I85PREP
⌘ K
CGIC study materials
CGIC study resources

CGIC practice questions

One question at a time. Build your CGIC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance

Which document establishes the authority, scope, and responsibilities of an organization's internal audit function?

  1. The vendor risk register
  2. The employee handbook
  3. The annual financial report
  4. The internal audit charter Correct answer.

Explanation

The internal audit charter is the formal document approved by the board or audit committee that defines the audit function's purpose, authority, and responsibilities. It provides the mandate for audit activity and independence.

Question 2Governance

Segregation of duties is primarily a control designed to address which risk?

  1. Errors or fraud from one person controlling a transaction end to end Correct answer.
  2. Unauthorized access to physical facilities
  3. Loss of data during a system migration
  4. Inadequate backup power for data centers

Explanation

Segregation of duties divides responsibilities so no single individual can initiate, authorize, record, and reconcile a transaction. This reduces the chance that errors or fraud go undetected.

Question 3Governance

A board committee composed solely of independent directors that oversees the audit function and financial reporting is best described as which of the following?

  1. The audit committee Correct answer.
  2. The compliance help desk
  3. The risk owners group
  4. The executive management team

Explanation

An audit committee is a board-level committee of independent directors responsible for oversight of financial reporting, internal controls, and the internal and external audit relationship. Independence from management is a defining feature.

Question 4Governance

Which of the following best describes the 'three lines model' in governance?

  1. A framework for classifying data by sensitivity
  2. A technique for testing backup restores
  3. A structure separating management, risk oversight functions, and internal audit Correct answer.
  4. A method for ranking IT incidents by severity

Explanation

The three lines model distinguishes operational management (first line), independent risk and compliance functions (second line), and internal audit (third line). This separation supports clear accountability and independent assurance.

Question 5Governance

Which of the following is the primary purpose of a governance risk and compliance (GRC) framework?

  1. To integrate risk, compliance, and control activities across the organization Correct answer.
  2. To replace the need for internal audit
  3. To guarantee that no security incidents occur
  4. To eliminate the need for regulatory reporting

Explanation

A GRC framework aligns risk management, compliance, and control activities so they are coordinated and reported consistently. It supports decision-making but does not remove the need for audit or guarantee outcomes.

Question 6Governance

A control that is performed only when a specific condition arises, rather than continuously, is classified as which type of control?

  1. Trigger-based Correct answer.
  2. Detective
  3. Automated
  4. Preventive

Explanation

Trigger-based controls execute in response to a defined event or condition, such as a failed login or a threshold breach. They differ from controls that run continuously or on a fixed schedule.

Question 7Governance

Which of the following is an example of a key performance indicator (KPI) in a security governance program?

  1. Percentage of critical patches applied within the defined window Correct answer.
  2. Number of employees in the finance department
  3. Total square footage of office space
  4. Average length of customer support calls

Explanation

A KPI measures how well an activity is performing against a target, such as patch timeliness. Governance programs use KPIs to track operational effectiveness of controls.

Question 8Governance

Which of the following best describes the concept of 'tone at the top'?

  1. The ethical and risk-aware culture set by senior leadership Correct answer.
  2. The volume of executive communications during an incident
  3. The frequency of board meetings
  4. The technical configuration of the firewall

Explanation

Tone at the top refers to the values, ethics, and risk attitude demonstrated by senior leadership, which shape organizational culture. It influences how seriously controls and policies are followed throughout the organization.

Question 9Governance

An organization's risk appetite statement should primarily do which of the following?

  1. Specify the exact firewall rules to be deployed
  2. Name the individuals responsible for incident response
  3. List every possible threat to the organization
  4. Define the amount and type of risk the organization is willing to accept Correct answer.

Explanation

A risk appetite statement expresses the level and nature of risk an organization is willing to pursue or retain in pursuit of its objectives. It guides decisions about which risks to accept, mitigate, or avoid.

Question 10Governance

A risk is assessed as having high likelihood and high impact. According to typical risk treatment logic, which response is most appropriate?

  1. Transfer all residual risk to customers
  2. Accept the risk without further action
  3. Ignore the risk until the next annual review
  4. Prioritize mitigation or avoidance of the risk Correct answer.

Explanation

Risks with high likelihood and high impact fall in the highest priority tier and warrant mitigation or avoidance. Acceptance without action is generally reserved for low-rated risks within appetite.

Question 11Governance

Which of the following best characterizes the relationship between policies, standards, and procedures?

  1. Policies are optional, standards are mandatory, and procedures are advisory
  2. Policies describe steps, standards state intent, and procedures are optional
  3. Policies and procedures are identical, while standards are external
  4. Policies state intent, standards specify requirements, and procedures describe steps Correct answer.

Explanation

Policies express management intent and mandatory direction; standards translate policy into specific, measurable requirements; procedures provide step-by-step instructions for execution. Each layer becomes more detailed and operational.

Question 12Governance

An organization discovers a control is operating effectively but is no longer relevant to current business processes. This situation is best described as which of the following?

  1. A material weakness
  2. A control deficiency
  3. A control that should be redesigned or retired Correct answer.
  4. A compensating control failure

Explanation

A control can operate effectively yet be obsolete if the underlying risk or process has changed. Governance requires periodic review to redesign or retire controls that no longer address relevant risks.

Question 13Governance

Which of the following is the most appropriate role for the board of directors regarding enterprise risk?

  1. Writing the organization's technical procedures
  2. Directly administering security tools
  3. Setting risk appetite and overseeing management's risk response Correct answer.
  4. Performing daily risk assessments

Explanation

The board sets the risk appetite and provides oversight of management's risk management activities. It does not perform operational risk work, which is delegated to management.

Question 14Governance

A third-party vendor's risk is being evaluated. Which governance artifact most directly documents the agreed security responsibilities between the organization and the vendor?

  1. The internal audit charter
  2. The incident response runbook
  3. The risk appetite statement
  4. The service level agreement and contract clauses Correct answer.

Explanation

Contracts and service level agreements define the security obligations, service levels, and responsibilities of each party. They are the primary governance mechanism for formalizing vendor accountability.

Question 15Governance

Which of the following best describes a key risk indicator (KRI)?

  1. A count of employees trained on security awareness
  2. A metric that signals increasing exposure to a risk before it materializes Correct answer.
  3. A list of all open audit findings
  4. A financial ratio used in budgeting

Explanation

A KRI is a forward-looking metric that provides early warning of rising risk exposure, such as an increasing number of failed access attempts. It differs from a KPI, which measures performance of an activity.

Question 16Governance

An organization's security policy requires annual review, but the last review was three years ago. From a governance perspective, this most directly represents which issue?

  1. A backup restore failure
  2. A technical vulnerability in the firewall
  3. A policy lifecycle management failure Correct answer.
  4. A network segmentation gap

Explanation

Policies must be reviewed and updated on the defined cycle to remain relevant and to demonstrate governance. Missing the review cycle indicates a failure in policy lifecycle management.

Question 17Governance

Which of the following is the best example of a detective control?

  1. A badge reader that blocks entry to a server room
  2. A policy requiring strong passwords
  3. A firewall rule that denies unauthorized traffic
  4. A monthly reconciliation that identifies discrepancies Correct answer.

Explanation

Detective controls identify problems after they occur, such as reconciliations that reveal discrepancies. Preventive controls, by contrast, aim to stop events before they happen.

Question 18Governance

An organization wants to ensure that a critical control failure is escalated to senior management within a defined time. Which governance mechanism most directly supports this?

  1. A software license inventory
  2. A data classification scheme
  3. An escalation matrix with defined thresholds and timelines Correct answer.
  4. A network diagram

Explanation

An escalation matrix defines who must be notified, at what threshold, and within what timeframe when issues arise. It provides a structured path for timely management awareness.

Question 19Governance

Which of the following best explains why independence is important for the internal audit function?

  1. It permits auditors to set the risk appetite
  2. It reduces the need for documentation
  3. It enables objective and unbiased assurance reporting Correct answer.
  4. It allows auditors to implement the controls they assess

Explanation

Independence allows internal audit to assess controls and report findings objectively without management influence. This objectivity is essential for credible assurance to the board.

Question 20Governance

An organization is deciding whether to accept, mitigate, transfer, or avoid a risk. Which factor is most relevant to choosing 'transfer'?

  1. The risk is entirely within the organization's control
  2. The risk can be shifted to a third party such as an insurer Correct answer.
  3. The risk is already fully mitigated
  4. The risk has no financial consequence

Explanation

Risk transfer shifts the financial consequence of a risk to another party, commonly through insurance or contractual arrangements. It does not eliminate the underlying risk, only its financial impact on the organization.

Question 21Governance

A governance program defines a set of metrics, but leadership never reviews them. What is the most significant consequence?

  1. The metrics become more accurate over time
  2. The controls automatically improve
  3. The program loses its ability to drive decisions and accountability Correct answer.
  4. The audit function is strengthened

Explanation

Metrics only add value when they inform decisions and accountability. Without leadership review, the governance program cannot respond to trends or hold owners accountable.

Question 22Governance

An organization has a low risk appetite for data breaches but a high appetite for innovation speed. How should this tension be reflected in governance?

  1. Apply stricter controls to data protection while allowing faster change processes with appropriate safeguards Correct answer.
  2. Eliminate all change controls to maximize innovation
  3. Freeze all projects until risk appetite is uniform
  4. Accept all data breach risks to speed delivery

Explanation

Risk appetite can vary by risk category, so governance should apply tighter controls where appetite is low and allow greater flexibility where appetite is high, with safeguards. This balances competing objectives.

Question 23Governance

A regulator requires an organization to demonstrate that controls are operating effectively over time. Which governance activity most directly provides this evidence?

  1. An informal team meeting summary
  2. A verbal assurance from a single manager
  3. Continuous control monitoring with retained evidence Correct answer.
  4. A one-time risk assessment performed at project start

Explanation

Continuous control monitoring generates ongoing, retained evidence that controls operate effectively over time, which is what regulators and auditors require. Point-in-time assessments do not demonstrate sustained operation.

Question 24Governance

An organization's board delegates risk oversight to a committee, but the committee lacks the expertise to evaluate technical cyber risk. What is the most appropriate governance response?

  1. Disband the committee and return all oversight to operational staff
  2. Allow the IT department to self-certify all cyber risks
  3. Reduce the scope of oversight to exclude cyber risk
  4. Provide independent expert input and targeted education to the committee Correct answer.

Explanation

Effective oversight requires that the governing body has access to sufficient expertise, often through independent advisors and targeted education. This preserves accountability while closing the knowledge gap.

Question 25Governance

An organization's risk register lists many risks but assigns no owners and no treatment dates. Which governance principle is most clearly violated?

  1. Data minimization
  2. Least privilege for system access
  3. Accountability and ownership of risk Correct answer.
  4. Network segmentation

Explanation

Risk governance requires that each risk has a named owner accountable for treatment and a target date for action. Without ownership and timelines, risks cannot be managed or tracked to closure.

Question 26Governance

Which document typically sits at the highest level of a security governance framework and states management's overall intent and direction for security?

  1. The configuration baseline
  2. The risk register
  3. The incident response plan
  4. The security policy Correct answer.

Explanation

A security policy is a high-level statement of management intent that authorizes and directs the security program. Lower-level artifacts such as standards, baselines, and plans derive their authority from the policy.

Question 27Governance

Which term describes the acceptance of residual risk by a person with the authority to commit resources to address it?

  1. Risk aggregation
  2. Risk avoidance
  3. Risk transfer
  4. Risk ownership Correct answer.

Explanation

Risk ownership means an accountable individual accepts residual risk and has the authority to fund treatment. Ownership cannot be assigned to someone without the means to act on the risk.

Question 28Governance

What is the primary purpose of a security steering committee?

  1. To audit the effectiveness of financial controls
  2. To administer user access requests on a daily basis
  3. To provide cross-functional direction and prioritization for security decisions Correct answer.
  4. To perform penetration testing on critical systems

Explanation

A steering committee brings together senior stakeholders from across the business to set priorities, resolve conflicts, and sponsor security initiatives. It is a decision-making and oversight body rather than an operational one.

Question 29Governance

Which concept holds that individuals should not be able to both commit and conceal an error or fraud within a critical process?

  1. Separation of duties Correct answer.
  2. Least privilege
  3. Need to know
  4. Defense in depth

Explanation

Separation of duties divides critical tasks among different people so that no single person controls an entire transaction. This reduces the chance that errors or fraud go undetected.

Question 30Governance

A security awareness program is best classified as which type of control?

  1. Corrective
  2. Compensating
  3. Detective
  4. Preventive Correct answer.

Explanation

Awareness training aims to stop incidents before they occur by shaping user behavior, which makes it preventive. It does not detect events after the fact or restore systems.

Question 31Governance

Which of the following is the most appropriate basis for determining how often a policy should be reviewed?

  1. The risk level and rate of change of the activity the policy governs Correct answer.
  2. The number of pages in the policy document
  3. The seniority of the person who signed the policy
  4. The vendor that supplied the policy template

Explanation

Review frequency should reflect how quickly the underlying business, technology, and threat environment change, and how much risk is at stake. High-risk or fast-changing areas warrant more frequent review.

Question 32Governance

What does the principle of least privilege require?

  1. Granting users the broadest access possible to avoid support requests
  2. Rotating all administrative passwords every thirty days
  3. Granting users only the access necessary for their assigned tasks Correct answer.
  4. Requiring two approvers for every access request

Explanation

Least privilege limits access rights to the minimum needed to perform assigned duties, reducing the potential impact of misuse or compromise. It is about scope of access, not the mechanics of approval.

Question 33Governance

Which role is typically accountable for the day-to-day operation of security controls within a business unit?

  1. The regulator
  2. The external auditor
  3. The control owner Correct answer.
  4. The board of directors

Explanation

The control owner is the individual accountable for ensuring a control operates as designed on an ongoing basis. Boards provide oversight, while auditors and regulators provide independent assurance.

Question 34Governance

An organization's policy states that all servers must be patched within thirty days of a vendor release, but no standard defines how compliance is measured. What governance gap does this represent?

  1. There is no defined measurement or assurance mechanism Correct answer.
  2. The policy lacks executive sponsorship
  3. The policy is too prescriptive
  4. The patch window is too short

Explanation

A policy without a supporting standard, procedure, and measurement method cannot be reliably enforced or evidenced. Governance requires that requirements be testable and monitored.

Question 35Governance

A security team reports quarterly to the board using a dashboard of control effectiveness measures. What governance function does this primarily serve?

  1. Capacity planning
  2. Operational incident triage
  3. Vulnerability remediation
  4. Oversight and accountability Correct answer.

Explanation

Reporting control effectiveness to the board enables oversight and holds management accountable for the security program. It gives leadership the information needed to govern risk.

Question 36Governance

An organization classifies a risk as outside its risk appetite but continues the activity without any documented decision. Which governance weakness is most evident?

  1. Absence of a formal risk acceptance decision Correct answer.
  2. Insufficient technical controls
  3. Excessive reliance on insurance
  4. Overstaffing of the risk function

Explanation

When a risk exceeds appetite, governance requires a documented, authorized decision to accept, treat, or avoid it. Continuing without such a record leaves accountability undefined.

Question 37Governance

Which approach best ensures that security requirements are built into a new system before it goes live?

  1. Embedding security gates in the system development lifecycle Correct answer.
  2. Conducting a post-incident review after launch
  3. Publishing a security awareness newsletter
  4. Adding security to the annual audit plan

Explanation

Embedding security gates into the development lifecycle catches requirements and design flaws before deployment, when remediation is cheapest. This is a preventive governance mechanism.

Question 38Governance

A company wants to compare its security posture against a recognized external framework to satisfy customer expectations. Which action best supports this?

  1. Purchasing additional endpoint protection licenses
  2. Drafting an internal memo describing security strengths
  3. Performing a gap assessment against the chosen framework Correct answer.
  4. Reducing the number of security policies

Explanation

A gap assessment maps current practices to framework requirements and identifies shortfalls, producing evidence of alignment. It creates a defensible basis for comparison and improvement.

Question 39Governance

Which factor most strongly justifies escalating a risk to executive management rather than treating it at the department level?

  1. The risk exceeds the department's authority or appetite thresholds Correct answer.
  2. The risk has an easily implemented technical fix
  3. The risk was identified by a junior analyst
  4. The risk appears in a widely used risk taxonomy

Explanation

Escalation is warranted when a risk exceeds the decision authority or appetite thresholds of the level at which it was identified. Executives must then decide on acceptance or resourcing.

Question 40Governance

An organization defines security roles but never documents them, relying on informal understanding among staff. What is the most likely governance consequence?

  1. Faster decision-making with no downside
  2. Improved staff morale
  3. Ambiguity about accountability during incidents Correct answer.
  4. Reduced need for security training

Explanation

Undocumented roles create ambiguity about who decides and who acts, which becomes acute during incidents. Documented role definitions make accountability explicit and enforceable.

Question 41Governance

Which statement best describes the purpose of a security charter?

  1. It specifies the encryption algorithms to be used
  2. It formally establishes a function's authority, scope, and reporting lines Correct answer.
  3. It lists the technical vulnerabilities found in the environment
  4. It records employee acceptance of acceptable use terms

Explanation

A charter is a governance document that establishes a function's mandate, authority, scope, and reporting relationships. It legitimizes the function and defines its boundaries.

Question 42Governance

A business unit wants to adopt a cloud service that stores regulated data. Which governance step should occur first?

  1. Disable logging to reduce cost
  2. Sign the contract and migrate data
  3. Assess the risk and required controls against policy Correct answer.
  4. Notify customers after migration

Explanation

Governance requires assessing risk and confirming that required controls meet policy before committing to a service that handles regulated data. This ensures decisions are informed and authorized.

Question 43Governance

Which practice best demonstrates that management is monitoring the security program over time rather than only at a point in time?

  1. Reviewing trended metrics at regular management reviews Correct answer.
  2. Producing a one-time certification report
  3. Publishing the security policy once
  4. Conducting a single annual penetration test

Explanation

Regular review of trended metrics shows continuous monitoring and allows management to detect deterioration and adjust course. Point-in-time artifacts do not demonstrate ongoing oversight.

Question 44Governance

An organization's internal audit team reports to the same executive who owns the security program they audit. What governance concern does this raise?

  1. The audit function's independence is compromised Correct answer.
  2. The audit scope will be too narrow
  3. The audit team may lack technical skills
  4. The security program will be overfunded

Explanation

Independence requires that auditors not report to those whose work they evaluate, since this creates a conflict of interest. Reporting lines should preserve objectivity, often through the audit committee.

Question 45Governance

Which combination of elements most fully defines a measurable security objective?

  1. A statement of management support
  2. A list of technologies to purchase
  3. A specific metric, a target value, and a timeframe Correct answer.
  4. A general aspiration with a target year

Explanation

An objective is measurable when it specifies what is measured, the target to be achieved, and by when. These elements allow progress to be tracked and accountability assigned.

Question 46Governance

An organization has a mature policy set but no mechanism to record exceptions when teams cannot comply. What is the most significant governance risk?

  1. Staff will request too much training
  2. Controls will be over-documented
  3. Policies will be updated too frequently
  4. Noncompliance becomes invisible and unmanaged Correct answer.

Explanation

An exception process makes deviations visible, time-bound, and formally accepted. Without it, noncompliance persists unrecorded and unmanaged, and leadership loses sight of actual risk.

Question 47Governance

A board asks how the organization would know if a critical security control stopped working. Which governance mechanism most directly answers this?

  1. A new vendor contract
  2. An updated organization chart
  3. A revised acceptable use policy
  4. A control testing and assurance schedule Correct answer.

Explanation

A testing and assurance schedule verifies that controls continue to operate as intended and surfaces failures. This provides the evidence the board needs to judge control reliability.

Question 48Governance

An organization must choose between two treatments for a risk: a costly preventive control or a cheaper detective control with slower response. Which analysis best supports the decision?

  1. Deferring the decision until the next audit cycle
  2. Selecting the cheaper option because cost always dominates
  3. Choosing the preventive control because prevention is always superior
  4. Comparing expected loss reduction against total cost of ownership for each option Correct answer.

Explanation

Sound treatment decisions weigh the reduction in expected loss against the full cost of each option, including response delays and residual risk. This produces a defensible, value-based choice.

Question 49Governance

A regulator asks an organization to prove that a delegated security responsibility was actually performed by the vendor. Which artifact provides the strongest evidence?

  1. The vendor's marketing brochure
  2. Independent assurance reports and performance metrics from the vendor Correct answer.
  3. The original request for proposal
  4. The internal organization chart

Explanation

Independent assurance reports and ongoing performance metrics demonstrate that the vendor actually performed the delegated responsibility. Marketing materials and planning documents show intent, not performance.

Question 50Governance

Leadership wants security metrics that reveal whether risk is increasing before losses occur. Which metric design best meets this goal?

  1. Tracking leading indicators tied to control health and exposure trends Correct answer.
  2. Measuring the number of policy documents published
  3. Reporting the security budget as a percentage of revenue
  4. Counting the total number of past incidents

Explanation

Leading indicators reflect changes in control health and exposure that precede losses, enabling preemptive action. Lagging counts of past incidents describe outcomes after harm has occurred.