: based on a conceptual model, open and flexible, and aligned to major standards. Holistic approach, stakeholder value and end-to-end coverage are principles for the governance system an enterprise builds.

Question 150Benefits Realization

A food company's IT department reports that a new planning tool reached 99.9% availability. The business sponsor says inventory costs have not changed. What does this BEST illustrate?

Correct answer: D. Measuring outputs does not show whether business outcomes were achieved
Technical outputs such as availability do not prove that business outcomes like lower inventory costs were achieved. Value measurement should focus on outcomes.