Free CGEIT Practice Exam (2026)

Your score by topic

Get a free CGEIT study plan on WhatsApp See related CISA Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Benefits Realization⚑ Flag

A car rental company's business case for a fleet tracking system depends on a 15% cut in fuel costs. Fuel prices are volatile. What would MOST strengthen the business case?

ADocumenting key assumptions and testing how results change if they vary BAdding a longer description of the vendor's tracking technology and roadmap CAsking the vendor to guarantee the fuel savings in the sales proposal DRemoving the fuel savings so that the case looks more conservative overall

Correct answer: A. Documenting key assumptions and testing how results change if they vary
Documenting assumptions and running sensitivity analysis shows decision makers how robust the case is when conditions change. Technology detail, removing benefits or vendor promises do not show how uncertainty affects value.

Question 2Governance of Enterprise IT⚑ Flag

At a shipping company, the CIO sets IT priorities, approves the major IT investments and then runs the projects, with no board review. Which COBIT 2019 principle does this situation MOST clearly violate?

AHolistic approach BDynamic governance system CGovernance distinct from management DTailored to enterprise needs

Correct answer: C. Governance distinct from management
The CIO is both setting direction and executing, so there is no separation between governance and management. A holistic approach concerns how components work together, which is not the central issue here.

Question 3Governance of Enterprise IT⚑ Flag

A chemical company's IT strategic plan consists of a list of projects and their budgets for the coming year. What is the GREATEST weakness of this plan?

AIt does not include detailed schedules for each project BIt was not reviewed by an external consulting firm CIt does not name the vendors selected for each project DIt lacks long-term direction linked to enterprise goals

Correct answer: D. It lacks long-term direction linked to enterprise goals
A strategic plan should set multi-year direction that shows how IT will support enterprise goals. A one-year project list is a tactical plan, so vendor names or detailed schedules would not fix the missing strategic link.

Question 4Risk Optimization⚑ Flag

The board of an e-commerce firm approved a risk appetite statement, but project teams say they never use it. What is the BEST way to make it effective?

AHave the board approve the statement again with stronger wording this time BPost the statement on the company intranet and ask staff to read it every year CAsk internal audit to test whether staff can recite the full statement DTranslate it into limits and criteria that guide everyday decisions

Correct answer: D. Translate it into limits and criteria that guide everyday decisions
Risk appetite is effective when it is cascaded into practical limits and decision criteria that people apply. Publishing, testing recall or rewording does not change how decisions are made.

Question 5IT Resources⚑ Flag

A government department received six bids for a new case management platform. The evaluation panel cannot agree on a winner. What would BEST support an objective selection?

AAsking each panel member to vote for their preferred vendor in secret BWeighted evaluation criteria derived from the business requirements CSelecting the vendor with the most recognized brand name in the government market DChoosing the bid that offers the longest free support period after launch

Correct answer: B. Weighted evaluation criteria derived from the business requirements
Weighted criteria based on business requirements provide a transparent and consistent basis for comparing bids. Brand, free support or private votes may favor factors that do not reflect what the department actually needs.

Question 6Benefits Realization⚑ Flag

A water utility's business case for a new billing system presents only one solution. What is the MOST significant weakness?

AIt does not include a detailed list of the screens in the new billing system BIt does not compare alternatives, including the option of doing nothing CIt does not describe the billing vendor's company history and its other clients DIt does not name every staff member who will work on the project team

Correct answer: B. It does not compare alternatives, including the option of doing nothing
Comparing alternatives, including a do-nothing baseline, shows whether the chosen option offers the best value. Vendor history, screen lists and team names do not help decide between options.

Question 7Governance of Enterprise IT⚑ Flag

An IT scorecard at a logistics provider contains only lagging measures such as annual IT cost and system availability last quarter. What is the BEST improvement?

ABenchmark the existing measures against similar companies BIncrease how often the same lagging measures are reported CRemove cost measures and focus only on availability DAdd leading indicators for areas such as skills and process capability

Correct answer: D. Add leading indicators for areas such as skills and process capability
Leading indicators, such as staff skills and process capability, give early warning of future performance and support a balanced view. Reporting the same lagging measures more often still only describes past results.

Question 8Governance of Enterprise IT⚑ Flag

A national bank operates under strict and frequently changing financial regulations. When tailoring its COBIT 2019 governance system, which design factor should MOST influence the priority given to compliance-related objectives?

ASourcing model for IT BEnterprise size CCompliance requirements DRole of IT

Correct answer: C. Compliance requirements
The compliance requirements design factor reflects the regulatory burden on the enterprise and raises the priority of compliance-related objectives. Enterprise size, role of IT and sourcing model influence other aspects of the design.

Question 9Risk Optimization⚑ Flag

A regional airline is moving from domestic flights into international routes. Its risk appetite was set three years ago. What should the board do?

ALet each new route manager set an appetite for their own international route BReview the risk appetite in light of the new strategy CWait until the first international incident before changing the appetite DKeep the current appetite statement because it was formally approved earlier

Correct answer: B. Review the risk appetite in light of the new strategy
Risk appetite should reflect the enterprise's strategy, so a major strategic change calls for the board to review it. Keeping it unchanged, delegating it or waiting for incidents leaves decisions without proper direction.

Question 10Benefits Realization⚑ Flag

A retailer changed its strategy from store expansion to online growth. Its IT portfolio was approved a year ago under the old strategy. What should the investment committee do?

AContinue the approved portfolio unchanged until next year's budget cycle ends BCancel every investment approved under the old strategy without any review CReassess the portfolio and rebalance it against the new strategy DAsk each project manager to decide whether their own project still fits

Correct answer: C. Reassess the portfolio and rebalance it against the new strategy
When strategy changes, the portfolio should be reassessed so investments match the new direction. Waiting a year wastes resources, blanket cancellation ignores value, and project managers lack the enterprise view.

Question 11IT Resources⚑ Flag

A cable company promises customers 99.9% availability in its SLA. The internal network team and two suppliers that support the service have no agreed targets. What is the GREATEST concern?

AThe customer SLA may not be achievable because supporting agreements do not back it BThe network team may feel that the customer SLA target is set unreasonably high CThe customer may not understand how availability is calculated each month DThe suppliers may ask for more detailed monthly reports than they receive today

Correct answer: A. The customer SLA may not be achievable because supporting agreements do not back it
Customer SLAs must be supported by internal operational agreements and underpinning contracts, or the enterprise cannot reliably meet them. The other concerns are minor compared with committing to a target nobody is obliged to support.

Question 12Governance of Enterprise IT⚑ Flag

During a goals cascade review, a software company finds that one IT goal does not trace to any enterprise goal. The goal currently consumes significant budget. What is the BEST action?

AAsk the IT team to report on the goal more frequently BReassess whether the goal should continue to receive resources CCreate a new enterprise goal that matches the IT goal so the link is restored DKeep funding the goal because work is already underway

Correct answer: B. Reassess whether the goal should continue to receive resources
An IT goal with no link to enterprise goals may consume resources without delivering value, so it should be reassessed. Inventing an enterprise goal to fit it reverses the cascade, which should flow from the enterprise downward.

Question 13Governance of Enterprise IT⚑ Flag

A software company has moved most development to agile and DevOps teams that release changes several times a day. Its governance processes still assume long, phase-gated projects. Which COBIT 2019 design factor is MOST relevant to redesigning governance?

AIT implementation methods BEnterprise goals CTechnology adoption strategy DThreat landscape

Correct answer: A. IT implementation methods
The IT implementation methods design factor covers whether an enterprise uses agile, DevOps or traditional approaches, and it directly affects how governance should be designed. Threat landscape and enterprise goals matter, but they do not address the mismatch between delivery method and governance.

Question 14Risk Optimization⚑ Flag

At a chemicals company, the operations director owns the risk of production system outages, and the IT manager runs the backup controls. Which statement BEST describes their roles?

AThe IT manager owns the risk because the backup controls are technical BThe risk is owned by the backup vendor that supplies the recovery software CThe director owns the risk and the IT manager owns the related controls DBoth share ownership of the risk and of the controls equally between them

Correct answer: C. The director owns the risk and the IT manager owns the related controls
The risk owner is accountable for the business impact and for deciding on responses, while the control owner operates specific controls. Mixing these roles or assigning ownership to a vendor blurs accountability.

Question 15Benefits Realization⚑ Flag

At a hospital network, business units send IT requests by email, phone and hallway conversations. Leaders cannot see total demand. What is the BEST first step?

ALet each IT team keep its own list of requests from the units it supports BTell business units that they must stop sending any new IT requests this year CHire more developers so that every request can be completed more quickly DCreate a single intake process for all proposed IT-enabled investments

Correct answer: D. Create a single intake process for all proposed IT-enabled investments
A single intake process gives visibility of total demand so requests can be assessed and prioritized consistently. Stopping requests, adding staff or keeping separate lists does not create that visibility.

Question 16IT Resources⚑ Flag

A holding company wants to merge the separate IT departments of its five subsidiaries into one shared service. What is the MOST important consideration for the board?

AWhether the combined department can be moved into the existing head office building BWhether the subsidiaries' IT managers agree to report to a single new leader CWhether the subsidiaries currently use the same email platform and devices DWhether the shared service can still meet each subsidiary's business needs

Correct answer: D. Whether the shared service can still meet each subsidiary's business needs
A shared service only creates value if it can meet the needs of the businesses it serves while gaining efficiencies. Office space, reporting preferences and current tools are implementation details.

Question 17Benefits Realization⚑ Flag

Under Val IT style value management, which statement BEST describes how different types of investment should be handled?

ADifferent categories of investment should be evaluated and managed differently BOnly investments above a fixed size should be evaluated in any formal way CAll investments should be evaluated with exactly the same single financial measure DInvestments should be evaluated by IT, with the business informed afterward

Correct answer: A. Different categories of investment should be evaluated and managed differently
Investments such as mandatory, sustaining and innovative ones carry different risk and value profiles, so they need appropriate criteria and oversight. A single measure or IT-only evaluation would distort decisions.

Question 18Governance of Enterprise IT⚑ Flag

An employee survey at a construction firm shows that most IT staff cannot describe the enterprise's IT strategy or how their work supports it. What is the BEST action?

ARewrite the IT strategy in more technical language BCommunicate the strategy and link it to team and individual objectives CPost the strategy document on the internal IT wiki DReplace IT managers whose teams scored lowest in the survey

Correct answer: B. Communicate the strategy and link it to team and individual objectives
Staff support a strategy when they understand it and see how their own objectives contribute to it. Simply posting the document does little to build understanding, and replacing managers does not fix a communication gap.

Question 19Governance of Enterprise IT⚑ Flag

A hotel chain has a well-designed IT governance framework, but nobody can say which committee approves cloud contracts or who chairs the architecture review. Which governance component is MOST deficient?

APeople, skills and competencies BServices, infrastructure and applications CInformation DOrganizational structures

Correct answer: D. Organizational structures
Organizational structures define the decision-making bodies, their membership and their authority, and this is exactly what is unclear. Skills and information are important, but they do not address missing committee roles and mandates.

Question 20Risk Optimization⚑ Flag

Which statement BEST describes inherent risk?

AThe level of risk that remains after management has applied its controls BThe level of risk that the board has formally agreed to accept CThe level of risk before any controls or responses are considered DThe level of risk that is shared with insurers and other third parties

Correct answer: C. The level of risk before any controls or responses are considered
Inherent risk is the exposure that exists before controls or other responses are applied. The risk remaining after controls is residual risk.

Question 21Benefits Realization⚑ Flag

A university runs a student experience program made up of eight related projects. Two projects keep blocking each other. Whose responsibility is it MAINLY to resolve this?

AThe program manager, who manages interdependencies across projects BThe individual project teams, who should negotiate directly with each other CThe vendor that supplies the main platform used by most of the projects DThe university's board, which should decide on each project conflict

Correct answer: A. The program manager, who manages interdependencies across projects
A key role of program management is coordinating dependencies among component projects so the program delivers its benefits. Leaving it to teams, escalating every conflict to the board or relying on a vendor is inappropriate.

Question 22Governance of Enterprise IT⚑ Flag

Which of the following BEST describes architecture principles in enterprise architecture?

ADetailed technical specifications for individual system builds BLists of vendors approved to supply technology products CEnduring general rules that guide IT decisions across the enterprise DDiagrams that show how the enterprise's applications exchange data with each other

Correct answer: C. Enduring general rules that guide IT decisions across the enterprise
Architecture principles are lasting, general rules, often with a rationale and implications, that guide decision making across the enterprise. Technical specifications, vendor lists and interface diagrams are more detailed artifacts that should follow from the principles.

Question 23Governance of Enterprise IT⚑ Flag

A health insurer adopted a new strategy to sell directly to consumers online. Its IT governance system was designed three years earlier for a broker-only model and has not been revisited. Which COBIT 2019 principle is MOST at risk?

ADynamic governance system BEnd-to-end governance system CGovernance distinct from management DBased on a conceptual model

Correct answer: A. Dynamic governance system
The dynamic governance principle says that when design factors such as strategy change, the governance system should be reconsidered and adjusted. End-to-end coverage and separation from management are not the main problem in this scenario.

Question 24Risk Optimization⚑ Flag

A toy maker is considering selling directly to children through a new app. The legal team finds the privacy risks very high and controls would be costly. Which response is MOST appropriate if the risk far exceeds appetite?

AAccept the risk and launch the app quickly to capture market share early BAvoid the risk by not proceeding with the app as currently designed CTransfer the full risk to the app development vendor through the contract DReduce the risk slightly with basic controls and launch on the planned date

Correct answer: B. Avoid the risk by not proceeding with the app as currently designed
When risk greatly exceeds appetite and mitigation is not cost-effective, avoiding the activity is appropriate. Accepting it, partly reducing it or shifting it to a vendor would leave the enterprise exposed.

Question 25IT Resources⚑ Flag

At a decentralized manufacturing group, plant managers, regional IT leads and corporate IT all sign sourcing deals, and nobody knows who may approve what. What should be done FIRST?

ADefine and communicate decision rights for IT sourcing decisions BAsk corporate procurement to cancel all sourcing deals signed by the plants this year CRequire every sourcing deal to be approved personally by the group CEO DLet each region keep its own approach and report total spending once a year

Correct answer: A. Define and communicate decision rights for IT sourcing decisions
Clear decision rights state who may make which sourcing decisions, which is a basic governance mechanism. Cancelling deals is disruptive, CEO approval of everything creates a bottleneck, and annual totals do not fix unclear authority.

Question 26Benefits Realization⚑ Flag

A police department plans a mobile reporting app that will save officer time but will also require extra data entry by supervisors. How should the business case treat the extra supervisor workload?

ALeave it out, since it is a small side effect of an otherwise positive project BAsk supervisors to absorb the work without adding it to any documents CRecord it as a dis-benefit and include it in the value assessment DTransfer the workload to the IT department so it is not counted as a cost

Correct answer: C. Record it as a dis-benefit and include it in the value assessment
Dis-benefits are negative outcomes that should be identified and included so the true net value is understood. Leaving them out or shifting them elsewhere gives a misleading picture.

Question 27Governance of Enterprise IT⚑ Flag

The executive committee of an insurance group questions the cost of its enterprise architecture function. What is MOST important for the function to demonstrate?

AThe percentage of projects that attended an architecture review meeting this year BIts contribution to business outcomes such as faster delivery of change CThe number of architecture documents produced each year DThe certifications held by members of the architecture team

Correct answer: B. Its contribution to business outcomes such as faster delivery of change
Executives fund functions that show measurable contribution to business outcomes. Document counts, certifications and meeting attendance are activity measures that do not show value to the enterprise.

Question 28Governance of Enterprise IT⚑ Flag

A family-owned bakery business with 40 staff wants to improve IT governance. A consultant proposes implementing every COBIT objective with full documentation. What should the owners do?

ACopy the governance manual of a large bank BAdopt the full proposal to ensure nothing is missed CSkip formal governance until the company grows much larger DTailor a smaller set of priorities to the company's needs

Correct answer: D. Tailor a smaller set of priorities to the company's needs
COBIT is meant to be tailored, and small enterprises should focus on the objectives that matter most to them. Implementing everything would waste scarce resources, and skipping governance leaves real risks unmanaged.

Question 29Risk Optimization⚑ Flag

A food delivery company completed its annual IT risk assessment in January. In March, it acquired a competitor with very different systems. What should happen?

AReassess risk now, because a major change has altered the risk profile BAsk the acquired company to keep its own risk process separate indefinitely CWait until next January to include the acquired systems in the assessment DAssume the acquired company's risks are the same as the existing company's

Correct answer: A. Reassess risk now, because a major change has altered the risk profile
Significant changes such as an acquisition should trigger reassessment so the risk profile stays current. Waiting, assuming similarity or keeping processes separate leaves risks unmanaged.

Question 30Benefits Realization⚑ Flag

A CIO set targets for a new e-commerce site's KPIs without consulting the business. Sales leaders say the targets do not matter to them. What is the BEST correction?

AKeep the targets as they are, since IT understands the site better than sales BAgree on KPI targets jointly with the business owners of the outcomes CRemove the targets and track the KPIs without any specific goals at all DAsk an external consultant to set new targets based on industry averages

Correct answer: B. Agree on KPI targets jointly with the business owners of the outcomes
Targets should be agreed with the business owners accountable for the outcomes so they reflect business priorities. IT-only targets, no targets or generic averages fail to secure business ownership.

Question 31IT Resources⚑ Flag

A university's IT training budget was cut by half. Many staff want courses in different technologies. How should the remaining budget BEST be allocated?

AFocus on skills most critical to the university's strategic initiatives BGive priority to staff with the longest service as a reward for their loyalty CFund the courses requested first, until the remaining budget is fully used DDivide the budget evenly so every staff member receives at least one course

Correct answer: A. Focus on skills most critical to the university's strategic initiatives
Limited training funds should go to the skills that matter most for strategic priorities, which supports resource optimization. Equal shares, first-come funding or seniority do not link spending to enterprise needs.

Question 32Governance of Enterprise IT⚑ Flag

A project at a credit union cannot meet an architecture standard without missing a regulatory deadline. The project manager asks for a deviation. What is the BEST response?

AReject the request because standards must always be followed BLet the project manager decide because the deadline is regulatory CChange the standard permanently so that this project and similar ones are compliant DGrant a time-bound waiver with documented risk and a remediation plan

Correct answer: D. Grant a time-bound waiver with documented risk and a remediation plan
A formal, time-bound waiver lets the enterprise meet the deadline while recording the risk and committing to return to the standard. Rejecting the request ignores a legitimate business constraint, and permanently changing the standard for one project weakens architecture governance.

Question 33Governance of Enterprise IT⚑ Flag

Which of the following BEST describes the role of the CIO within an effective governance of enterprise IT arrangement?

ALeading IT management and advising executives on technology value and risk BSetting the enterprise risk appetite and approving it without board involvement CApproving the overall enterprise business strategy each year for the board DHolding final accountability for governance of enterprise IT on behalf of shareholders

Correct answer: A. Leading IT management and advising executives on technology value and risk
The CIO leads IT management, executes the direction set by the board and advises executives on how technology can create value and where risks lie. Final accountability for governance stays with the board, which also sets risk appetite and approves enterprise strategy.

Question 34Benefits Realization⚑ Flag

An investment committee ranks IT proposals mainly by how quickly each one recovers its initial cost. Which statement BEST describes a key weakness of relying on this payback period?

AIt cannot be calculated for investments that are funded internally BIt gives too much weight to benefits expected late in the life cycle CIt ignores benefits that arrive after the cost has been recovered DIt requires detailed forecasts of costs for every year of the project

Correct answer: C. It ignores benefits that arrive after the cost has been recovered
Payback period shows only how fast the initial cost is recovered, so it ignores later benefits and usually the time value of money. Strategic investments with large long-term value can therefore rank below quick, low-value ones.

Question 35Risk Optimization⚑ Flag

A KRI that tracks unpatched critical systems at a hospital has crossed its red threshold for two months. What should happen?

AEscalate per the agreed process and ensure action is taken BKeep monitoring the indicator for another quarter before taking any action CRaise the threshold so that the indicator returns to green in the next report DRemove the indicator from the board dashboard until the number improves

Correct answer: A. Escalate per the agreed process and ensure action is taken
A threshold breach should trigger the agreed escalation and response so exposure is brought back within tolerance. Changing thresholds or hiding the indicator conceals the problem.

Question 36Benefits Realization⚑ Flag

A CEO asks whether her company's IT cost and service levels are competitive. Which approach would BEST answer this?

AComparing this year's IT budget only with last year's internal IT budget BAsking IT managers to give their own opinion about how competitive they are CSurveying the vendors that supply services to the IT department each year DBenchmarking IT performance against comparable organizations

Correct answer: D. Benchmarking IT performance against comparable organizations
Benchmarking against comparable organizations gives an external reference point on cost and performance. Internal opinions, year-over-year comparisons or vendor surveys do not show competitiveness.

Question 37IT Resources⚑ Flag

A conglomerate runs four different HR systems and three finance systems across its divisions. Which governance mechanism would BEST reduce this duplication over time?

AA one-time cost-cutting exercise that removes the most expensive system in each area BAn enterprise architecture that sets standards and promotes reuse CA rule that each division must fund its own systems from its own budget DAn annual survey that asks users which system they would like to keep

Correct answer: B. An enterprise architecture that sets standards and promotes reuse
Enterprise architecture provides target standards and reuse principles that guide investment decisions and reduce duplication. A one-time cut, divisional funding rules or user surveys do not create lasting direction.

Question 38Governance of Enterprise IT⚑ Flag

A transportation authority is starting its first enterprise architecture program. Which architecture domain should normally be defined FIRST?

AApplication architecture covering the systems in use today BSecurity architecture covering controls and access models CBusiness architecture covering capabilities, processes and goals DTechnology architecture covering servers, networks and platforms

Correct answer: C. Business architecture covering capabilities, processes and goals
Business architecture defines what the enterprise does and needs, which then drives the data, application and technology architectures. Starting with technology risks designing solutions that do not reflect business priorities.

Question 39Governance of Enterprise IT⚑ Flag

At a clinical research organization, nobody will decide who may access trial data. IT says the business owns the data, and the business says IT runs the systems. Who should be accountable for data access decisions?

AThe database administrator who maintains the systems BThe business data owner for the trial data CThe IT security analyst who reviews access logs DThe external auditor who tests access controls

Correct answer: B. The business data owner for the trial data
The business data owner is accountable for decisions about who may access data, because the owner understands its value and use. IT staff are custodians who carry out those decisions, and auditors provide independent assurance.

Question 40Risk Optimization⚑ Flag

A bank is starting to record IT-related loss events, including near misses. What is the PRIMARY benefit of this practice?

AIt allows the bank to report fewer incidents to its regulators each year BIt allows the bank to recover the losses from its technology vendors directly CIt removes the need to perform risk assessments for systems with no losses DIt provides data to improve risk analysis and calibrate assessments

Correct answer: D. It provides data to improve risk analysis and calibrate assessments
Loss event data, including near misses, provides evidence to improve risk analysis and test assumptions in assessments. It does not replace assessments or allow reduced regulatory reporting.

Question 41Benefits Realization⚑ Flag

A government agency wants a post-implementation review of a major tax system. The program manager offers to lead it. What is the GREATEST concern?

AThe program manager may not know which benefits were in the business case BThe review may lack objectivity if led by the people who ran the program CThe program manager may not have enough time because of other new projects DThe review may take longer to complete than the agency originally expected

Correct answer: B. The review may lack objectivity if led by the people who ran the program
Reviews led by those responsible for delivery may lack independence and understate problems. Time and duration are practical concerns, and the program manager likely knows the business case well.

Question 42Governance of Enterprise IT⚑ Flag

A diversified holding company has created a business capability map. How can this map BEST support IT governance?

ABy documenting the network design for each office location BBy replacing the need for detailed project business cases CBy showing where IT investment supports strategic capabilities DBy listing the software licenses each business unit holds

Correct answer: C. By showing where IT investment supports strategic capabilities
A capability map lets governance bodies see which capabilities are strategic and where investments overlap or leave gaps. It informs business cases but does not replace them, and license lists or network designs are operational detail.

Question 43Governance of Enterprise IT⚑ Flag

A draft RACI for a manufacturer marks the board as accountable for patching servers, approving user access and closing help desk tickets. What is the GREATEST concern with this draft?

AThe board would be drawn into operational management BThe chart does not include external vendors CHelp desk staff may disagree with the assignments in the chart DThe chart has too few roles listed as informed

Correct answer: A. The board would be drawn into operational management
The board should be accountable for direction and oversight, not routine operational tasks, which belong to management. Missing informed roles or vendors are minor issues compared with confusing governance and management.

Question 44Risk Optimization⚑ Flag

At an insurance company, the head of enterprise risk reports to the head of sales, whose targets depend on taking on more risk. What is the GREATEST concern?

ASales staff may not understand the risk terms used in the monthly reports BThe risk team may not have enough budget to buy a new risk tool this year CThe head of risk may spend too much time attending sales meetings DThe risk function may lack the independence to challenge risk taking

Correct answer: D. The risk function may lack the independence to challenge risk taking
A second-line risk function needs independence to challenge the business, and reporting to someone whose targets reward risk taking undermines that. Budget, terminology and meeting time are minor concerns.

Question 45Benefits Realization⚑ Flag

Post-implementation reviews at a manufacturer often find that benefits were overestimated. What is the BEST way to use this finding?

AFeed lessons learned into how future business cases are prepared BReduce the benefits of all future business cases by a fixed percentage CFile the review reports with the project records for future audit purposes DStop holding post-implementation reviews because the findings never change

Correct answer: A. Feed lessons learned into how future business cases are prepared
Feeding lessons into future business case practice improves estimate quality over time. Filing reports does nothing, fixed reductions are arbitrary, and stopping reviews removes learning.

Question 46IT Resources⚑ Flag

An insurer has over 300 IT suppliers and treats them all the same way. The new vendor management office wants to focus its effort. What should it do FIRST?

ASchedule quarterly review meetings with all 300 suppliers starting next month BAsk every supplier to sign a new contract using the insurer's standard template CClassify suppliers by their criticality and value to the business DReduce the number of suppliers to fewer than fifty within the next year

Correct answer: C. Classify suppliers by their criticality and value to the business
Classifying suppliers by criticality and value lets the insurer apply more oversight where the business depends on it most. Uniform contracts, arbitrary cuts or meetings with every supplier spread effort without regard to importance.

Question 47Governance of Enterprise IT⚑ Flag

A hotel chain published a new acceptable use policy for IT resources. Three months later, a spot check shows most staff are unaware of its key requirements. What is the BEST action?

AAsk managers to email the policy to their teams again with a reminder note BShorten the policy so that it fits on a single page CDiscipline employees who broke the policy during the spot check DRun an awareness program and require staff to acknowledge the policy

Correct answer: D. Run an awareness program and require staff to acknowledge the policy
An awareness program with formal acknowledgment builds understanding and creates accountability for following the policy. Disciplining staff who were never properly informed is unfair, and resending the document is unlikely to change awareness.

Question 48Governance of Enterprise IT⚑ Flag

A multinational retailer operates in 22 countries with different and sometimes conflicting privacy laws. Which approach to compliance governance is BEST?

ALet each country team handle privacy on its own with no central oversight BApply only the home country's laws to all operations CFollow the least strict law to keep costs as low as possible DUse an enterprise framework that maps requirements with local variations

Correct answer: D. Use an enterprise framework that maps requirements with local variations
An enterprise framework that maps all applicable requirements, with defined local variations, gives consistent oversight while respecting each jurisdiction. Applying only home country law or the weakest standard creates legal exposure, and no central oversight leaves the board blind.

Question 49Benefits Realization⚑ Flag

A health insurer is rolling out a new claims workflow to 2,000 staff across many offices. Which approach would BEST support adoption at the local level?

AAllowing each office to decide whether it wants to use the new workflow BA network of trained change champions within each office CAsking the vendor to answer all user questions through its support portal DSending one company-wide email that explains the change and the go-live date

Correct answer: B. A network of trained change champions within each office
Change champions provide local support, feedback and credibility, which helps people adopt new ways of working. A single email, vendor support or optional use does not drive adoption across many sites.

Question 50Risk Optimization⚑ Flag

Under the three lines model, which group forms the FIRST line in managing IT risk?

AThe internal audit department that tests controls each year BThe enterprise risk function that sets the risk framework CBusiness and IT management who own and manage risks day to day DExternal regulators who review the enterprise's practices

Correct answer: C. Business and IT management who own and manage risks day to day
The first line consists of management who own and manage risk in daily operations. The risk function is the second line, internal audit is the third, and regulators are external.

Question 51IT Resources⚑ Flag

A manufacturer must decide whether to renew its own data center or move to cloud hosting. Which approach is BEST for the decision?

AFollow the hosting choice that the company's main competitor made last year BChoose cloud because it is the modern approach recommended by most analysts CKeep the data center because the staff already know how to operate it well DCompare total cost of ownership and fit with business requirements

Correct answer: D. Compare total cost of ownership and fit with business requirements
A sound sourcing decision weighs the full cost over time against how well each option meets business needs, including risk and flexibility. Copying competitors or following trends or habits ignores the enterprise's specific situation.

Question 52Benefits Realization⚑ Flag

A city is introducing a new resident services platform that affects call center staff, field workers and residents. What is MOST important in the change communication plan?

ASending detailed technical specifications to every affected employee BUsing the same message and channel for every group to keep things simple CTailoring messages to the concerns and needs of each stakeholder group DCommunicating only after go-live so that people are not confused early

Correct answer: C. Tailoring messages to the concerns and needs of each stakeholder group
Each stakeholder group has different concerns, so communication should be tailored to what matters to them. Uniform messages, late communication or technical detail reduce understanding and support.

Question 53Governance of Enterprise IT⚑ Flag

A professional services firm's IT policies are very detailed and name specific products and settings. As a result, the policies need board-level reapproval several times a year. What is the BEST improvement?

AStop naming products in policies and leave technology choices to each team BKeep policies high level and move technical details into standards CReduce the number of board meetings that review IT policies DLet the IT department change policies without any approval

Correct answer: B. Keep policies high level and move technical details into standards
Policies should state stable management intent, while standards and procedures hold details that change often. This keeps approval at the right level without frequent board involvement. Dropping approval or leaving choices to each team removes needed control.

Question 54Governance of Enterprise IT⚑ Flag

At an investment firm, regulatory requirements are reviewed only after IT projects are built, which often causes costly rework. Which of the following would BEST address this?

AReduce the number of IT projects started each year BHire more compliance testers to check each system after it is finished and deployed CConsider regulatory requirements during strategy and investment decisions DAsk regulators to approve each project before go-live

Correct answer: C. Consider regulatory requirements during strategy and investment decisions
Building regulatory requirements into strategy and investment decisions prevents compliance gaps before money is spent. More testers would still find issues late, and asking regulators to approve projects is not their role.

Question 55Risk Optimization⚑ Flag

A power utility is connecting plant control systems to its corporate network to collect real-time data. What is the MOST important governance concern?

AConnecting operational technology may expose safety-critical systems to cyber threats BThe corporate network may need more bandwidth during peak reporting periods CPlant engineers may need training on the new data dashboards and their use DThe data collected may be more detailed than managers can review each day

Correct answer: A. Connecting operational technology may expose safety-critical systems to cyber threats
Linking operational technology to corporate networks can expose safety-critical systems to cyber attacks, with serious safety and service consequences. Data volume, training and bandwidth are lesser operational issues.

Question 56Benefits Realization⚑ Flag

A business case for a new inventory system includes software, hardware and vendor fees only. Store staff will need training time and processes will be redesigned. What is the MOST significant concern?

AThe case may not list all of the hardware models the vendor plans to supply BBusiness-side costs are missing, so the true investment is understated CThe case does not describe the reporting features of the inventory system DThe case may not include the vendor's preferred project management method

Correct answer: B. Business-side costs are missing, so the true investment is understated
IT-enabled investments include business costs such as training and process redesign, and leaving them out understates the investment. The other gaps are minor detail.

Question 57Governance of Enterprise IT⚑ Flag

A public broadcaster plans to introduce a formal IT governance framework. Earlier change programs failed because of internal resistance. What should be done FIRST?

AAssess the organizational culture and its readiness for change BRoll out the full framework across the organization at once to build momentum CTrain all IT staff on the framework's processes DSelect a governance software tool to support the framework

Correct answer: A. Assess the organizational culture and its readiness for change
Understanding culture and readiness lets leaders design an approach that addresses the causes of past resistance. Tools, training or a big-bang rollout before that assessment risk repeating earlier failures.

Question 58Governance of Enterprise IT⚑ Flag

A telecom company plans to let employees read work email and client files on their personal phones. Security wants strict controls, while staff object to the company managing their own devices. What should executive management do FIRST?

ABan personal devices so that only company phones can access email BLet each department decide its own rules for personal phones CApprove a personal device policy that balances protection and privacy DBuy mobile management software and install it on all staff phones

Correct answer: C. Approve a personal device policy that balances protection and privacy
Management should first set the rules for using personal devices with company data, balancing data protection against employee privacy and usability. Buying tools or banning devices before the policy is agreed skips the decision about acceptable risk.

Question 59IT Resources⚑ Flag

A bank is replacing thousands of laptops and servers. The IT team plans to sell old equipment to a local reseller. What is the MOST important governance requirement?

ARecording the serial numbers of the new devices before the old ones are sold BMaking sure the reseller collects all of the equipment within one week CObtaining the highest possible resale price for the equipment being retired DA disposal policy that ensures data is removed and legal duties are met

Correct answer: D. A disposal policy that ensures data is removed and legal duties are met
Asset retirement must be governed so that sensitive data is destroyed and legal and environmental obligations are met. Resale value, serial tracking and pickup speed are secondary to these risks.

Question 60Benefits Realization⚑ Flag

A logistics company's strategy commits it to cutting carbon emissions by 30%. Its IT investment process scores proposals only on cost and revenue. What is the BEST improvement?

AApprove only investments that reduce emissions, whatever their other value BAsk each project to publish its emissions after it goes live, if it wishes CLeave the scoring as it is, since emissions are a facilities matter and not IT DAdd environmental impact as a criterion aligned with the strategy

Correct answer: D. Add environmental impact as a criterion aligned with the strategy
Investment criteria should reflect enterprise strategy, so environmental impact belongs in the evaluation alongside cost and revenue. Ignoring it breaks alignment, and making it the only criterion or an optional afterthought is unbalanced.

Question 61Risk Optimization⚑ Flag

A media company runs all streaming services on one cloud provider. The board asks what would happen if the provider failed or the relationship ended. What is MOST important to have in place?

AA tested exit and contingency plan for critical services BA team of staff certified in every service that the provider offers CA larger discount negotiated with the current provider for the next three years DA clause that lets the company review the provider's marketing plans

Correct answer: A. A tested exit and contingency plan for critical services
A tested exit and contingency plan ensures critical services can continue if the provider fails or the relationship ends. Discounts, marketing reviews and certifications do not address continuity.

Question 62Governance of Enterprise IT⚑ Flag

An IT director at a municipal government is offered an expensive trip by a vendor bidding on a major contract. What is the MOST appropriate action?

ADecline privately and say nothing so the bid is not affected BDisclose the offer under the conflict-of-interest policy and decline it CAccept the trip as long as the director will not vote on the contract award DAccept the trip and share any useful information with the team

Correct answer: B. Disclose the offer under the conflict-of-interest policy and decline it
Disclosing the offer and declining it protects the integrity of the procurement and follows ethical expectations. Accepting the gift, even without voting, creates an appearance of bias, and staying silent hides possible vendor misconduct from the organization.

Question 63Governance of Enterprise IT⚑ Flag

At an agricultural cooperative, the IT department decides alone which systems to fund. Business leaders complain that IT spending does not match their priorities. What is the BEST way to change this?

AOutsource the investment decisions to an external consultant BLet IT continue deciding but publish its choices each year CGive each business leader a separate IT budget to spend however they choose DHave business leaders share investment decisions in a governance forum

Correct answer: D. Have business leaders share investment decisions in a governance forum
Investment decisions should involve business leadership through a governance forum so that spending reflects enterprise priorities. Publishing IT-only decisions keeps the same problem, and separate budgets fragment spending and lose the enterprise view.

Question 64Benefits Realization⚑ Flag

Three business units will share a new analytics platform. They disagree about who should pay and how benefits will be counted. What should be agreed BEFORE approval?

AWhich unit's logo will appear first on the platform's main dashboard screen BWhether the platform will be hosted in the cloud or on company servers CHow costs and benefits will be allocated among the participating units DWhich unit's IT staff will have administrator rights to the analytics platform

Correct answer: C. How costs and benefits will be allocated among the participating units
Shared investments need clear agreement on cost and benefit allocation so accountability and funding are not disputed later. Logos, admin rights and hosting are secondary details.

Question 65Risk Optimization⚑ Flag

A software vendor discovered that a widely used open source library in its product contained malicious code. The board asks how to govern this type of risk. Which approach is BEST?

ARely on customers to report problems with third-party components they find BOversee a software supply chain risk program covering third-party components CAsk developers to read the source code of every library before they use it DBan the use of all open source software in every product immediately

Correct answer: B. Oversee a software supply chain risk program covering third-party components
A software supply chain risk program gives structured oversight of third-party and open source components. Total bans are impractical, manual review does not scale, and relying on customers is reactive.

Question 66IT Resources⚑ Flag

At a telecom provider, the same engineers support live services and deliver projects. Incidents keep pulling them off projects, and every project is late. What is the BEST governance response?

AHire contractors for each project without reviewing the current workload BAsk the engineers to work extra hours until all projects are back on schedule CDefine how capacity is allocated between operations and change work DStop all project work until there are no open incidents in the environment

Correct answer: C. Define how capacity is allocated between operations and change work
Agreeing how capacity is split between running services and delivering change makes trade-offs explicit and supports realistic planning. Overtime, project freezes or unplanned contractors do not address the underlying allocation problem.

Question 67Benefits Realization⚑ Flag

An airline approved a lounge app instead of a baggage tracking upgrade with higher expected value. Which concept BEST describes the value the airline gave up?

AOpportunity cost BFixed cost CVariable cost DSunk cost

Correct answer: A. Opportunity cost
Opportunity cost is the value lost from the best alternative not chosen. Sunk, fixed and variable costs describe other aspects of spending.

Question 68Governance of Enterprise IT⚑ Flag

At a manufacturing company, staff who report IT errors are often blamed and disciplined. Management suspects many incidents now go unreported. What is the BEST way to address this?

AInstall monitoring software to detect incidents automatically BPromote a culture that encourages open reporting without blame CRequire managers to sign off on every incident report DIncrease penalties for staff who fail to report incidents

Correct answer: B. Promote a culture that encourages open reporting without blame
A just culture encourages people to report problems so the organization can learn and reduce risk. Harsher penalties deepen the fear that causes underreporting, and monitoring tools do not change the underlying behavior.

Question 69Governance of Enterprise IT⚑ Flag

A publishing group appointed a chief digital officer while keeping its CIO. Both now claim authority over customer platforms and data analytics, and teams receive conflicting direction. What should executive leadership do FIRST?

AClarify the responsibilities and decision rights of each role BAsk the IT steering committee to vote on each conflict CMerge both roles into a single new position right away DLet the two executives compete for a year to see who performs better

Correct answer: A. Clarify the responsibilities and decision rights of each role
Clarifying each role's responsibilities and decision rights removes the overlap and gives teams consistent direction. Merging roles may be a later option, but it is premature, and voting on each conflict does not fix the underlying ambiguity.

Question 70Risk Optimization⚑ Flag

At a retail chain, the CISO reports to the head of IT infrastructure, who often overrules security concerns to meet deadlines. What is the BEST governance improvement?

AGive the head of infrastructure a security certification to improve awareness BAsk the CISO to escalate concerns by email to the head of infrastructure CChange the CISO's reporting line to provide independence and visibility DRequire the CISO to approve all infrastructure changes personally

Correct answer: C. Change the CISO's reporting line to provide independence and visibility
An independent reporting line, such as to the CEO, risk committee or board, allows security concerns to reach decision makers without conflict. Email escalation to the same person, certifications or approving every change do not fix the conflict.

Question 71Benefits Realization⚑ Flag

Which statement BEST describes net present value when used to evaluate an IT investment?

AThe time it takes for cumulative benefits to equal the initial investment BThe value of future cash flows discounted to today, minus the investment CThe percentage of the budget spent on hardware compared with software DThe total cost of ownership measured over the full life of the investment

Correct answer: B. The value of future cash flows discounted to today, minus the investment
Net present value discounts expected future cash flows to today and subtracts the investment, accounting for the time value of money. Payback period is the time to recover the investment.

Question 72IT Resources⚑ Flag

A European retailer plans to move its customer support systems to a provider located in another country. What is the GREATEST concern from a governance view?

AThe provider's staff may work in a time zone that is several hours away BThe provider may use a different ticketing tool than the retailer does now CTravel costs may increase when managers visit the provider's offices DLaws on where customer data may be stored and processed

Correct answer: D. Laws on where customer data may be stored and processed
Legal and regulatory requirements on data location and transfer can create serious compliance exposure when services move abroad. Time zones, tools and travel costs are manageable operational issues.

Question 73Governance of Enterprise IT⚑ Flag

Business unit leaders at a fashion retailer complain that IT decisions are made without their input and do not reflect their needs. What is the BEST way to improve engagement?

ASet up regular forums and relationship roles linking business and IT BSend business leaders a detailed monthly newsletter about current IT projects CLet each business unit build its own internal IT team DAsk the CIO to approve all IT decisions personally

Correct answer: A. Set up regular forums and relationship roles linking business and IT
Regular two-way forums and business relationship roles give business leaders a real voice in IT decisions. A newsletter is one-way communication, and separate IT teams fragment the enterprise instead of improving engagement.

Question 74Governance of Enterprise IT⚑ Flag

An electronics maker is negotiating to acquire a smaller competitor. The deal team has reviewed finances and markets but not technology. What should IT governance ensure BEFORE the deal is signed?

AThe target's IT staff are given new job titles BThe target's IT risks and compatibility are assessed in due diligence CThe target's email and collaboration systems are migrated to the buyer's platform DThe target's software licenses are renewed for five years

Correct answer: B. The target's IT risks and compatibility are assessed in due diligence
IT due diligence before signing reveals risks, costs and integration issues that may affect the price or the decision itself. Migrating systems, renewing licenses and changing job titles are integration activities that come after the deal.

Question 75Benefits Realization⚑ Flag

Two proposed investments at an insurer have the same expected benefits. One relies on an unproven technology and a vendor new to the market. How should this affect prioritization?

AIt should not matter, because the expected benefits are exactly the same BThe riskier investment should be preferred because it may be more innovative CThe decision should be based only on which vendor offers the lowest price DThe riskier investment should have its value adjusted for its higher risk

Correct answer: D. The riskier investment should have its value adjusted for its higher risk
Prioritization should consider risk-adjusted value, since higher risk lowers the likelihood of realizing benefits. Ignoring risk or preferring it for novelty does not reflect sound value management.

Question 76Risk Optimization⚑ Flag

A CISO at a logistics firm asks the board for a large increase in the security budget. How should the request BEST be justified?

ABy listing the number of new tools that other companies have bought recently BBy describing the latest attack techniques reported in the news this month CBy noting that the security budget has not increased for several years now DBy showing how the spending reduces key risks to business objectives

Correct answer: D. By showing how the spending reduces key risks to business objectives
Security investment should be justified by how it reduces significant risks to business objectives within appetite. Peer tool counts, budget history or news stories do not show value to the enterprise.

Question 77Governance of Enterprise IT⚑ Flag

Both the sales and the product divisions of an electronics maker claim ownership of product pricing data and make conflicting changes to it. What is the BEST resolution?

AHave the data governance body assign one accountable owner BCreate two copies of the data so each division controls its own CGive both divisions joint ownership with equal authority DLet the IT department take ownership to remain neutral

Correct answer: A. Have the data governance body assign one accountable owner
Ownership should be assigned by the data governance body to the single business leader most accountable for the data. Joint ownership blurs accountability, IT is a custodian rather than an owner, and duplicate copies create inconsistent data.

Question 78Governance of Enterprise IT⚑ Flag

A conglomerate is selling one of its divisions. The buyer needs the seller's IT services for 12 months while it builds its own. Which of the following is MOST important for governing this arrangement?

AShutting down all shared systems as soon as the sale closes to cut costs BAllowing the buyer full access to all seller systems CDefining transitional service agreements with clear terms and exit dates DMoving all division staff to the buyer on the first day

Correct answer: C. Defining transitional service agreements with clear terms and exit dates
Transitional service agreements set the scope, service levels, costs and end dates for temporary services, which protects both parties. Giving the buyer full access creates serious security and data risk, and shutting down shared systems immediately would disrupt the division.

Question 79IT Resources⚑ Flag

A five-year network services contract at a hospital group is due for renewal in six months. The vendor has offered a 3% price increase. What should the hospital do FIRST?

ABenchmark the vendor's price and service levels against the market BStart migrating services to a new vendor right away to avoid the increase CAsk the vendor for a discount equal to the proposed increase in price DAccept the offer because changing vendors would disrupt hospital services

Correct answer: A. Benchmark the vendor's price and service levels against the market
Benchmarking shows whether the current price and service are competitive and gives a fact base for negotiation or retendering. Accepting, demanding discounts or migrating without facts may lead to poor decisions.

Question 80Benefits Realization⚑ Flag

A fintech firm wants to avoid programs continuing long after they stop making sense. What is the BEST practice at the time of approval?

AAsk the finance team to decide on stopping programs without input from sponsors BDefine clear criteria that would trigger stopping or re-scoping the program CApprove programs only when the sponsor promises they will never be stopped DRequire programs to finish within one year, whatever their size and goals

Correct answer: B. Define clear criteria that would trigger stopping or re-scoping the program
Defining stop criteria upfront makes later decisions objective and reduces the influence of momentum or sunk cost. Promises, fixed durations or finance-only decisions do not provide that discipline.

Question 81Risk Optimization⚑ Flag

A data breach at an online retailer was handled by IT for three days before executives learned of it. What is the BEST governance improvement?

AAsk IT to fix all incidents faster so that executives never need to be told BDefine criteria for escalating incidents to executives and the board CRequire the board to approve every incident response action in advance DHire an external firm to handle all incidents without involving IT staff

Correct answer: B. Define criteria for escalating incidents to executives and the board
Clear escalation criteria ensure significant incidents reach executives and the board in time for decisions on communication, legal and business impact. Faster fixes or outsourcing do not ensure timely escalation, and board approval of every action is impractical.

Question 82Governance of Enterprise IT⚑ Flag

A review at a research institute finds that nearly all information is labeled highly confidential, including public reports. What is the GREATEST concern?

AThe classification software license may cost more each year BLabels may not display correctly in some document templates CProtection costs rise and sensitive data stands out less DStaff may need extra time to apply labels to documents

Correct answer: C. Protection costs rise and sensitive data stands out less
Overclassification wastes money on unneeded controls and makes it harder to focus protection on truly sensitive information. Display problems, labeling time and license costs are minor compared with that loss of meaningful protection.

Question 83Governance of Enterprise IT⚑ Flag

The board of a payroll services company asks how it can gain confidence that its outsourced data center provider maintains effective controls. Which of the following is the BEST source of assurance?

AVerbal confirmation from the provider's account manager BAn independent assurance report on the provider's controls CA count of the incidents the provider reported to the company last year DMarketing materials published by the provider

Correct answer: B. An independent assurance report on the provider's controls
An independent assurance report gives objective evidence about the design and operation of the provider's controls. Verbal confirmation and marketing materials come from the provider itself, and incident counts alone do not show whether controls are effective.

Question 84Benefits Realization⚑ Flag

Business cases at a large retailer consistently show benefits arriving faster and costs lower than reality. What is the BEST control?

AAsking sponsors to sign a statement that their estimates are completely accurate BRequiring every business case to be at least twenty pages long to show depth CAllowing only the IT department to prepare business cases from now on DIndependent review and challenge of business cases before approval

Correct answer: D. Independent review and challenge of business cases before approval
Independent review challenges optimism bias and improves estimate quality before decisions are made. Length rules, signed statements or IT-only authorship do not provide objective challenge.

Question 85IT Resources⚑ Flag

Which statement BEST describes the value of adopting a skills and competency framework for IT staff?

AIt gives a common language for skills, roles and development needs BIt replaces the need for annual performance reviews for every IT employee CIt sets the salary level for each IT role based on current market data DIt guarantees that all IT staff will hold professional certifications

Correct answer: A. It gives a common language for skills, roles and development needs
A competency framework creates a shared way to describe skills and roles, which supports workforce planning, hiring and development. It does not replace reviews, set salaries or guarantee certifications.

Question 86Risk Optimization⚑ Flag

At a stock brokerage, the IT team set the recovery time objective for the trading platform at 24 hours. Business leaders say this is far too long. What is the BEST action?

ALet the disaster recovery vendor choose the objective it can support BChoose a recovery time halfway between the IT and business views CHave business owners set recovery objectives based on business impact DKeep the IT team's objective because IT understands the platform best

Correct answer: C. Have business owners set recovery objectives based on business impact
Recovery objectives should be set by business owners based on the impact of downtime, with IT advising on cost and feasibility. A compromise or vendor-driven value does not reflect business need.

Question 87Benefits Realization⚑ Flag

A toy company's portfolio board must choose between two digital features of similar total value. One supports a holiday sales campaign that starts in ten weeks, while the other has no deadline. Which factor should MOST influence the order of delivery?

AThe value that would be lost if each feature were delivered later BThe feature that the delivery team finds easier to build CThe order in which the two requests were first submitted DThe feature that the most senior executive is sponsoring

Correct answer: A. The value that would be lost if each feature were delivered later
Cost of delay captures how much value is lost each week a feature is late, so the time-critical holiday feature should come first even though total value is similar. Ease of build and request order ignore when the value actually occurs.

Question 88Governance of Enterprise IT⚑ Flag

An online marketplace keeps all customer data indefinitely in case it becomes useful for future analytics. What is the GREATEST concern?

AAnalytics queries may run more slowly on larger data sets BData storage costs will continue to grow each year CBackups may take longer to complete each night DGreater legal and privacy exposure from data kept past its need

Correct answer: D. Greater legal and privacy exposure from data kept past its need
Keeping data beyond its business or legal need increases exposure to privacy violations, breach impact and discovery costs. Storage cost and performance are real, but they are far less serious than the legal and reputational risk.

Question 89Governance of Enterprise IT⚑ Flag

The CFO of a regional airline wants to outsource all application development next quarter to cut costs by 20 percent. What should the governance body do FIRST?

AEvaluate the proposal against strategy, risks and total value BIssue a request for proposals to offshore vendors CNotify development staff that their roles will end DApprove the plan promptly because it meets the stated savings target

Correct answer: A. Evaluate the proposal against strategy, risks and total value
An outsourcing decision should first be evaluated for strategic fit, risk and total value, not cost alone. Issuing an RFP, notifying staff or approving based on savings skips this evaluation.

Question 90Benefits Realization⚑ Flag

An IT department at a hotel chain collects user satisfaction scores every quarter but takes no action on them. What is the BEST improvement?

APublish the scores only when they are above the target set for the quarter BChange the survey questions every quarter to keep users more interested CAnalyze feedback trends and use them to drive service improvements DStop collecting the scores because they do not affect any decisions made

Correct answer: C. Analyze feedback trends and use them to drive service improvements
Feedback is valuable when it is analyzed and used to drive improvement actions. Stopping, selective publishing or changing questions undermines its usefulness.

Question 91Risk Optimization⚑ Flag

Two banks merged six months ago and now share many systems and staff. Each bank still has its own continuity plan from before the merger. What is the GREATEST concern?

AThe plans may use different document templates and naming conventions BThe plans may be stored on different file servers in each former bank CThe plans may have been written by staff who have since left the banks DThe plans may not reflect the new combined dependencies and priorities

Correct answer: D. The plans may not reflect the new combined dependencies and priorities
After a merger, systems, processes and dependencies change, so old plans may not support recovery of the combined business. Templates, storage and authors are minor issues.

Question 92IT Resources⚑ Flag

A software company keeps losing its best cloud architects to competitors, which delays key products. What is the BEST long-term response?

AReplace all architects with an outsourced design team on a fixed contract BLower the hiring standards so that vacancies can be filled more quickly CAsk departing architects to sign stricter non-compete agreements before they leave DCreate career paths and development plans for critical roles

Correct answer: D. Create career paths and development plans for critical roles
Career paths and development opportunities address common reasons skilled staff leave and help retain critical talent. Legal restrictions, outsourcing or lower standards may create new problems without fixing retention.

Question 93Governance of Enterprise IT⚑ Flag

Executives at a wholesale distributor no longer trust management reports because of frequent data errors. The data governance council wants to address data quality. What should it do FIRST?

ABuy a data cleansing tool to correct existing errors BDefine quality dimensions and acceptable thresholds with data owners CAsk IT to rebuild the reporting system from scratch DRequire report authors to check all figures manually before each release

Correct answer: B. Define quality dimensions and acceptable thresholds with data owners
Data quality cannot be managed until owners agree on what good quality means and how it will be measured. Tools, rebuilds and manual checks can follow, but without agreed thresholds they cannot show whether quality has improved.

Question 94Governance of Enterprise IT⚑ Flag

An online retailer adopted agile product teams, but every change still waits for a monthly governance board and a yearly funding cycle. Delivery has slowed. Which of the following is the BEST governance response?

AAdd more approval steps and executive sign-offs to reduce delivery risk BRemove governance from agile teams entirely CAdapt governance with lighter controls and incremental funding DReturn all teams to a traditional waterfall method

Correct answer: C. Adapt governance with lighter controls and incremental funding
Governance should be adapted to agile delivery through lighter, embedded controls and incremental funding tied to outcomes. Removing governance leaves risk unmanaged, and returning to waterfall or adding approvals ignores the business need for speed.

Question 95Benefits Realization⚑ Flag

An investment committee at a bank wants to stop a data quality project that shows weak direct benefits. Two major programs rely on its outputs. What should the committee do BEFORE deciding?

AStop the project at once, since its direct benefits are too low to justify it BAssess how stopping it would affect the programs that depend on it CMove the project's budget to the two programs without telling their sponsors DAsk the project team to promise higher benefits so that it can continue

Correct answer: B. Assess how stopping it would affect the programs that depend on it
Investments in a portfolio are often interdependent, so the committee should understand how stopping one affects others before deciding. Judging the project only on its own benefits could damage larger programs.

Question 96Risk Optimization⚑ Flag

A manufacturer's board is concerned about ransomware. Directors want to avoid making rushed decisions during an attack. What should the board do in advance?

ALeave all decisions about any ransom payment to the IT team during an attack BBuy cryptocurrency now so that a ransom can be paid quickly if needed CAgree on decision authority and principles, including on ransom payment DAsk the CISO to promise that ransomware attacks will not succeed

Correct answer: C. Agree on decision authority and principles, including on ransom payment
Agreeing in advance who decides and on what principles, including legal and ethical questions on payment, allows timely and sound decisions under pressure. Leaving it to IT, preparing to pay or seeking guarantees is not good governance.

Question 97Governance of Enterprise IT⚑ Flag

The board of a large bank is considering appointing a chief data officer. What is the PRIMARY governance benefit of this role?

ALower salaries for database administrators across the bank BSingle executive accountability for managing data as an enterprise asset CDirect operational control over all of the bank's databases and storage systems DRemoving data ownership duties from business unit leaders

Correct answer: B. Single executive accountability for managing data as an enterprise asset
A chief data officer gives the enterprise a senior leader accountable for data strategy and governance across business units. The role does not take over business ownership of data or run the infrastructure, which remain with owners and IT respectively.

Question 98Governance of Enterprise IT⚑ Flag

The board of an insurance group approved a three-year digital transformation. Which measure would BEST show the board whether the transformation is succeeding?

APercentage of the budget spent to date BCount of staff trained on new digital tools CProgress on the business outcomes defined in the business case DNumber of new applications deployed to production

Correct answer: C. Progress on the business outcomes defined in the business case
Success should be measured by progress toward the business outcomes the board approved, such as customer growth or lower claims costs. Budget spent, applications deployed and staff trained are activity measures that do not prove value.

Question 99Benefits Realization⚑ Flag

A board receives the same 30-line value report every month, and most items never change. What is the BEST improvement?

AHighlight trends and exceptions that need board attention BSend the report every quarter but keep exactly the same format and content CAsk the CIO to present each of the 30 lines in detail at every meeting DAdd more lines to the report so that the board has a more complete picture

Correct answer: A. Highlight trends and exceptions that need board attention
Exception-based reporting with trends directs board attention to what needs a decision. Adding lines, reducing frequency or more presentation time does not improve focus.

Question 100IT Resources⚑ Flag

A payroll provider used by a large employer has recently reported heavy financial losses. What is the BEST action for the employer's vendor governance?

AAsk the vendor to lower its fees to help the employer save money BTerminate the contract at once and bring payroll back in-house immediately CWait until the vendor actually fails before taking any action at all DMonitor the vendor's viability and confirm contingency plans

Correct answer: D. Monitor the vendor's viability and confirm contingency plans
Monitoring financial viability and preparing contingency options protects service continuity without overreacting. Immediate termination may be premature, and waiting for failure leaves the employer exposed.

Question 101Risk Optimization⚑ Flag

A manufacturer's board approved a cyber risk appetite stating it will accept no more than four hours of production downtime from any cyber event. Management now reports that three plants run unsupported control systems that could cause multiday outages. What should happen NEXT?

AReport the gap to the board with treatment options and owners BAsk the vendor to extend support informally CLower the appetite statement to match current exposure DAccept the exposure because the systems still run today

Correct answer: A. Report the gap to the board with treatment options and owners
When exposure exceeds the board's stated appetite, management must escalate it with options for treatment so the board can decide. Quietly lowering the appetite to match reality defeats the purpose of setting it.

Question 102Benefits Realization⚑ Flag

A program sponsor at an energy company wants to remove a module that underpins one of the main benefits, to save time. What is the BEST governance response?

AAsk the delivery team to vote on whether the module should be removed BAllow the change because the sponsor has full authority over the scope CAssess the impact on benefits and seek approval through change control DProceed with the change and report its effect at the program's closure

Correct answer: C. Assess the impact on benefits and seek approval through change control
Scope changes that affect benefits should be assessed and approved through the program's change control so the business case stays valid. Unilateral changes or team votes bypass governance.

Question 103Governance of Enterprise IT⚑ Flag

Analysts at a healthcare provider build reports in a new analytics platform by combining data from many sources. No one records where the data came from or how it was transformed. What is the GREATEST concern?

AAnalysts may create more reports than the business needs BThe platform may need more computing capacity over time CReport formats may differ between analyst teams DDecisions may rely on data whose origin cannot be verified

Correct answer: D. Decisions may rely on data whose origin cannot be verified
Without data lineage, the organization cannot confirm the accuracy of reports or trace errors back to their source, which undermines decisions and accountability. Report volume, formatting and capacity are minor operational concerns.

Question 104Governance of Enterprise IT⚑ Flag

In COBIT 2019, which of the following BEST describes how capability levels and maturity levels are applied?

ACapability levels apply to people, and maturity levels apply to technology platforms BBoth terms describe the same rating applied only to the whole enterprise CMaturity levels apply to individual activities within one process DCapability levels apply to processes, and maturity levels apply to focus areas

Correct answer: D. Capability levels apply to processes, and maturity levels apply to focus areas
COBIT 2019 rates processes using capability levels, and it uses maturity levels for focus areas or groups of objectives. The terms are not interchangeable, and neither is tied to people or technology alone.

Question 105IT Resources⚑ Flag

A media company is building new services on a single cloud provider's proprietary tools. The board worries about future flexibility. Which action BEST addresses this concern?

ASign a ten-year agreement with the provider to secure a lower price per unit BInclude portability in design choices and data exit terms in the contract CAvoid all cloud services and keep every workload in the company data center DAsk the provider for a verbal promise to support any future migration

Correct answer: B. Include portability in design choices and data exit terms in the contract
Considering portability in design and securing data exit rights in the contract reduce lock-in while still allowing cloud benefits. Avoiding cloud forfeits value, and long terms or verbal promises increase dependence.

Question 106Benefits Realization⚑ Flag

A bank tracks benefits for dozens of programs in scattered spreadsheets. Which tool would BEST support consistent benefit management?

AA shared project schedule that shows all milestones across the portfolio BA benefits register showing each benefit, owner, measure and status CA financial ledger that records all spending on the portfolio's programs DA risk register that lists the threats facing each program in the portfolio

Correct answer: B. A benefits register showing each benefit, owner, measure and status
A benefits register centralizes information on each benefit, its owner, measure and progress. Schedules, risk registers and ledgers track other aspects of programs.

Question 107Risk Optimization⚑ Flag

A digital bank releases software changes several times a day. Risk managers worry that traditional change approvals cannot keep up. What is the BEST approach?

AHave internal audit approve each release before it reaches production BExempt all software releases from risk management to keep up the speed CSlow the release frequency so that each change can be reviewed manually DEmbed automated controls and risk checks into the delivery pipeline

Correct answer: D. Embed automated controls and risk checks into the delivery pipeline
Embedding automated controls in the pipeline keeps risk managed while supporting rapid delivery. Slowing releases loses agility, exemptions remove control, and audit approvals would compromise independence.

Question 108Governance of Enterprise IT⚑ Flag

A car manufacturer plans to share vehicle sensor data with a technology partner to develop new services. What is the MOST important governance control before sharing begins?

AA press release announcing the new partnership to customers BA plan to share the data with additional partners later CAn agreement defining permitted use, ownership and protection of the data DA technical test confirming that the partner can receive very large data files

Correct answer: C. An agreement defining permitted use, ownership and protection of the data
A data sharing agreement sets clear limits on use, ownership and protection, which keeps the enterprise in control of its information. Technical testing and publicity matter, but they do not protect the data or define accountability.

Question 109Governance of Enterprise IT⚑ Flag

A mining company's governance office proposes a target of capability level 5 for every IT process. Which of the following is the GREATEST concern with this proposal?

ALevel 5 ratings may not be recognized by the company's external auditors BTargets are not based on enterprise priorities and design factors CStaff may need extra training on process documentation DAssessments at level 5 take longer to complete

Correct answer: B. Targets are not based on enterprise priorities and design factors
Target capability levels should reflect enterprise priorities and design factors, so a uniform top target wastes resources on low-priority processes. Training needs and assessment duration are minor compared with misallocating effort.

Question 110Benefits Realization⚑ Flag

A retailer's benefit owners rarely report on progress, and missed benefits have no consequences. What is the BEST way to strengthen accountability?

ARemove benefit targets from business cases to avoid any further disputes BPublicly criticize benefit owners whose programs miss their benefit targets CLink benefit targets to the performance objectives of the benefit owners DAsk the program office to report on benefits instead of the business owners

Correct answer: C. Link benefit targets to the performance objectives of the benefit owners
Linking benefit targets to personal performance objectives makes owners accountable through the performance management system. Public criticism, shifting reporting or removing targets weakens ownership.

Question 111Risk Optimization⚑ Flag

An insurer's risk register excludes a scenario of a total loss of its main data center because it is rated very unlikely. What is the BEST response?

AInclude the scenario, since its impact could be severe despite its low likelihood BWait until another insurer experiences a data center loss before adding it CDelete similar low-probability scenarios from the register to keep it short DAgree, since unlikely scenarios do not need to be considered at all

Correct answer: A. Include the scenario, since its impact could be severe despite its low likelihood
Low-probability, high-impact scenarios can threaten the enterprise and must be considered in risk analysis and continuity planning. Excluding them on likelihood alone ignores potentially severe consequences.

Question 112IT Resources⚑ Flag

Which statement BEST describes the governance purpose of service credits in an outsourcing agreement?

AThey replace the need to monitor the provider's performance against the SLA BThey encourage the provider to meet service levels and offer a remedy when it does not CThey are a source of extra revenue that offsets the cost of the outsourced service DThey allow the customer to end the contract at any time without giving a reason

Correct answer: B. They encourage the provider to meet service levels and offer a remedy when it does not
Service credits create an incentive for the provider to meet agreed levels and give the customer a remedy for shortfalls. They are not meant to generate revenue, do not give termination rights and still depend on performance monitoring.

Question 113Governance of Enterprise IT⚑ Flag

The board of an online lender is reviewing its oversight of artificial intelligence used in core business processes. What is MOST important for the board to establish?

ARisk appetite and clear accountability for AI-driven outcomes BA target for the number of AI use cases deployed each year CTechnical standards for the programming languages used in models DA requirement that every model is built by internal staff

Correct answer: A. Risk appetite and clear accountability for AI-driven outcomes
The board should set how much AI risk the enterprise will accept and who is accountable when AI decisions affect customers or the business. Coding standards are management detail, and deployment targets encourage volume without addressing risk.

Question 114Governance of Enterprise IT⚑ Flag

A water utility wants to start a COBIT-based governance implementation. According to the COBIT implementation approach, which of the following should happen FIRST?

ASelecting and installing a governance management tool BWriting detailed procedures for every IT process CRecognizing the pain points and trigger events that drive the need to act DRunning a full capability assessment of all 40 governance and management objectives

Correct answer: C. Recognizing the pain points and trigger events that drive the need to act
The COBIT implementation lifecycle starts by identifying the drivers, such as pain points and trigger events, that create the need for change. Tools, procedures and detailed assessments come later once the drivers and scope are understood.

Question 115Benefits Realization⚑ Flag

A powerful division head at a media company bypassed the portfolio process and directly hired a vendor to build a large system. What should the governing body do?

ACancel the division head's budget for all IT spending going forward BAsk IT to support the system without reviewing its costs or benefits CApprove the project after the fact because the division head is senior DReinforce that all significant investments must follow the portfolio process

Correct answer: D. Reinforce that all significant investments must follow the portfolio process
Governance depends on consistent use of the portfolio process, so leaders should reinforce it and review the investment. Approving bypasses sets a poor precedent, and extreme penalties are disproportionate.

Question 116Risk Optimization⚑ Flag

A bank wants business units to experiment quickly with new fintech tools without exposing customer data or core systems. Leaders fear that strict approval gates will kill innovation. Which approach BEST balances risk and innovation?

ALet business units adopt any tool they choose and review later BRequire board approval for every experiment CBan all new tools until a full risk assessment of each is done DProvide an isolated sandbox with synthetic data and clear criteria for moving to production

Correct answer: D. Provide an isolated sandbox with synthetic data and clear criteria for moving to production
A governed sandbox with synthetic data limits exposure while letting teams experiment, and clear graduation criteria bring risk review in at the right time. Letting units adopt anything leaves customer data and core systems exposed.

Question 117Benefits Realization⚑ Flag

A university runs 400 applications, many with overlapping functions and low use. What is the BEST approach to improve value?

AAssess applications for value and cost, and retire or consolidate where justified BAsk each department to justify why the university needs more applications CMove all 400 applications to cloud hosting without changing anything else DUpgrade all 400 applications to their latest versions over the coming year

Correct answer: A. Assess applications for value and cost, and retire or consolidate where justified
Application portfolio rationalization assesses value and cost so low-value applications can be retired or consolidated. Upgrading or moving everything keeps the waste.

Question 118Governance of Enterprise IT⚑ Flag

A mortgage company plans to use a vendor's AI model to approve loan applications. The vendor will not explain how the model reaches its decisions. What is the GREATEST concern?

AThe model may process applications more slowly than the current system BThe company cannot justify decisions it is still accountable for CThe vendor may raise license fees in future years DStaff may need training to use the vendor's interface

Correct answer: B. The company cannot justify decisions it is still accountable for
The enterprise remains accountable for lending decisions even when a vendor supplies the model, so a lack of explainability creates fairness, regulatory and reputational risk. License fees, training and speed are secondary operational issues.

Question 119Governance of Enterprise IT⚑ Flag

An education ministry implemented new IT governance processes, and early results were good. A year later, staff have slipped back to old habits. Which of the following would BEST have sustained the improvements?

APublishing the governance framework on the intranet once BReplacing staff who returned to previous practices CRunning a second implementation with a new consultant DEmbedding changes through ongoing change enablement and monitoring

Correct answer: D. Embedding changes through ongoing change enablement and monitoring
Sustaining governance requires change enablement, including reinforcement, communication and monitoring, so that new practices become normal behavior. A one-time publication or a new consultant does not change behavior over time.

Question 120IT Resources⚑ Flag

An internal review at a bank found that 30% of paid software subscriptions have not been used in six months. What is the BEST governance action?

AAsk finance to cancel all software subscriptions and approve each one again BRequire each user to justify their software use in a written report each year CReclaim and reassign unused licenses as part of regular asset reviews DBuy a larger enterprise agreement so that unit prices go down for everyone

Correct answer: C. Reclaim and reassign unused licenses as part of regular asset reviews
Regularly reclaiming and reallocating unused licenses optimizes existing assets and reduces waste. Mass cancellation disrupts work, larger agreements may increase waste, and annual written justifications add burden without systematic control.

Question 121Benefits Realization⚑ Flag

A program at a shipping firm keeps escalating small schedule slips to the steering committee, which wastes executive time. What is the BEST improvement?

AAgree on tolerances so only deviations beyond limits are escalated BHold steering committee meetings every week to deal with each slip quickly CStop reporting schedule information to the steering committee altogether DAsk the program manager to hide small slips from all status reports

Correct answer: A. Agree on tolerances so only deviations beyond limits are escalated
Agreed tolerances delegate minor variances to management and escalate only significant deviations, which uses governance time well. Stopping reporting or hiding slips removes transparency.

Question 122Risk Optimization⚑ Flag

Business units at a global retailer use different terms and scales to describe IT risks, so reports cannot be compared. What is the BEST action?

ALet each unit continue its own approach but report less often to leaders BReplace all qualitative ratings with technical vulnerability scores CEstablish a common risk taxonomy and rating scales for the enterprise DAsk each unit to send longer reports with more explanation of its terms

Correct answer: C. Establish a common risk taxonomy and rating scales for the enterprise
A common taxonomy and rating scales create a shared language so risks can be compared and aggregated. Longer reports, less reporting or technical scores do not solve inconsistency.

Question 123Governance of Enterprise IT⚑ Flag

A streaming service plans to run all its systems on a single public cloud provider using many provider-specific services. What is the GREATEST concern for the board?

ADependence on one provider with no workable exit strategy BMonthly invoices may be harder for finance to read CThe provider's data centers may be in different time zones DDevelopers may need to learn new programming tools

Correct answer: A. Dependence on one provider with no workable exit strategy
Heavy use of proprietary services without an exit strategy creates lock-in that limits negotiating power and resilience. Developer skills, invoice format and time zones are manageable details compared with that strategic dependency.

Question 124Governance of Enterprise IT⚑ Flag

An investment holding company owns seven subsidiaries, each with its own board and IT team. After a breach at one subsidiary, group directors realize they have no view of how IT is governed across the group. What should the group board do FIRST?

AMerge all subsidiary IT teams into one central group department BSet minimum IT governance requirements and reporting for all subsidiaries CLeave IT governance entirely to each subsidiary's own board DHave group IT staff take over daily security operations at each subsidiary

Correct answer: B. Set minimum IT governance requirements and reporting for all subsidiaries
The group board stays accountable for group-wide risk, so it should set minimum IT governance expectations and regular reporting while subsidiary boards govern locally. Merging all IT or running subsidiary operations from the center is a major structural step that should not come before basic oversight is in place.

Question 125Benefits Realization⚑ Flag

A tech company approved more projects than its delivery teams can staff, and most are now delayed. What should the portfolio process have considered?

AThe available delivery capacity when selecting investments BThe expected number of user stories in each project's product backlog CThe number of projects that competing companies approved in the same year DThe personal preference of each executive sponsor for project start dates

Correct answer: A. The available delivery capacity when selecting investments
Portfolio selection must consider resource capacity so approved work can be delivered. Competitor activity, backlog counts or sponsor preferences do not prevent over-commitment.

Question 126IT Resources⚑ Flag

A retailer's core platform has years of quick fixes, and changes now take three times longer than before. The IT director says this slows every initiative. What is the BEST governance response?

AAsk developers to fix technical debt in their spare time each week BBan all further changes to the platform until a full rewrite is complete CMake technical debt visible and include it in portfolio decisions DOutsource platform maintenance so the problem moves to a vendor

Correct answer: C. Make technical debt visible and include it in portfolio decisions
Making technical debt visible lets leaders weigh its cost and include remediation in resource and investment decisions. Bans, spare-time fixes or outsourcing do not give the enterprise a planned way to manage it.

Question 127Risk Optimization⚑ Flag

A business unit at a logistics firm asks for an exception to the security policy so it can launch a partner portal on time. What is the BEST way to handle this?

AGrant a permanent exception, since the business unit owns the portal BApprove a time-limited exception at the right level, with compensating controls CLet the project team approve its own exception to avoid any delay DDeny all exceptions to the security policy regardless of the business need

Correct answer: B. Approve a time-limited exception at the right level, with compensating controls
Exceptions should be approved by someone with authority, limited in time and supported by compensating controls, so risk stays within appetite. Permanent, self-approved or blanket-denied exceptions are poor practice.

Question 128Governance of Enterprise IT⚑ Flag

Cloud spending at an education technology company has tripled in a year, and no one can explain which business units drive the costs. What is the BEST governance response?

ASet a hard monthly spending cap and shut down any services that exceed it BMove all workloads back to on-premises data centers CAsk the cloud provider for a volume discount on all services DAssign cost ownership to business units with tagging and spend reporting

Correct answer: D. Assign cost ownership to business units with tagging and spend reporting
Assigning cost ownership with tagging and regular reporting creates transparency and accountability for cloud consumption. Hard caps can disrupt critical services, and discounts lower unit prices without fixing the lack of control.

Question 129Governance of Enterprise IT⚑ Flag

A pension fund is building its IT policy framework. Which of the following should be approved at the governance level rather than by operational management?

AEnterprise IT principles and high-level policies BConfiguration settings for network firewalls CWork instructions for the service desk DStep-by-step backup procedures for each server

Correct answer: A. Enterprise IT principles and high-level policies
The governing body approves enterprise principles and high-level policies that set direction. Detailed procedures, configurations and work instructions are developed and approved by management to carry out that direction.

Question 130Benefits Realization⚑ Flag

Business unit leaders at a manufacturer say they do not see IT's contribution to their results. What is the BEST approach?

AAsk the board to tell business unit leaders to value IT more than before BReport benefits jointly with business owners, showing shared outcomes CStop reporting IT performance to business leaders who are not interested DHave IT send longer reports to business leaders about its technical activities

Correct answer: B. Report benefits jointly with business owners, showing shared outcomes
Joint benefit reporting with business owners shows how IT and the business together achieve outcomes. Technical reports, silence or board pressure do not create shared understanding.

Question 131Risk Optimization⚑ Flag

A board member at a traditional bank suggests delaying all digital investments to avoid IT risk. What is the BEST response from a risk optimization view?

AExplain that not investing also carries risk, such as losing competitiveness BAgree, because avoiding new technology always reduces risk for the bank CSuggest investing only in technologies that carry no risk of any kind DRecommend that the bank transfer all IT risk to its technology vendors

Correct answer: A. Explain that not investing also carries risk, such as losing competitiveness
Risk optimization recognizes that failing to use IT to enable the business also creates risk, such as falling behind competitors. No technology is risk-free, and transferring all risk is not possible.

Question 132Governance of Enterprise IT⚑ Flag

A European payroll provider wants to move employee data to a cloud region in another country to lower costs. What should be done FIRST?

AWait until several competitors have fully proven each technology in practice BTest network speed between the offices and the new region CInform employees that their data will be moved abroad DDetermine the legal and regulatory rules on where the data may reside

Correct answer: D. Determine the legal and regulatory rules on where the data may reside
Data residency rules may limit or prohibit storing personal data in certain countries, so they must be confirmed before any commitment. Pricing, performance testing and employee notices only make sense once the move is known to be permitted.

Question 133Governance of Enterprise IT⚑ Flag

Which of the following is the BEST example of an outcome measure for IT governance, as opposed to a process performance measure?

AImprovement in customer satisfaction from IT-enabled services BNumber of RACI charts completed and approved by the governance office CNumber of steering committee meetings held this year DPercentage of policies reviewed on schedule

Correct answer: A. Improvement in customer satisfaction from IT-enabled services
An outcome measure shows whether enterprise goals were achieved, such as better customer satisfaction from IT-enabled services. Meetings held, policies reviewed and RACI charts completed show activity, not results.

Question 134Benefits Realization⚑ Flag

A company measures IT success mainly through an annual user satisfaction survey. What is the GREATEST limitation of this approach?

AThe survey results may be hard to present in a single chart to the board BSurveys usually cost more to run than other types of performance measures CSatisfaction does not show whether investments delivered business value DUsers may not have enough time to complete the survey each year in full

Correct answer: C. Satisfaction does not show whether investments delivered business value
Satisfaction is useful but does not show whether IT-enabled investments produced business outcomes such as revenue or cost savings. Cost, time and presentation are minor issues.

Question 135IT Resources⚑ Flag

During an audit, a logistics firm learns that its IT service provider has moved part of the work to an unknown subcontractor. What contract provision would BEST have prevented this?

AA clause requiring approval before the provider uses subcontractors BA clause setting a fixed price for the full term of the outsourcing agreement CA clause requiring the provider to hold regular quarterly business reviews DA clause stating that the provider must use the latest technology available

Correct answer: A. A clause requiring approval before the provider uses subcontractors
Requiring approval of subcontractors gives the firm visibility and control over who handles its services and data. Pricing, review meetings and technology clauses do not control subcontracting.

Question 136Benefits Realization⚑ Flag

A retailer is about to switch on a new point-of-sale system in 600 stores. Which activity is MOST important just before go-live?

AReviewing the vendor's financial statements for the most recent quarter BCompleting the lessons-learned report for the program's planning phase CUpdating the IT asset register with the purchase dates of the hardware DAssessing whether the stores and staff are ready for the change

Correct answer: D. Assessing whether the stores and staff are ready for the change
An organizational readiness assessment confirms that people, processes and support are in place, which affects adoption and benefits. Vendor finances, lessons learned and asset records can wait.

Question 137Risk Optimization⚑ Flag

A transport company's executives set the five-year strategy first and then ask the risk team to review it. What is the BEST improvement?

AHave internal audit approve the strategy before the board considers it BConsider risk as part of strategy setting, not only after it is decided CKeep the current approach but give the risk team more time to review it DAsk the risk team to set the strategy so that it avoids all major risks

Correct answer: B. Consider risk as part of strategy setting, not only after it is decided
Integrating risk into strategy setting lets the enterprise weigh risk and opportunity while choices are still open. Reviewing afterward limits influence, and risk or audit teams should not set or approve strategy.

Question 138Governance of Enterprise IT⚑ Flag

Board members of a mining company keep hearing about emerging technologies such as quantum computing and ask how the company should respond. What is the BEST approach?

AInvest early in each new technology to stay ahead of rivals BWait until competitors have proven each technology fully CUse a structured process to assess fit with strategy and risk DAsk the IT department to decide which technologies to adopt

Correct answer: C. Use a structured process to assess fit with strategy and risk
A structured innovation process lets the enterprise evaluate emerging technologies against strategic fit, value and risk before committing funds. Investing in every trend wastes resources, and always waiting can mean missing real opportunities.

Question 139Governance of Enterprise IT⚑ Flag

A software company wants to align IT teams with quarterly business priorities and make progress visible to executives. Teams currently track hundreds of activity metrics that leaders do not read. Which approach BEST supports this governance goal?

AAdd more activity metrics so nothing is missed BUse a small set of objectives and key results linked to enterprise goals CReplace all metrics with a single uptime figure DLet each team choose metrics without linking them to strategy

Correct answer: B. Use a small set of objectives and key results linked to enterprise goals
Objectives and key results tie team work to a few measurable outcomes that support enterprise goals, which makes alignment and progress visible to leaders. More activity metrics add noise without showing contribution to strategy.

Question 140IT Resources⚑ Flag

A specialty insurer is deciding whether to build its own pricing engine or buy a commercial product. Which factor should carry the MOST weight?

AWhether the commercial product has a more modern user interface design BWhether the in-house developers would find building the engine more interesting CWhether building would let the IT department grow its overall headcount DWhether the capability gives a competitive advantage to the business

Correct answer: D. Whether the capability gives a competitive advantage to the business
Capabilities that differentiate the business may justify building, while commodity functions are usually better bought. Developer interest, interface design and headcount growth do not reflect enterprise value.

Question 141Benefits Realization⚑ Flag

A bank's business case for a new core platform expects large savings from shutting down the legacy system. Two years after go-live, the legacy system still runs. What is the GREATEST concern?

AThe legacy system's support staff may lose motivation over a long period BThe expected savings are not realized while the old system keeps running CThe new platform may need more storage than originally planned for it DThe legacy system may still produce reports in a slightly different format

Correct answer: B. The expected savings are not realized while the old system keeps running
Benefits that depend on decommissioning are not achieved while the legacy system remains in use, so the business case is not delivered. Morale, report formats and storage are lesser concerns.

Question 142Risk Optimization⚑ Flag

A bank's security team warns that future quantum computers could break the encryption it uses to protect long-term customer data. What is the BEST governance response now?

AIgnore the issue until quantum computers are widely available for purchase BReplace all encryption across the bank immediately with new algorithms CMonitor the threat and plan to make encryption easier to replace over time DStop storing any customer data for longer than one year from today

Correct answer: C. Monitor the threat and plan to make encryption easier to replace over time
Monitoring the emerging threat and planning for crypto agility prepares the bank without premature or disruptive changes. Ignoring it risks future exposure, while immediate replacement or drastic data limits are disproportionate.

Question 143Governance of Enterprise IT⚑ Flag

A fintech startup's market is changing quickly, and its five-year IT strategy was outdated within a year. What is the BEST way to keep the IT strategy relevant?

AReview and adjust the strategy on a regular rolling cycle BExtend the planning horizon to ten years for greater stability CStop formal planning and respond to each change as it happens DLet each product team set its own IT direction independently

Correct answer: A. Review and adjust the strategy on a regular rolling cycle
A rolling review cycle keeps the strategy aligned with changing business conditions while keeping a clear direction. Abandoning planning or letting teams set their own direction removes the alignment that governance needs.

Question 144Governance of Enterprise IT⚑ Flag

Employees at a marketing agency have started using generative AI tools for client work without any guidance. The board asks how this should be governed. What is the BEST approach?

ABlock all AI tools at the firewall until national AI regulations are finalized BAllow each employee to decide how to use AI on their own CWait until a client complains before taking action DExtend the governance framework with AI principles, policy and accountability

Correct answer: D. Extend the governance framework with AI principles, policy and accountability
Extending the existing governance framework with AI principles, policy and clear accountability lets the agency gain the benefits while managing the risks. A total block forfeits value, and leaving use to individual judgment or waiting for complaints leaves the risk unmanaged.

Question 145Benefits Realization⚑ Flag

A telecom company proposes a new integration platform that will not create revenue itself but will enable faster launches of future products. How should its value BEST be assessed?

AAssess it by the strategic capabilities and future benefits it enables BApprove it without a business case because infrastructure is always needed CReject it, since it does not produce any direct revenue on its own DMeasure its value only by the number of servers and tools it will replace

Correct answer: A. Assess it by the strategic capabilities and future benefits it enables
Enabling investments should be assessed by the capabilities and future benefits they make possible, linked to strategy. Rejecting it for lack of direct revenue or approving without a case are both poor practice.

Question 146IT Resources⚑ Flag

A bank depends on one strategic vendor for its digital channels. Executives feel the relationship is purely transactional and not aligned with bank goals. What is the BEST improvement?

AAsk the vendor to send a larger team of staff to work at the bank's offices BAdd more financial penalties to the contract for every missed service level CSet up joint governance with regular executive reviews of shared goals DReduce all communication with the vendor to formal written notices only

Correct answer: C. Set up joint governance with regular executive reviews of shared goals
Joint governance with executive reviews aligns a strategic vendor with enterprise goals and manages the relationship at the right level. More penalties or more onsite staff address symptoms rather than strategic alignment.

Question 147Risk Optimization⚑ Flag

A telecom company assessed the risk of each vendor only when it was first onboarded. Several critical vendors have since changed ownership and services. What is the BEST improvement?

ARepeat the full onboarding assessment for every vendor every single month BStop using any vendor that has changed ownership since it was first onboarded CAsk each vendor to confirm by email once a year that nothing important has changed DReassess vendor risk periodically, with frequency based on criticality

Correct answer: D. Reassess vendor risk periodically, with frequency based on criticality
Vendor risk changes over time, so periodic reassessment, more often for critical vendors, keeps the risk view current. Self-confirmation is weak, monthly full reviews waste effort, and automatic exit is disproportionate.

Question 148Governance of Enterprise IT⚑ Flag

A retail bank deployed an AI model to flag fraudulent card transactions. Six months later its accuracy had dropped sharply as customer behavior changed, but no one noticed for weeks. What is the BEST governance control to prevent this?

ARetraining the model every week whether or not performance has changed BReplacing the model with manual review of every flagged transaction CAsking the vendor to guarantee the model's accuracy in the contract terms DOngoing performance monitoring with named owners and thresholds

Correct answer: D. Ongoing performance monitoring with named owners and thresholds
AI models can degrade after deployment, so governance requires continuous monitoring against agreed thresholds with clear owners who act on alerts. Scheduled retraining without monitoring may not catch problems, and a vendor guarantee does not remove the bank's accountability.

Question 149Governance of Enterprise IT⚑ Flag

A regulator has cited a credit union for weak IT access controls and asked for a response within 60 days. What should the board do FIRST?

AHave directors personally redesign the IT access control framework over the coming months BRequire management to present a remediation plan with owners and dates CReplace the CIO immediately to show the regulator that action was taken DAppeal the finding before management has reviewed the underlying issues

Correct answer: B. Require management to present a remediation plan with owners and dates
The board oversees remediation by holding management accountable for a plan with clear owners and deadlines, then monitoring progress. Directors redesigning controls themselves is too operational, and replacing the CIO before understanding the cause is premature.

Question 150Benefits Realization⚑ Flag

A software company is moving from funding short projects to funding long-lived product teams. What is MOST important for the governing body to put in place?

AA rule that every product team must finish its work within twelve months BA policy that product teams never change their scope once funding is approved COutcome-based measures for each product, reviewed regularly to guide funding DA requirement that product teams report the hours each person works each day

Correct answer: C. Outcome-based measures for each product, reviewed regularly to guide funding
With persistent product funding, regular review of outcome measures lets the governing body confirm value and adjust funding. Fixed end dates, hour tracking or frozen scope do not fit the model or show value.