From a governance perspective, the PRIMARY goal of an IT risk optimization process should be to ensure:
Answer(s): D
The primary goal of an IT risk optimization process from a governance perspective is to ensure that the impact of IT risk to the enterprise is managed in alignment with the enterprise risk management (ERM) framework and the enterprise objectives. IT risk optimization is not only about defining thresholds, approving strategies or mapping metrics, but about ensuring that IT risk is effectively mitigated, monitored and communicated to support the achievement of enterprise goals. Reference := CGEIT Exam Content Outline, Domain 4: Risk Optimization1; Certified in Governance of Enterprise IT (CGEIT) Course, Learning Tree2
Which of the following is the BEST way to ensure new systems can be adequately supported once in production?
The best way to ensure new systems can be adequately supported once in production is to require operational management be identified in the business case. This means that the business case should include the costs, benefits, risks and resources associated with the operation and maintenance of the new system, as well as the roles and responsibilities of the operational staff. By doing so, the business case can ensure that the new system is aligned with the business objectives and can deliver value to the stakeholders. Additionally, the business case can help to secure the commitment and support of the operational management for the new system. Reference := CGEIT Exam Content Outline, Domain 3: Benefits Realization1; COBIT 5: Enabling Processes, chapter 4, section 4.2.22; Building A Governance System: A Review of Information Flow and Items Component
To benefit from economies of scale, a CIO is deciding whether to outsource some IT services. Which of the following would be the MOST important consideration during the decision-making process?
Answer(s): B
The most important consideration during the decision-making process of outsourcing some IT services is to identify the core IT processes that are critical for the organization’s strategic objectives and competitive advantage. Core IT processes are those that provide unique value to the organization and differentiate it from its competitors. Outsourcing core IT processes may result in loss of control, innovation, and differentiation, as well as increased dependency and risk. Therefore, core IT processes should be retained in-house, while non-core IT processes can be outsourced to benefit from economies of scale, cost reduction, and access to specialized skills and technologies. Reference := CGEIT Exam Content Outline, Domain 3: Benefits Realization1; COBIT 5: Enabling Processes, chapter 4, section 4.2.32; IT governance -managing the outsourcing relationship
The board and senior management of a new enterprise recently met to formalize an IT governance framework. The board of directors' FIRST step in implementing IT governance is to ensure that:
Answer(s): C
The first step in implementing IT governance is to ensure that IT roles and responsibilities are established. This means that the board of directors should define the authority, accountability, and decision rights of the key stakeholders involved in IT governance, such as the board itself, senior management, business units, IT function, and external parties. By doing so, the board can ensure that IT governance is aligned with the enterprise governance and strategy, and that IT performance and value delivery are monitored and evaluated. Establishing IT roles and responsibilities is also a prerequisite for defining IT policies and procedures, developing a portfolio of IT-enabled investments, and implementing an IT balanced scorecard. Reference := CGEIT Exam Content Outline, Domain 1: Framework for the Governance of Enterprise IT1; COBIT 5: Enabling Processes, chapter 4, section 4.1.12; Improve IT Governance to Drive Business Results
An IT risk assessment for a large healthcare group revealed an increased risk of unauthorized disclosure of information. Which of the following should be established FIRST to address the risk?
The first step to address the risk of unauthorized disclosure of information is to establish a data classification policy. A data classification policy defines the categories of data based on their sensitivity and value to the organization, and specifies the appropriate security controls and handling procedures for each category. A data classification policy helps to identify the most critical and confidential data, and to prioritize the protection of such data from unauthorized access, disclosure, modification, or loss. A data classification policy also provides a basis for implementing other measures, such as data encryption tools, data loss prevention tools, and data retention policy, to enhance the security of data. Reference := Reducing Cybersecurity Security Risk From and to Third Parties; Unauthorized Access: Prevention Best Practices; Security of Enterprise Application Integration
Which of the following should be the MAIN governance focus when implementing a newly approved bring your own device (BYOD) policy?
The main governance focus when implementing a newly approved BYOD policy is to educate employees on the increased IT security risk to the enterprise. BYOD introduces various challenges and threats to the enterprise’s data and network security, such as device loss or theft, unauthorized access, malware infection, data leakage, and compliance violations. Therefore, it is essential to raise the awareness and understanding of employees on the potential risks and their responsibilities in protecting the enterprise’s assets and information. Educating employees on the IT security risk can also help to foster a culture of security and compliance, and to promote best practices for BYOD usage, such as following the acceptable use policy, installing security software, and reporting incidents. Reference := The Ultimate Guide to BYOD Security: Definition & More -Digital Guardian; Enterprise mobility and security: How to build a BYOD policy; Bring Your Own Device for Executives | Cyber.gov.au
An audit report has revealed that data scientists are analyzing sensitive "big data" files using an offsite cloud because corporate servers do not have the necessary processing capabilities. A review of policies indicates this practice is not prohibited. Which of the following should be the FIRSTstrategic action to address the report?
Answer(s): A
The first strategic action to address the report is to authorize a risk analysis of the practice. A risk analysis is a systematic process of identifying, assessing, and prioritizing the potential threats and vulnerabilities that may arise from the use of an offsite cloud for analyzing sensitive “big data” files. A risk analysis can help to determine the level of exposure and impact of the practice on the organization’s data security, privacy, compliance, and performance. A risk analysis can also provide recommendations for mitigating or avoiding the risks, such as implementing appropriate controls, policies, and procedures.Updating data governance practices, revising the information security policy, and recommending the use of a private cloud are possible actions that may result from the risk analysis, but they are not the first step. Data governance practices are the rules and processes that define how data is created, stored, accessed, used, and disposed of within an organization. Data governance practices should align with the organization’s data strategy, objectives, and values. Information security policy is a document that outlines the principles, guidelines, and responsibilities for protecting the confidentiality, integrity, and availability of data. Information security policy should reflect the organization’s risk appetite, legal obligations, and industry standards. A private cloud is a cloud computing model that provides dedicated resources and services to a single organization. A private cloud may offer more control, security, and customization than an offsite cloud, but it may also require more investment, maintenance, and expertise.Therefore, before updating data governance practices, revising the information security policy, or recommending the use of a private cloud, it is important to conduct a risk analysis of the current practice of using an offsite cloud for analyzing sensitive “big data” files. This will help to ensure that the organization makes informed and strategic decisions that balance the benefits and risks of using cloud computing for big data analytics.
Which of the following BEST lowers costs and improves scalability from an IT enterprise architecture (EA) perspective?
Standardization is the best option to lower costs and improve scalability from an IT enterprise architecture perspective, because it reduces complexity, increases interoperability, and enables reuse of IT resources. Reference:= ISACA, CGEIT Review Manual, 27th Edition, 2019, page 79.
Share your comments for ISACA CGEIT exam with other users:
please i need this dump. thanks
i have to take the aws certified developer - associate dva-c02 in the next few weeks and i wanted to know if the questions on your website are the same as the official exam.
all questions are more important
ques 4 answer should be c ie automatically recover from failure
very very useful page
the exams are giving me an eye opener
3rd so far, need to cover more
aligns with the pecd notes
question 4: b securityadmin is the correct answer. https://docs.snowflake.com/en/user-guide/security-access-control-overview#access-control-framework
kindly please share dumps
it is very useful, thank you
need safe rte dumps
can you upload the cis - cpg dumps
q6 = 1. download odt application 2. create a configuration file (xml) 3. setup.exe /download to download the installation files 4. setup.exe /configure to deploy the application
great material
could you please upload sap c_arsor_2302 questions? it will be very much helpful.
vraag 20c: rsa veilig voor symmtrische cryptografie? antwoord c is toch fout. rsa is voor asymmetrische cryptogafie??
so far good
question 31 has obviously wrong answers. tls and ssl are used to encrypt data at transit, not at rest.
pls provide dump for 1z0-1080-23 planning exams
could you please upload the exam?
please upload this
good material
lets see if this is good stuff...
useful information
intéressant
thank you for making the interactive questions
questions are accurate
i need questions/dumps for this exam.
i need this exam, when will it be uploaded
i need the dumps !
very helpful
good source
my 3rd test and passed on first try. hats off to this brain dumps site.