Five CGEIT practice questions follow, drawn from our own bank and worked through in full: the credited answer, why it wins, and why the strongest wrong option loses. Two come from Domain 1 at 40% of the exam, one from Domain 3 at 26%, and one each from Domains 2 and 4.
On a CGEIT item, two or three options are usually things a competent professional might genuinely do, so crossing options off gets you almost nowhere. What the exam grades is which defensible action comes first, and whose job it is to take it. That is why five questions taken apart properly beat fifty answered and forgotten. For the format itself, our overview of the CGEIT certification covers the 150 questions in 4 hours and the 200 to 800 scaled score with 450 to pass.
How to read a CGEIT question before you answer it
Two habits do most of the work on this exam.
First, find the qualifier. FIRST, BEST, MOST important, PRIMARY, GREATEST. That word is the actual question. A FIRST item asks about sequence, not the eventual fix, and those are almost never the same option.
Second, decide whose chair you are sitting in. COBIT 2019 splits governance from management, and ISO/IEC 38500 gives governance its verbs: a governance body evaluates the situation, directs someone to act, and monitors the result. Management plans, builds and runs the work itself. Most wrong answers on the CGEIT are the right action taken by the wrong role, or the right action taken two steps too early.
Try each question before you read the walkthrough.
Question 1, Domain 1: the board's first move on a failing investment
A strategic IT-enabled investment is failing because of technology problems nobody anticipated. What should be the board of directors' FIRST course of action?
A. Terminate the investment and redirect the funding.
B. Assess the business risk and the available options.
C. Approve a budget increase so the technical problems can be resolved.
D. Revise the enterprise's investment selection process.
Answer: B.
The board cannot direct anything until it knows what it is looking at: how bad the technology problems are, what the business is exposed to now, what recovery would cost, and which options exist. Evaluate, then direct. FIRST puts you at the front of that sequence.
A is the option most people put second, and it is attractive because it looks like decisive leadership. Boards do kill failing investments, and killing this one may well be the right call. It is not the first call. Terminating before the options are assessed throws away value that might be recoverable and leaves the board unable to justify the decision. Option C is the same error with the opposite sign: more money for a problem nobody has sized. Option D is the trap worth naming: revising the selection process is good governance and does nothing about the investment currently on fire. It fixes next year's decisions while this one keeps burning.
This is trap one in its purest form. The manager asks what to do about the problem. The governance body asks what it knows, what it must decide, and what it will direct someone else to do.
Question 2, Domain 1: what should a steering committee actually direct?
An IT steering committee receives an audit finding that new software applications are delivered on schedule but consistently reach production with unacceptable defect levels. Which of the following would be the BEST direction from the committee?
A. Require key performance indicators for defect rates.
B. Evaluate the change management process.
C. Establish mandatory code peer reviews in development.
D. Evaluate the quality assurance process.
Answer: D.
Defects reaching production in a consistent pattern is a quality assurance failure by definition, because QA exists to catch them before release. So the committee directs an evaluation of that process, which then tells you whether the cause is coverage, timing, resourcing, or a schedule that treats testing as the compressible part.
C is the one that catches good candidates, and it fails on altitude rather than merit. Code peer reviews are good practice and may well be part of the answer once QA has been evaluated. Picking them now means choosing one specific control, before diagnosis, over the process that should have surfaced which control was missing. That is trap two: preferring a named tool to a repeatable process. Option A measures the problem without changing it. Option B lands on the wrong process, since change management governs how releases reach production, not how defects get into the build.
Note the distinction hiding here. A steering committee sits on the management side of the COBIT 2019 line, so directing an evaluation of a delivery process is squarely its job. A board would not touch a QA process at all. It would ask why software quality keeps reaching the risk report and whether accountability for it is clear. Mixing those two seats up is trap three, and board, IT strategy committee, IT steering committee and CIO all answer the same situation differently. The four CGEIT domains explained shows where each sits.
Question 3, Domain 3: who is accountable for the benefits?
Who is PRIMARILY accountable for delivering the benefits of an IT-enabled investment program to the enterprise?
A. The program manager
B. The chair of the IT steering committee
C. The chief information officer
D. The business sponsor
Answer: D.
IT-enabled benefits are business results. Nobody in IT can produce them, because they arrive only when a business process changes, headcount is redeployed, or a cost line actually falls. The business sponsor has the authority to make those changes happen and answers to executive management for the return.
Most of the wrong answers here land on C, the CIO, and it is experienced people who pick it. The CIO owns the IT contribution, the platform, the delivery capability and often the budget line. Owning the largest share of the work is not the same as owning the outcome, and CGEIT is consistent here: accountability follows the value, not the effort. Option A is a delivery role, accountable for scope, schedule and cost. Option B is oversight, which reviews and challenges without carrying the outcome.
A large share of Domain 1 and Domain 3, two thirds of your paper between them, comes down to naming the accountable party. The sponsor owns the benefit, the program manager owns delivery, the committee oversees, the board answers to stakeholders.
Question 4, Domain 2: the vendor met every SLA and the business still lost
An IT department outsourced application support and negotiated the service level agreements directly with the vendor. The vendor met every SLA, but business owners said their expectations were not met and senior management cancelled the contract. This situation can BEST be avoided in future by:
A. improving the business requirements gathering process.
B. improving the way service level agreements are negotiated.
C. implementing a vendor performance scorecard.
D. assigning formal responsibility for vendor management.
Answer: A.
Read the stem again. The vendor performed, and every target was met, so the failure cannot sit in vendor performance or vendor monitoring. Any option pointing there answers a closed question. What failed was upstream: the targets were written by IT without the business owners in the room, so they measured the wrong things well.
B, improving SLA negotiation, is close enough to be arguable. Better negotiation produces a better contract, but it still starts from whatever requirements it is handed, so the same misunderstanding yields a more precisely wrong SLA. Fix the input first. Option C adds reporting on metrics that were already green. Option D adds an owner for a relationship already being managed to target.
This is trap four, the most expensive assumption in Domain 2. An SLA moves the activity to the vendor and leaves the accountability exactly where it was. Outsource the help desk, application support, even the project management office, and the enterprise still answers for the outcome and the compliance position.
Question 5, Domain 4: what the board needs with a KRI
When reporting key risk indicators to the board, which information BEST enables risk-based decision-making?
A. The readings presented against risk appetite, thresholds and tolerance
B. A classification of current business risk
C. Emerging industry risk trends and benchmarks
D. The costs and resources needed for the mitigation options
Answer: A.
A KRI reading on its own is a number with no verdict attached. Failed logins are up 40%. Is that fine, or is the board already late? Only appetite, threshold and tolerance answer that, and with them on the page every director can see which indicators need a decision.
The runner-up is D, cost and resources, which feels board-appropriate because boards approve spending. It arrives one step early. Cost data answers how to respond once somebody has established that a response is needed, and putting it first invites the board to pick the cheapest answer to a question it has not asked. Option B is a snapshot with no boundary against it. Option C helps calibrate appetite in a strategy session and says nothing about your position now.
Trap five, then: reporting raw metrics rather than decision-ready information. It runs across Domains 3 and 4, in balanced scorecard items and anywhere a stem asks what the board should receive.
The five traps, in one place
Every miss above belongs to one of five recurring errors.
Answering as the manager doing the work rather than the governance body that evaluates, directs and monitors.
Choosing a specific control, tool or project over structure, accountability or a repeatable process.
Confusing the IT steering committee's management role with the board's governance accountability.
Assuming a service level agreement moves accountability to the vendor.
Reporting raw metrics rather than decision-ready information.
When you miss an item, tag it with the trap rather than the domain. After thirty questions that tally tells you what to re-read, which a percentage score never does. Our honest look at CGEIT difficulty covers why the exam is built to punish these five.
How to review a CGEIT practice question properly
Marking an item wrong and moving on wastes most of a question bank. Three minutes of review is enough, and it goes like this.
Say which role the stem named, then which role your answer belonged to. Board, IT strategy committee, IT steering committee, CIO, process owner, sponsor. If those two do not match, that is your entire error and you can stop there.
Otherwise, write one sentence on why your own option lost, which is the half no answer key gives you. Nodding along with an explanation is not learning. And on a FIRST item, check the sequence: the answer is almost always the earliest step nobody has taken, which on this exam is usually an assessment rather than a fix.
How many CGEIT practice questions is enough?
ISACA releases no CGEIT pass rates, so treat any figure quoted online as invention. Candidates who felt ready tend to share two things: a few hundred items worked with real review, and at least one full-length 150-question run under the clock.
The timed run matters for its own reason. Four hours across 150 questions is 96 seconds an item, and sustained judgment tires you faster than recall does. Find out what your accuracy looks like in hour four while the lesson is still free, because a second sitting is US$575 as an ISACA member or US$760 as a nonmember.
Volume installs the rules, and it has to be explained volume. The ISACA CGEIT Study Guide pairs plain-English coverage of all four domains at their 40/15/26/19 weights with a full-length 150-question practice exam, every answer explained the way the five above are. Our 12-week CGEIT study plan says where that exam belongs in your schedule.
FAQ
How many CGEIT practice questions should I do before the exam?
Most candidates who feel prepared have worked several hundred items with full review, plus at least one timed 150-question run. The count matters less than the habit: for every miss, be able to state why the credited answer wins and why yours loses. ISACA publishes no CGEIT pass rate, so your own review log is a better readiness signal than any percentage quoted online.
Why do so many CGEIT questions seem to have two right answers?
Because they often do, in the sense that two options are both actions a competent professional might take. The exam asks which one comes first, or which one a governance body takes rather than a manager. The ranking follows a small set of repeating rules about sequence and about who owns the decision, and once you can name the rule an item is testing, the two-answer feeling fades on most of them.
Do I need to know COBIT 2019 to answer CGEIT practice questions?
Yes, as a way of thinking more than as a set of definitions to recite. The governance and management split, the EDM domain against APO, BAI, DSS and MEA, and the design factors behind a tailored governance system all shape how the credited answers are chosen. ISO/IEC 38500's evaluate, direct and monitor model is the other half of that vocabulary.
Should I practice by domain or with full-length exams?
Both, in that order. Domain practice while you study shows which of the five traps keeps catching you and confirms the material is landing. A full-length timed exam belongs in your final weeks, where it builds pacing for 150 questions in 4 hours and shows how your judgment holds up late in a long sitting.
Do practice questions help with the CGEIT experience requirement?
No. They prepare you for the exam only. Certification also requires five or more years of experience supporting the governance of enterprise IT, spanning at least three of the four domains with a minimum of one year in Domain 1. Our post on the CGEIT requirements covers how that is documented and when to apply.
Looking for a plain-English CGEIT guide? ISACA CGEIT: Simply Certified Study Guide covers all four domains at their 40/15/26/19 weights, with a full-length 150-question practice exam, every answer explained.
Simply Certified is an independent publisher. CGEIT and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.