Question 1

When preparing a new IT strategic plan for board approval, the MOST important consideration is to ensure the plan identifies:

Accepted Answer

A

Explanation: The MOST important consideration for board approval of an IT strategic plan is ensuring it clearly defines roles and responsibilities linked to IT objectives. The board's primary function is oversight and ensuring accountability for achieving enterprise goals. By explicitly linking roles and responsibilities to strategic IT objectives, the plan demonstrates a clear governance structure, assigns ownership, and provides the board with assurance that the strategy is actionable and its execution can be effectively monitored. This directly supports the core governance principles of direction and performance monitoring, which are paramount at the board level.

Question 2

Once the strategic vision has been established, which of the following would be the BEST activity for supporting the implementation of performance measures?

Accepted Answer

D

Explanation: Once a strategic vision is established, it must be translated into measurable objectives. The most effective activity to support the implementation of performance measures is to identify Key Performance Indicators (KPIs). KPIs are specific, quantifiable metrics that directly measure the achievement of strategic goals. They form the foundation of the performance measurement framework by providing clear targets and a means to track progress. This allows the enterprise to monitor how effectively it is executing its strategy and to make data-driven decisions. Without defined KPIs, any performance measurement system would lack focus and relevance to the strategic vision.

Question 3

A CIO has recently been made aware of a new regulatory requirement that may affect IT-enabled
business activities. Which of the following should be the CIO s FIRST step in deciding the appropriate
response to the new requirement?

Accepted Answer

C

Explanation: The most critical first step when faced with a new regulatory requirement is to fully understand its scope, implications, and potential impact. The CIO, while an expert in IT, is not typically a legal or regulatory expert. Therefore, the initial and most prudent action is to consult with internal or external legal and risk management professionals. These experts can accurately interpret the regulation and advise on its applicability to the organization's IT-enabled business activities. This foundational understanding is a prerequisite for any subsequent actions, such as assessing resource needs, modifying projects, or briefing executive leadership.

Question 4

An IT strategy committee wants to evaluate how well the IT department supports the business strategy. Which of the following is the BEST method for making this determination?

Accepted Answer

C

Explanation: The IT balanced scorecard (BSC) is a strategic performance management framework specifically designed to translate strategy into a comprehensive set of performance measures. It provides a holistic view by evaluating IT performance from multiple perspectives: financial, customer, internal processes, and learning and growth. This allows the IT strategy committee to directly link IT objectives and metrics to the overarching business strategy, offering the most complete and balanced method for determining how well the IT department provides support. It moves beyond purely operational or technical metrics to assess strategic contribution and value delivery.

Question 5

Which of the following is the MOST important consideration when integrating a new vendor with an enterprise resource planning (ERP) system?

Accepted Answer

B

Explanation: Integrating a new vendor with an Enterprise Resource Planning (ERP) system introduces significant risks to the organization's core data and business processes. A vendor risk assessment is the most critical initial step as it evaluates the vendor's security posture, financial stability, operational capabilities, and compliance with legal and regulatory requirements. This foundational activity provides the necessary information for senior management to make an informed selection, for procurement to draft an appropriate contract with necessary safeguards, and for technical teams to plan a secure integration. Without a thorough risk assessment, the enterprise is exposed to potential data breaches, operational disruptions, and non-compliance, making this the paramount consideration for governance of enterprise IT (GEIT).

Question 6

A healthcare enterprise is procuring Internet of Things (IoT) devices to be used across its facilities.
Which of the following is MOST important to establish before vendors are engaged to provide the
devices?

Accepted Answer

A

Explanation: Establishing product compliance criteria is the most critical initial step in the procurement process for IoT devices in a healthcare setting. This foundational governance activity involves defining the specific security, privacy (e.g., HIPAA), regulatory, and interoperability standards the devices must meet. These criteria form the basis for the request for proposal (RFP) and provide an objective framework for evaluating and selecting vendors. Without first defining what constitutes an acceptable and compliant product, the enterprise cannot effectively manage risk, ensure alignment with legal obligations, or make informed sourcing decisions. This step must precede any engagement with vendors to ensure all potential solutions are measured against the same essential requirements.

Question 7

A global organization has noticed a significant decrease in the return on IT investments in a particular region. To enhance project governance in this region, the CEO should FIRST

Accepted Answer

D

Explanation: The most appropriate initial action for a CEO, operating at a governance level, is to first understand the context and root cause of the performance issue. Engaging directly with the region's leadership is a fundamental step in the "Evaluate" component of the Evaluate, Direct, and Monitor (EDM) governance model. This collaborative approach ensures that any subsequent corrective actions are based on a thorough understanding of the specific challenges in that region, rather than on assumptions. This diagnostic step is crucial for effective governance and strategic decision-making before directing specific reviews or implementing changes.

Question 8

Which of the following is the BEST method to monitor IT governance effectiveness?

Accepted Answer

B

Explanation: The Balanced Scorecard (BSC) is the most effective method for monitoring IT governance effectiveness because it is a strategic performance management framework. It translates an organization's strategic objectives into a coherent set of performance measures distributed across four perspectives: financial, customer, internal business processes, and learning and growth. When applied to IT (as an IT Balanced Scorecard), it ensures that IT performance measurement is not solely focused on technical or operational metrics but is directly linked to business value and strategic alignment. This holistic, multi-dimensional view provides a comprehensive assessment of how well the IT governance framework is performing in achieving enterprise goals, which is its primary purpose.

Question 9

An enterprise's current business continuity plan (BCP) fails to consider many common crisis events. What would be MOST helpful to address this situation?

Accepted Answer

A

Explanation: The primary deficiency identified is that the business continuity plan (BCP) fails to consider many common crisis events. The most direct and effective method to remedy this is to engage a broad range of stakeholders in scenario development. Stakeholders from various business units, IT, and support functions possess unique insights into potential threats and impacts relevant to their areas. This collaborative approach ensures that the BCP is built upon a comprehensive and realistic set of potential crisis scenarios, directly addressing the plan's current weakness and enhancing its overall relevance and effectiveness.

Question 10

An IT steering committee is concerned that enterprise technologies have grown stagnant and are outdated. Which of the following is the BEST strategy to invest in modern technology?

Accepted Answer

C

Explanation: The BEST strategy is a governance-level action that embeds the desired change into the enterprise's processes. Creating a new investment category for innovation establishes a formal, strategic mechanism for the IT steering committee to prioritize, fund, and track modernization efforts. This approach aligns with IT portfolio management principles, ensuring that overcoming technological stagnation becomes a deliberate and sustainable part of the enterprise's investment strategy. It directly addresses the committee's concern by creating a dedicated channel for funding new technology, separate from day-to-day operational spending, thereby ensuring focus and accountability for modernization.

Question 11

Which of the following should be the FIRST consideration for an enterprise faced with a pandemic situation resulting in a mandatory remote work environment?

Accepted Answer

B

Explanation: In a crisis mandating a sudden shift to remote work, the most immediate and foundational priority is operational enablement. The enterprise must first ensure that its staff has the necessary technology—such as laptops, secure network access (VPN), and collaboration tools—to be productive. Without these essential resources, business operations cannot continue, rendering other important activities like policy updates or performance monitoring moot. This aligns with the CGEIT domain of IT Resource Optimization, which focuses on ensuring IT capabilities are sufficient to support the enterprise's objectives, especially during a major business disruption.

Question 12

What should be done FIRST when feedback indicates recently implemented software products are not meeting business unit expectations?

Accepted Answer

C

Explanation: The most critical first step is to understand the nature and extent of the discrepancy between performance and expectations. A gap analysis is a formal, structured process designed to compare the current state (the software's actual performance) with the desired state (the business unit's expectations). This analysis will identify the specific areas where the software is failing and provide the necessary data to determine the root cause(s). Without this foundational understanding, any subsequent actions, such as reviewing logs or implementing training, would be based on assumption rather than evidence and could be ineffective or wasteful.

Question 13

Which of the following is a responsibility of an IT strategy committee?

Accepted Answer

C

Explanation: The primary function of an IT strategy committee is to provide strategic-level guidance and ensure that IT strategy is aligned with the overall enterprise strategy. This committee typically consists of board members and senior executives. Its key responsibility is to advise the board of directors on IT-related strategic matters, including the development of IT goals, principles, and policies that will enable the achievement of business objectives. This advisory role ensures that IT is considered a strategic enabler from the highest level of the organization.

Question 14

Which of the following would be the MOST effective way to ensure IT capabilities are appropriately aligned with business requirements for specific business processes?

Accepted Answer

C

Explanation: The most effective way to ensure IT capabilities are aligned with specific business process requirements is to directly involve the business process stakeholders in the technical review process. Requiring joint architecture and design reviews creates a formal mechanism for business owners to validate that the proposed IT solution meets their functional and operational needs before significant resources are invested. This collaborative approach bridges the gap between business requirements and technical implementation, ensuring the final solution delivers the intended business value.

Question 15

Which of the following is the MOST important reason that IT strategic planning processes need to be adequately documented and communicated?

Accepted Answer

B

Explanation: The most important reason for documenting and communicating the IT strategic plan is to promote transparency to all stakeholders. This is a fundamental principle of good governance. Transparency ensures that the board, executive management, business units, and other key parties understand the direction of IT, the rationale behind strategic choices, and how IT investments are intended to create business value. This understanding fosters trust, facilitates buy-in, and ensures that IT is aligned with and accountable to the enterprise's overall objectives. The other options are consequences or components of this primary objective.

Free ISACA CGEIT Actual Exam Questions