How hard is the CGEIT exam? Hard in a way that has little to do with how much material there is. The four domains are not enormous, nothing asks you to configure anything, and the vocabulary is familiar to anyone who has sat through a steering committee meeting. The difficulty is abstraction. Most items describe a plausible enterprise situation and then offer several actions a competent professional could defend out loud, and only one earns the point.
You will not find a pass rate here. ISACA does not publish them for CGEIT, so every percentage circulating online came from somebody with no access to the data. What follows is the knowable part: the clock, what a 450 scaled score does and does not mean, where the questions sit, and the errors that reliably cost experienced governance people marks.
What does the CGEIT exam actually ask of you?
150 multiple-choice questions in 4 hours. Do the division and you get 96 seconds an item, which sounds comfortable until you meet the stems.
A CGEIT stem is a short scenario with three moving parts: an enterprise situation, a trigger such as an audit finding or a missed target, and an actor being asked to act. Most candidates read one twice, once for the situation and once to work out who the question is really about. Two passes plus four options that all sound sensible is not a leisurely 96 seconds. Nobody writes anything on this exam and the clock is still tight.
Stems almost always carry a qualifier: BEST, MOST, FIRST, or GREATEST. Those words are the exam telling you in advance that more than one option is defensible and that it is grading your ranking rather than your recall.
What does a 450 scaled pass mark actually mean?
Your result arrives as a scaled score between 200 and 800, and 450 passes. The scaling is the part readers get wrong more often than anything else on this exam.
450 is not a percentage, and dividing it by 800 does not produce one. ISACA converts your raw count of correct answers into a scaled value so results stay comparable across exam forms of unequal difficulty. A harder form and an easier form both pass at 450, the raw count behind that 450 differs, and the conversion is not published. Advice telling you to hit a particular percentage on practice tests is arithmetic performed on a number that was never arithmetic.
So you cannot work out in advance how many questions you can afford to miss, which makes the sane target comfortable rather than borderline. And domain-level results are informational only: the score is total items correct regardless of domain. One number, whole paper.
Where are the CGEIT questions concentrated?
Unevenly, which is worth knowing before you plan anything. Governance of Enterprise IT carries 40% of the paper, Benefits Realization 26%, Risk Optimization 19%, and IT Resources 15%. Those weights are ISACA's and they are exact.
Applied to 150 questions, the first two account for roughly 99 items between them and IT Resources for about 23. That arithmetic is ours rather than a per-domain count ISACA publishes, so it is good for planning hours and useless for predicting your form. What it tells you is where the difficulty is worth meeting: two domains decide two thirds of your result, and the smallest one is where candidates who enjoy operational detail overspend.
The CGEIT domains explained breaks down what sits inside each one. The weights come from the outline effective 2020, so confirm them on ISACA's CGEIT Exam Content Outline page before scheduling around them.
Why do so many CGEIT questions have two defensible answers?
Because the exam seats you somewhere specific and then offers you the chair you actually sit in at work.
CGEIT puts you at board or governance-committee level, a seat with authority over direction rather than execution. Governance evaluates, directs, and monitors, the pattern COBIT 2019 and ISO/IEC 38500 both label Evaluate, Direct, Monitor. Management plans, builds, runs, and assesses. The whole exam turns on which side of that line an action belongs to.
So a stem tells you an IT strategic plan is out of step with enterprise objectives. One option has the IT steering committee revise the plan; another has the governance body evaluate the misalignment and direct management to revise it. The second is keyed, because the governance body does not do the planning. It sets direction and holds someone accountable.
That is the distractor pattern, three management-level solutions and one governance-level direction. Candidates with deep operational experience pick the option matching what they would do on Monday morning, which is exactly what the item was built to detect.
Which CGEIT mistakes actually cost people points?
Five come up often enough to name, all variations on one habit: answering from the operating seat instead of the governing one.
Answering as the manager who does the work. The parent error, described above. When you feel certain because of your operational experience, check whether the option is a governance direction or a management execution.
Reaching for a specific control or tool when the question wants structure, accountability, or a repeatable process. FIRST questions almost never point at a control. They point at establishing a framework element, assigning accountability, or getting the information the governance body needs to decide.
Confusing the IT steering committee's management role with the board's governance accountability, or a policy with a standard or a procedure. The steering committee prioritizes projects and allocates resources within direction already set, which makes it a management body. A policy is a board-level statement of direction, a standard the mandatory requirement implementing it, a procedure the instruction for carrying the standard out. Give the board accountability for a procedure and you have answered at the wrong altitude.
Treating an SLA as though it transferred accountability to the vendor. An SLA documents what a provider committed to do and gives you a remedy when they fall short. The enterprise stays accountable to its regulators and stakeholders for every function it has outsourced. SLA data is a governance indicator, not a governance shield.
Reporting raw metrics to the board instead of decision-ready information. An availability figure of 99.4% tells a board nothing on its own. The target was 99.9%, the shortfall hit a revenue-generating customer service, and management proposes a specific remediation: that a board can act on. Offered a detailed IT metrics dashboard or an exception-driven strategic scorecard, take the scorecard.
Each of those decides real items, which is easier to see worked through than described. The CGEIT practice question walkthrough takes them one at a time.
Who finds the CGEIT hardest?
This runs against what most people assume before they book. The candidate who struggles most is usually the technically strong one with no board exposure. Deep architecture, security, or delivery experience is not much use here, and worse, it pulls toward the wrong option, because the manager's answer is always on the screen and always looks competent. The less technical candidate who has spent two years taking minutes in governance meetings, watching a committee push a business case back for lacking measurable benefits, finds the keyed answers land where their instincts already are.
None of which argues for skipping the technical domains, only for where your study time earns most. If you have never watched a governance body work, what you need is the decision logic: who acts, at what level, in what order.
None of it gates your registration. The five-year governance experience rule applies to certification, so you can sit while the years accrue; the CGEIT experience requirements covers what must be true before you apply.
How much COBIT do you actually need to know?
Enough to reason with it, not enough to recite it: the governance and management split cold, EDM against APO, BAI, DSS and MEA, the 40 objectives at the level of what they are for, the governance system and framework principles, and the 11 design factors, with ISO/IEC 38500's Evaluate, Direct, Monitor model underneath.
What the exam does not reward is treating COBIT as a checklist. Scenarios regularly describe an enterprise that adopted all 40 objectives and still has governance failures, and the cause traces to a generic template applied without running the design factors.
How should you prepare for the hard parts?
Match the preparation to the difficulty rather than the page count: Domain 1 and Domain 3 first, and resist Domain 2 because it reads more easily. The 12-week CGEIT study plan turns those percentages into weeks.
Then drill explained questions in volume, because installing the ranking habit is the only route past the two-answer problem. Reading about the governance-versus-management line is not the same as having it fire automatically at 96 seconds an item. Our CGEIT study guide is built for that, pairing coverage of the four domains at their real weights with a full-length 150-question practice exam that explains every option.
Sit at least one full timed run first, preferably two. Four hours of continuous ranking judgment tires you faster than four hours of recall, and a retake costs the full USD 575 or USD 760 again. The CGEIT exam costs and fees has the rest.
So how hard is the CGEIT exam, really?
Hard in a narrow, learnable way. The format is as forgiving as multiple choice gets, the blueprint is published, and the content is within reach of anyone already working near an IT governance function. The difficulty is one habit: answering as the body that evaluates, directs, and monitors rather than as the person who would fix the problem. Retrain that, put your hours where the items are, and what remains is judgment you have been exercising in meetings for years. For the map before the difficulty, start with what the CGEIT certification is.
FAQ
What is the CGEIT pass rate?
ISACA does not publish pass rates for CGEIT, so any figure quoted online is unofficial and traceable to nobody in particular. Judge readiness against the published facts instead: four domains weighted 40/15/26/19, 150 questions in 4 hours, and a 450 scaled pass mark on a 200 to 800 scale.
Can you convert a CGEIT scaled score of 450 into a percentage?
No, and you should not try. A scaled score is a converted value rather than a raw percentage of items correct, so 450 out of 800 does not translate into a share of the paper. ISACA scales results to keep exam forms comparable, so the raw count behind a 450 is neither fixed nor published. Do not set a percentage target for practice exams.
Which CGEIT domain is the hardest?
Domain 1, Governance of Enterprise IT, causes the most trouble: it is 40% of the exam and it is where the governance-versus-management distinction is tested most sharply. Domain 3 at 26% is the second heaviest, and the place where candidates confuse a projected business case with a measured outcome.
Do I need a technical background to pass the CGEIT?
No, and a strong one can work against you. CGEIT does not test firewall configuration, cloud architecture, or incident response. It tests whether you can step above operations and make governance decisions, so candidates from audit, risk, and executive backgrounds often find the lens already matches theirs while technical candidates unlearn the pull toward the operational answer.
How long is the CGEIT exam and how many questions?
150 multiple-choice questions in 4 hours, or 96 seconds per item on an even split. Scenario stems usually need reading twice, so bank time on the items you know cold rather than assuming the budget is generous.
Looking for a plain-English CGEIT guide? ISACA CGEIT: Simply Certified Study Guide covers all four domains at their 40/15/26/19 weights, with a full-length 150-question practice exam, every answer explained.
Simply Certified is an independent publisher. CGEIT and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.