Free Practice Questions for Isaca CGEIT Exam

The primary goal of implementing service level agreements (SLAs) with an outsourcing vendor is to achieve operational objectives, such as improving service quality, efficiency, effectiveness, and value. SLAs are contracts that define the scope, standards, and expectations of the service delivery, as well as the roles, responsibilities, and rights of both parties. SLAs can help align the outsourcing vendor’s services with the enterprise’s strategy, goals, and needs, as well as monitor and measure their performance and outcomes. SLAs can also help manage the risks, costs, and benefits of outsourcing, as well as resolve any issues or disputes that may arise.

Gaining a competitive advantage, establishing penalties for not meeting service levels, and complying with regulatory requirements are possible benefits or outcomes of implementing SLAs with an outsourcing vendor, but they are not the primary goal. Gaining a competitive advantage is a strategic objective that may result from outsourcing some IT functions or processes to a vendor that can provide better or cheaper services than the enterprise itself or its competitors. Establishing penalties for not meeting service levels is a mechanism that can be included in SLAs to enforce accountability and compliance, as well as to compensate for any losses or damages caused by poor service delivery. Complying with regulatory requirements is a legal obligation that may affect the design and implementation of SLAs, especially when outsourcing involves sensitive or personal data or cross-border transactions.

References := 12 Service Level Agreement (SLA) best practices for IT leaders; Contents The Complete Guide To IT Service Level Agreements - IT Governance; Service level management and service level agreements - IT Governance; Service Level Agreements: A Legal and Practical Guide.

 An IT balanced scorecard (BSC) is a framework that measures and manages the performance and value of IT in relation to the enterprise’s strategy, goals, and objectives. An IT BSC provides the most comprehensive insight into the effectiveness of IT, because it covers four perspectives that reflect the key aspects of IT: financial, customer, internal process, and learning and growth. For each perspective, an IT BSC defines objectives, measures, targets, and initiatives that align with the enterprise’s vision and mission. An IT BSC also helps to balance the short-term and long-term outcomes of IT, as well as the leading and lagging indicators of IT performance. According to ISACA’s article on The IT Balanced Scorecard1, “the IT BSC is a powerful tool for demonstrating the contribution of IT to the business, communicating IT performance in business terms, and aligning IT with business strategy.” Furthermore, according to ISACA’s CGEIT Domain 1: Framework for the Governance of Enterprise IT2, “the IT BSC is a widely used framework for measuring and managing the performance of IT resources in relation to enterprise goals.” Therefore, an IT BSC is the best way to provide a comprehensive insight into the effectiveness of IT.

Data management is the aspect of IT governance that BEST addresses the potential intellectual property implications of a cloud service provider having a database in another country. Data management involves defining and implementing policies and processes for the effective and efficient acquisition, storage, distribution, usage, and disposal of data in alignment with business objectives and regulatory requirements1. Data management also includes ensuring the protection of data quality, integrity, availability, confidentiality, and ownership1. Therefore, data management can help mitigate the risks of intellectual property infringement, theft, or misuse that may arise from storing data in a foreign jurisdiction with different legal and regulatory frameworks23. References :=

CGEIT Review Manual (Digital Version), Chapter 4: Value Optimization, Section 4.2: IT Value Delivery, Subsection 4.2.3: IT Resource Management, Page 123

CGEIT Review Manual (Print Version), Chapter 4: Value Optimization, Section 4.2: IT Value Delivery, Subsection 4.2.3: IT Resource Management, Page 123

Cloud computing: A brief overview of intellectual property issues “in the cloud” - Lexology2

Protecting Intellectual Property in the Cloud - WIPO

The next step that the enterprise should do after performing a business impact analysis (BIA) considering a number of risk scenarios is to assess risk mitigation strategies. A risk mitigation strategy is a plan of action that aims to reduce the likelihood or impact of a risk event, or to transfer or accept the risk1. Assessing risk mitigation strategies involves evaluating the costs, benefits, feasibility, and effectiveness of various options for addressing the risks identified in the BIA. Assessing risk mitigation strategies can help the enterprise prioritize and implement the most appropriate and efficient solutions for protecting its critical business processes and resources from potential disruptions2. According to the Business Continuity Planning Process Diagram, assessing risk mitigation strategies is the fourth step in the business continuity planning process, following the BIA3.

The other options are not the next steps that the enterprise should do after performing a BIA. Performing a risk controls gap analysis is a step that precedes the BIA, as it helps to identify the existing controls and their effectiveness in preventing or reducing the risks4. Updating the disaster recovery plan (DRP) is a step that follows after assessing risk mitigation strategies, as it involves documenting the procedures and resources for restoring the critical business functions and IT systems in case of a disaster5. Verifying compliance with relevant legislation is a step that is done throughout the business continuity planning process, as it ensures that the enterprise meets the legal and regulatory requirements for its industry and location6. References := 1: Risk Mitigation Strategies - ISACA72: How to Conduct aComprehensive Business Impact Analysis: A Step-by-Step Guide33: Business Continuity Planning Process Diagram - ISACA84: Business Impact Analysis: Definition and How To Conduct One15: The Complete Guide to Business Impact Analysis with Templates - Creately46: How To Conduct Business Impact Analysis in 8 Easy Steps - G25

A project governance framework is a set of principles, policies, roles, responsibilities, and processes that guide, direct, and control the initiation, planning, execution, monitoring, and closure of IT projects. A project governance framework can help the enterprise address the problems of poor project performance, lack of accountability, and inconsistency in execution by:

Providing a clear and consistent structure for managing IT projects across the enterprise

Aligning IT projects with the strategic objectives and priorities of the enterprise

Defining the roles and responsibilities of the project stakeholders, including the board of directors, senior management, project sponsors, project managers, project teams, and end-users

Establishing the criteria and methods for selecting, prioritizing, approving, and funding IT projects

Setting the standards and expectations for project planning, execution, quality, risk management, communication, and reporting

Implementing the mechanisms and tools for monitoring, controlling, evaluating, and reviewing IT project performance and outcomes

Ensuring the accountability and transparency of IT project decisions and results

The first consideration for an enterprise faced with a pandemic situation resulting in a mandatory remote work environment should be ensuring staff has the necessary technology to be productive, because this would enable the enterprise to maintain its business continuity and resilience, and to minimize the disruption and loss of the IT services and capabilities. The necessary technology may include hardware, software, network, security, and communication tools that support the remote work activities and requirements of the staff12. The enterprise should also provide guidance and training to the staff on how to use the technology effectively and securely12. The other options are not the first consideration, because they are either dependent on or secondary to the availability and functionality of the technology.

 A cost-benefit analysis (CBA) is a process that evaluates the costs and benefits of a project or investment to determine its feasibility and profitability for an organization. A CBA can help the IT steering committee to compare different options for establishing a virtual reality store, such as the required hardware, software, data center, security, marketing, maintenance, etc. A CBA can also help estimate the potential revenues, customer satisfaction, competitive advantage, and social impact of the virtual reality store. A CBA can provide a rational basis for decision-making and prioritization of the project. A CBA should be requested before other actions such as a resource gap analysis, a key risk indicator (KRI) development, or a threat assessment, as they depend on the scope and objectives of the project that are defined by the CBA. References: ISACA, Performance Measurement Metrics for IT Governance, page 11. ProjectManager, Cost-Benefit Analysis: A Quick Guide with Examples and Templates2. HBS Online, Cost-Benefit Analysis: What It Is & How to Do It

The best way for a CIO to monitor the alignment between the business and IT strategy is to regularly review the balanced scorecard. The balanced scorecard is a strategic management tool that helps to measure and communicate the performance of an organization in relation to its vision, mission, goals, and objectives. The balanced scorecard uses four perspectives: financial, customer, internal process, and learning and growth, to evaluate how well the organization is achieving its desired outcomes and creating value for its stakeholders1. The balanced scorecard can also help to align the IT strategy with the business strategy by linking the IT objectives, initiatives, and measures with the business objectives, initiatives, and measures across the four perspectives2. By reviewing the balanced scorecard regularly, the CIO can monitor the progress and results of the IT strategy, identify the gaps and issues that need to be addressed, and ensure that the IT strategy is supporting and enabling the business strategy. According to COBIT 5, one of the seven enablers of IT governance is performance management, which includes using the balanced scorecard to align IT-related goals and metrics with enterprise goals and metrics3. The balanced scorecard is also part of the IT governance domain 5: Performance Measurement4.

The other options are not the best ways for a CIO to monitor the alignment between the business and IT strategy. Key risk indicators (KRIs) are metrics that indicate the level of risk exposure or potential impact of a risk event on an organization. KRIs can help to monitor and manage IT risks, but they do not necessarily reflect the alignment of IT strategy with business strategy. IT services supporting business processes are the activities and functions that IT provides to enable and facilitate the execution of business processes. Reviewing IT services can help to evaluate the quality and efficiency of IT delivery, but they do not capture the strategic alignment of IT with business. The risk register is a document that records and tracks the identified risks, their causes, impacts, probabilities, responses, owners, and statuses. The risk register can help to document and communicate IT risks, but it does not measure or report the alignment of IT strategy with business strategy. References := 1: Balanced Scorecard Basics - Balanced Scorecard Institute12: Aligning Business Strategy with Information Technology Strategy - ISACA23: COBIT 5: A Business Framework for the Governance and Management of Enterprise IT, ISACA, page 314: CGEIT Review Manual 2023, ISACA, page 197. : Key Risk Indicators - ISACA3 : What are IT Services? Definition & Examples - BMC Software4 : Risk Register - ISACA

IT resource planning is the process of identifying, allocating, and managing the IT resources needed to support the enterprise’s objectives and strategies. The primary objective of IT resource planning should be to maximize the value received from IT, which means ensuring that the IT resources are aligned with the business needs, optimized for efficiency and effectiveness, and delivering the expected benefits and outcomes. IT resource planning should also consider the risks, costs, and opportunities associated with IT resources, as well as the service level agreements (SLAs) and outsourcing options that may affect the quality and availability of IT services. References: CGEIT Exam Content Outline | ISACA1, CGEIT Review Manual (Digital Version), What are the Objectives of Resource Management? | Kantata2, What Is Resource Planning: A Comprehensive Guide3

Risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite of the enterprise should be the primary consideration when developing a risk management policy for a portfolio of IT-enabled investments, because it helps to align the risk management strategy with the business strategy and goals. Risk appetite also helps to define the risk tolerance and thresholds for each investment, and to prioritize and allocate resources accordingly. Risk appetite also helps to communicate the expectations and responsibilities of the stakeholders involved in the risk management process, and to foster a risk-aware culture within the organization. References := CGEIT Review Manual, Chapter 4: Risk Optimization, Section 4.1: IT Risk Management Strategy, Subsection 4.1.1: Establishing IT Risk Appetite, Page 139.

The IT investment process is a systematic approach to selecting, managing, and evaluating information technology investments that align with the enterprise’s strategic goals and objectives. The first step in the IT investment process is to select IT projects that will best support the enterprise’s mission, vision, and values. This involves identifying the business needs, problems, or opportunities that IT can address, and prioritizing them based on their alignment with the enterprise’s strategy, performance, and risk management. This step also involves defining the scope, objectives, and expected outcomes of each IT project, and establishing criteria for measuring its success and value. Selecting IT projects that will best support the enterprise’s mission helps ensure that IT investments are relevant, effective, and efficient for the enterprise.

Data classification is a process of organizing and categorizing data based on its characteristics, confidentiality, and sensitivity. Data classification helps to determine the level of access and protection that data requires. Data classification also makes data easier to understand, compare, and analyze. Data classification is an essential part of information security, as it helps to align the security measures and policies with the data’s value and risk. By incorporating data classification into the information architecture, the IT processes can ensure that information security requirements are taken into consideration from the design stage to the implementation stage. References :=

What is Data Classification? A Data Classification Definition

What is Sensitive Data? Definition, Examples, and More

The best action to address the situation of the risk committee being overwhelmed by the number of false positives in risk reports is to evaluate key risk indicators (KRIs). KRIs are metrics that measure the likelihood and impact of IT-related risks on the enterprise’s objectives and goals. Evaluating KRIs can help the risk committee to identify and prioritize the most significant and relevant risks, as well as to adjust the thresholds or values that trigger the risk alerts or warnings. Evaluating KRIs can also help reduce the number of false positives, which are the cases where the risk reports indicate a high level of risk, but the actual risk is low or negligible. Reducing false positives can help improve the accuracy and reliability of risk reports, as well as save time and resources for the risk committee.

Conducting a risk assessment, changing the reporting format, and adjusting the IT balanced scorecard are also possible actions to take to address the situation of the risk committee being overwhelmed by false positives, but they are not the best action. Conducting a risk assessment is a process that involves identifying, analyzing, evaluating, and treating the IT risks that may affect the enterprise’s objectives and operations. Conducting a risk assessment can help update and validate the risk information and data, as well as implement appropriate controls and mitigation strategies. However, conducting a risk assessment may not be sufficient or feasible to address the issue of false positives, as it may require a lot of time and effort, and it may not address the root causes of false positives, such as inaccurate or outdated KRIs. Changing the reporting format is a measure that involves modifying or improving the way that risk information and data are presented or communicated in risk reports. Changing the reporting format can help enhance and simplify the readability and usability of risk reports, as well as highlight or emphasize the key points or findings. However, changing the reporting format may not solve the problem of false positives, as it may only affect the appearance or style of risk reports, not their content or quality. Adjusting the IT balanced scorecard is a task that involves revising or updating the metrics that track the performance of IT in relation to the enterprise’s vision, strategy, and goals. Adjusting the IT balanced scorecard can help evaluate and communicate the effectiveness and efficiency of IT operations, services, and projects, as well as their contribution to customer satisfaction, business value, and innovation. However, adjusting the IT balancedscorecard may not directly address the issue of false positives, as it may focus on different aspects or dimensions of IT performance than KRIs.

This is because social media can offer many advantages for an enterprise, such as enhancing customer engagement, increasing brand awareness, improving market intelligence, and fostering innovation. However, social media also poses many challenges and threats, such as data breaches, privacy violations, reputational damage, legal liabilities, and compliance issues. Therefore, an enterprise needs to balance the business benefits and risk of using social media in the workplace, and establish a clear and consistent social media policy and governance framework that defines the objectives, roles, responsibilities, standards, and processes for managing social media activities and data.

Some of the sources that support this answer are:

1: This source provides a comprehensive guide on how to create a social media governance plan that covers the key elements of a social media policy, compliance management, security and risk mitigation, decision-making and approval workflow, and crisis management.

2: This source discusses the gaps, risks, and opportunities of social media governance in the context of Australian public communication. It identifies some of the best practices and recommendations for developing and implementing a social media strategy that aligns with the organizational goals and values, as well as the legal and ethical obligations.

3: This source explores the social media governance challenges and solutions for financial services companies. It highlights the importance of balancing the business benefits and risk of social media, and suggests some of the key steps to achieve effective social media governance, such as conducting a risk assessment, defining a social media policy, establishing a governance structure, monitoring and measuring performance, and reviewing and updating the strategy.

 As this is the first step to understand the scope, objectives, and expectations of the new direction, as well as to align the IT project portfolio with the business needs and priorities. Asking business stakeholders to discuss their vision can also help identify and address any gaps or issues in the current IT project portfolio, as well as to communicate and collaborate effectively with the business units.

Canceling projects with a net present value (NPV) below a defined threshold, conducting a risk assessment against the potential new services, and starting re-allocating budget to projects involving mobile or cloud are possible actions to take after asking business stakeholders to discuss their vision, but they are not the first step. Canceling projects with a low NPV may help free up some funds for the new direction, but it may also affect the existing or planned benefits or outcomes of those projects. Conducting a risk assessment can help evaluate the feasibility and impact of the new services, as well as identify and mitigate any threats or uncertainties. Starting re-allocating budget can help support and enable the new services, but it may also disrupt or compromise the current or ongoing projects. These actions should be based on a clear and shared understanding of the new strategy and its implications for the IT project portfolio.