I85PREP
⌘ K
CTO study materials
CTO study resources

CTO practice questions

One question at a time. Build your CTO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Technology Strategy and Governance

In IT governance, which document typically defines the decision rights and accountability framework for how technology investments are directed and controlled?

  1. The service level agreement
  2. The governance charter Correct answer.
  3. The capacity plan
  4. The disaster recovery plan

Explanation

A governance charter establishes decision rights, accountability, and the mechanisms by which technology decisions are made and monitored. Operational documents like DR plans, SLAs, and capacity plans execute within that framework rather than define it.

Question 2Technology Strategy and Governance

A CTO wants a single, widely adopted control framework that pairs IT governance with business alignment across five domains including EDM. Which framework is designed for that purpose?

  1. ISO 27001
  2. COBIT Correct answer.
  3. ITIL 4
  4. TOGAF ADM

Explanation

COBIT is structured around governance and management objectives spanning domains such as Evaluate, Direct and Monitor (EDM), and is explicitly oriented toward aligning IT with business goals. ITIL focuses on service management, ISO 27001 on information security, and TOGAF on architecture method.

Question 3Technology Strategy and Governance

Under a federated governance model, how are technology decisions typically distributed?

  1. An external regulator approves each decision
  2. Business units decide independently with no central input
  3. Central IT holds all decision authority
  4. Authority is shared between central and distributed groups by decision type Correct answer.

Explanation

Federated governance allocates decision rights by domain, sharing authority between central and business-unit stakeholders. Centralized models concentrate authority, while decentralized models push it fully outward.

Question 4Technology Strategy and Governance

An organization needs fast local responsiveness but also consistent enterprise standards. Which operating model best balances these tensions?

  1. Federated Correct answer.
  2. Outsourced
  3. Fully decentralized
  4. Fully centralized

Explanation

A federated model balances enterprise consistency with local responsiveness by sharing decision rights across levels. Centralized and decentralized models optimize one side at the expense of the other.

Question 5Technology Strategy and Governance

What is the primary purpose of an enterprise architecture review board?

  1. To approve individual software purchases
  2. To ensure proposed changes conform to architecture standards and strategy Correct answer.
  3. To manage daily incident tickets
  4. To negotiate vendor contract pricing

Explanation

An architecture review board evaluates proposed initiatives for conformance with target architecture and strategic direction. It does not handle procurement transactions, incident operations, or commercial negotiation.

Question 6Technology Strategy and Governance

A team proposes a new microservice platform that conflicts with the approved target architecture. According to architecture governance, what should happen first?

  1. Cancel the project without assessment
  2. Submit an exception or deviation request for review Correct answer.
  3. Deploy immediately and document later
  4. Escalate directly to the CFO

Explanation

Architecture governance requires deviations to be assessed through a formal exception process so risks and rationale are evaluated. Deploying first bypasses control, escalation to finance is premature, and cancellation without assessment is unjustified.

Question 7Technology Strategy and Governance

Which metric best indicates whether the technology portfolio is aligned with strategic priorities?

  1. Percentage of spend mapped to strategic initiatives Correct answer.
  2. Number of servers decommissioned
  3. Average ticket resolution time
  4. Count of open change requests

Explanation

Alignment is measured by how investment maps to stated strategic priorities. The other metrics describe operational efficiency or activity volume rather than strategic fit.

Question 8Technology Strategy and Governance

In portfolio management, what does the term 'run the business' investment category typically cover?

  1. Ongoing operations and maintenance of existing systems Correct answer.
  2. Mergers and acquisitions
  3. New market-entering products
  4. Experimental research prototypes

Explanation

Run-the-business spending sustains current operations, while grow and transform categories cover expansion and innovation. New products, prototypes, and M&A fall outside routine operations.

Question 9Technology Strategy and Governance

Which risk response involves transferring financial exposure to a third party?

  1. Transference Correct answer.
  2. Mitigation
  3. Avoidance
  4. Acceptance

Explanation

Transference shifts risk exposure, commonly through insurance or contractual arrangements. Acceptance retains the risk, mitigation reduces it, and avoidance eliminates the activity creating it.

Question 10Technology Strategy and Governance

A CTO is told a critical vendor may fail to meet recovery obligations. Which governance artifact best formalizes the vendor's required recovery commitments?

  1. The internal audit plan
  2. The business continuity contract clause Correct answer.
  3. The developer style guide
  4. The marketing roadmap

Explanation

Recovery obligations should be codified in contractual clauses so they are enforceable and auditable. Audit plans, roadmaps, and style guides do not establish vendor recovery commitments.

Question 11Technology Strategy and Governance

Which of the following best describes the purpose of a technology steering committee?

  1. To prioritize and oversee major technology investments and initiatives Correct answer.
  2. To perform daily database backups
  3. To write production code
  4. To conduct individual performance reviews

Explanation

A steering committee provides oversight and prioritization for significant technology investments and resolves cross-initiative conflicts. Operational tasks and HR reviews belong to other functions.

Question 12Technology Strategy and Governance

An organization wants to ensure technology decisions are transparent and defensible. Which practice most directly supports this?

  1. Shortening the annual budget cycle
  2. Removing escalation paths
  3. Reducing the number of stakeholders involved
  4. Documenting decision rationale and approvals Correct answer.

Explanation

Transparency and defensibility depend on recorded rationale and approval trails. Reducing stakeholders, removing escalation, or shortening budgets do not create auditability.

Question 13Technology Strategy and Governance

What distinguishes a RACI matrix from a simple task list in governance?

  1. It replaces the need for any approval process
  2. It assigns roles for responsibility, accountability, consultation, and information Correct answer.
  3. It records only deadlines
  4. It lists only external vendors

Explanation

A RACI matrix clarifies who is responsible, accountable, consulted, and informed for each activity, which a task list does not. It complements rather than replaces approval processes.

Question 14Technology Strategy and Governance

A regulator requires that the company demonstrate control effectiveness annually. Which activity most directly satisfies this?

  1. A team-building event
  2. A product launch review
  3. A vendor demo
  4. An independent control audit Correct answer.

Explanation

Independent audits provide evidence that controls operate effectively and are the standard mechanism for regulatory assurance. The other activities do not produce control-effectiveness evidence.

Question 15Technology Strategy and Governance

Which concept describes the acceptable level of variation from a standard that governance tolerates before escalation is required?

  1. Risk appetite
  2. Service credit
  3. Change freeze
  4. Tolerance threshold Correct answer.

Explanation

A tolerance threshold defines the boundary of acceptable deviation before escalation. Risk appetite expresses willingness to take risk overall, service credits are contractual remedies, and change freezes halt changes.

Question 16Technology Strategy and Governance

A CTO sets a low risk appetite for customer data exposure but a high appetite for experimentation in internal tooling. What does this demonstrate?

  1. Risk appetite is irrelevant to governance
  2. Risk appetite equals risk avoidance
  3. Risk appetite is uniform across the enterprise
  4. Risk appetite can be differentiated by domain Correct answer.

Explanation

Risk appetite is commonly expressed per domain, allowing stricter limits where harm is severe and more latitude where experimentation is low-risk. It is neither uniform nor equivalent to avoidance.

Question 17Technology Strategy and Governance

Which is the clearest indicator that technology governance is ineffective?

  1. A published architecture standard
  2. A functioning review board
  3. Recurring unapproved architecture exceptions Correct answer.
  4. A documented decision log

Explanation

Recurring unapproved exceptions signal that the control process is being bypassed or is not enforced. Published standards, working boards, and decision logs are signs of effective governance.

Question 18Technology Strategy and Governance

What is the main governance purpose of a technology capability roadmap?

  1. To sequence capability investments toward a target state Correct answer.
  2. To record server serial numbers
  3. To list customer complaints
  4. To schedule employee vacations

Explanation

A capability roadmap sequences investments and milestones toward a desired future state, guiding resource allocation. It is not an HR schedule, complaint log, or asset register.

Question 19Technology Strategy and Governance

A company must choose between two platforms with similar features but one aligns with a five-year strategic direction. Which governance principle should guide the choice?

  1. Vendor popularity in the market
  2. Strategic alignment with the target architecture Correct answer.
  3. Fastest procurement cycle
  4. Lowest immediate license cost

Explanation

Governance prioritizes strategic alignment with the target architecture and long-term direction over short-term cost or popularity. Cost and speed matter but are subordinate to strategic fit.

Question 20Technology Strategy and Governance

Which of the following best characterizes 'shadow IT' from a governance perspective?

  1. Approved but underfunded initiatives
  2. Technology used without organizational sanction or oversight Correct answer.
  3. Retired legacy systems
  4. Vendor-managed infrastructure

Explanation

Shadow IT is technology adopted outside sanctioned channels, creating unmanaged risk and compliance exposure. Approved initiatives, retired systems, and vendor-managed infrastructure are all within governance visibility.

Question 21Technology Strategy and Governance

An audit finds several business units procuring SaaS independently. What governance response most directly addresses the root cause?

  1. Increase the IT budget
  2. Establish a lightweight approved-vendor and intake process Correct answer.
  3. Ban all SaaS purchases permanently
  4. Reduce the number of auditors

Explanation

Shadow procurement typically arises when sanctioned channels are slow or unclear; a lightweight intake and approved-vendor list restores visibility without blocking business needs. Blanket bans, budget changes, or fewer auditors do not fix the process gap.

Question 22Technology Strategy and Governance

What role does a data governance council typically play in technology strategy?

  1. It writes application code
  2. It sets policy for data quality, ownership, and access Correct answer.
  3. It manages network cabling
  4. It negotiates office leases

Explanation

A data governance council defines policies for data ownership, quality, and access to support reliable decision-making. Coding, cabling, and facilities are unrelated operational functions.

Question 23Technology Strategy and Governance

A CTO must decide whether to build, buy, or partner for a new capability. Which governance consideration weighs most heavily when the capability is a core differentiator?

  1. Avoiding all vendor relationships
  2. Retaining control over differentiating intellectual property Correct answer.
  3. Reducing documentation effort
  4. Minimizing the number of internal staff

Explanation

When a capability is a core differentiator, retaining control over the associated intellectual property protects competitive advantage, which often favors building or tightly controlled partnering. Staff minimization, vendor avoidance, or documentation shortcuts are not strategic criteria.

Question 24Technology Strategy and Governance

Which governance mechanism best ensures technology investments are periodically re-evaluated against realized benefits?

  1. Ad hoc hallway discussions
  2. A one-time business case at approval
  3. Annual vendor conferences
  4. Benefit realization reviews at defined milestones Correct answer.

Explanation

Scheduled benefit realization reviews compare actual outcomes to the business case and inform continuation or cancellation decisions. A one-time case, conferences, or informal chats do not provide structured re-evaluation.

Question 25Technology Strategy and Governance

An organization's governance board approves initiatives but never checks outcomes. Which governance weakness does this represent?

  1. Absence of a feedback and accountability loop Correct answer.
  2. Too many risk controls
  3. Excessive decentralization
  4. Overreliance on external auditors

Explanation

Governance requires a closed loop where approved investments are monitored for outcomes and adjusted accordingly; approval without follow-up breaks accountability. The scenario does not indicate decentralization, auditor reliance, or excessive controls.

Question 26Technology Strategy and Governance

Which document most clearly establishes the authority of a technology governance body to make binding decisions?

  1. A vendor contract with a managed service provider
  2. A terms of reference or charter approved by executive leadership Correct answer.
  3. An architecture diagram of the current-state environment
  4. A project status report distributed to stakeholders

Explanation

A governance body's authority derives from an approved charter or terms of reference that defines its mandate, membership, decision rights, and escalation path. Without that formal mandate, the group can advise but cannot bind the organization.

Question 27Technology Strategy and Governance

A CTO wants technology strategy to be traceable to enterprise goals. Which artifact creates that traceability most directly?

  1. A capacity plan for data center infrastructure
  2. A benefits dependency map linking initiatives to business outcomes Correct answer.
  3. A skills inventory of the engineering workforce
  4. A service catalog listing operational support tiers

Explanation

A benefits dependency map explicitly connects each initiative through enabling changes to the business outcomes and goals it serves. This makes the causal chain from investment to strategy auditable.

Question 28Technology Strategy and Governance

Which statement best captures the difference between technology strategy and technology governance?

  1. Strategy is owned by engineering; governance is owned by finance
  2. Strategy concerns new investment; governance concerns only operational incidents
  3. Strategy sets direction and choices; governance sets the decision rights and controls that keep execution aligned Correct answer.
  4. Strategy is reviewed annually; governance is reviewed continuously

Explanation

Strategy defines where the organization intends to go and the choices it makes to get there, while governance defines who decides, how decisions are made, and how compliance is assured. The two are complementary but distinct in purpose.

Question 29Technology Strategy and Governance

Which practice best keeps a technology strategy relevant as market conditions shift?

  1. Scheduling periodic strategy reviews with explicit trigger conditions for early revision Correct answer.
  2. Replacing the strategy whenever a new technology becomes popular
  3. Freezing the strategy for a fixed multi-year term to ensure stability
  4. Delegating all strategy updates to individual delivery teams

Explanation

Effective strategies combine a stable planning rhythm with defined triggers, such as a major competitive shift or regulatory change, that force an early review. This balances commitment with adaptability.

Question 30Technology Strategy and Governance

An enterprise architect proposes a standard integration pattern, but one division argues its legacy system cannot comply. What is the most appropriate governance step?

  1. Require the division to submit a time-bound exception with a remediation plan for approval by the architecture board Correct answer.
  2. Suspend the standard until every division can comply
  3. Grant a permanent exemption so the division can proceed without further review
  4. Escalate directly to the CEO for a binding ruling

Explanation

Exceptions should be explicit, time-bound, and owned, with a documented path back to compliance. This preserves the standard's integrity while acknowledging legitimate transitional constraints.

Question 31Technology Strategy and Governance

A CTO must decide how much autonomy business units have to select their own analytics tools. Which governance lever most directly sets that boundary?

  1. The service level agreement for analytics platform uptime
  2. The annual audit plan for the analytics function
  3. The capital expenditure approval threshold
  4. The defined decision rights for tooling selection across federated and central roles Correct answer.

Explanation

Decision rights specify who may make which choices and at what level, which is precisely the mechanism for allocating autonomy. Capex thresholds, SLAs, and audit plans influence behavior but do not define who decides.

Question 32Technology Strategy and Governance

A regulated firm must prove that a new cloud service meets data residency obligations before go-live. Which governance control is most appropriate?

  1. A post-implementation review conducted six months after launch
  2. A quarterly newsletter summarizing regulatory changes
  3. A mandatory architecture and compliance gate before production release Correct answer.
  4. An open backlog item to assess residency at a later date

Explanation

A pre-production gate enforces the control at the point where it can prevent non-compliance. Post-hoc review detects problems only after exposure has occurred.

Question 33Technology Strategy and Governance

Which set of measures best evaluates whether a governance framework is working?

  1. Total technology spend and headcount
  2. Number of meetings held and attendance rates
  3. Decision cycle time, exception volume and aging, and audit findings closure rate Correct answer.
  4. Count of policies published and pages of documentation

Explanation

Effective governance measures outcomes such as how quickly decisions are made, how exceptions are managed, and whether findings are remediated. Activity and volume metrics show effort, not effectiveness.

Question 34Technology Strategy and Governance

A CTO is accountable for a platform whose delivery is outsourced. Which arrangement best preserves governance accountability?

  1. Assign accountability to the supplier's account manager
  2. Transfer all decision rights to the supplier under a fixed-price contract
  3. Retain decision rights for architecture and risk while defining supplier obligations through measurable service commitments Correct answer.
  4. Rely on the supplier's internal governance and audit reports alone

Explanation

Accountability for regulated and strategic outcomes cannot be fully outsourced; the organization must retain key decision rights and make supplier obligations explicit and measurable. Supplier self-attestation alone does not discharge that duty.

Question 35Technology Strategy and Governance

Which mechanism best ensures that architecture standards remain current rather than becoming obstacles?

  1. Publishing standards only to the architecture team
  2. Scheduling regular standard reviews with defined sunset and review dates Correct answer.
  3. Permanently grandfathering all systems that predate the standard
  4. Requiring unanimous approval from every division to change a standard

Explanation

Standards need lifecycle management, including scheduled review and sunset provisions, so they evolve with technology and business needs. Without review dates, standards ossify and are increasingly bypassed.

Question 36Technology Strategy and Governance

A board asks how technology risk appetite translates into operational limits. Which artifact best performs that translation?

  1. A risk register listing identified risks and owners
  2. Risk tolerance thresholds expressed as measurable limits mapped to controls Correct answer.
  3. An incident post-mortem report
  4. A business continuity plan for the data center

Explanation

Appetite is a high-level statement of how much risk the organization will accept; tolerance thresholds convert it into measurable limits that controls and monitoring can enforce. A risk register records risks but does not by itself express acceptable limits.

Question 37Technology Strategy and Governance

Two business units propose competing platforms that would each become a de facto standard. What governance approach best resolves this?

  1. Apply a documented evaluation against strategic, architectural, and total cost criteria with a single accountable decision owner Correct answer.
  2. Let both proceed and allow the market to decide internally
  3. Split the capability so each unit owns half of the platform
  4. Defer the decision until both units have fully built their solutions

Explanation

Convergent decisions require transparent, criteria-based evaluation and a named decision owner so the outcome is defensible. Allowing duplication or indefinite deferral multiplies cost and entrenches fragmentation.

Question 38Technology Strategy and Governance

A CTO is designing governance for an AI capability that will make recommendations affecting customers. Which control set is most appropriate at the governance layer?

  1. Define model risk ownership, human oversight requirements, and periodic bias and performance review Correct answer.
  2. Rely on the vendor's model documentation as the sole assurance artifact
  3. Prohibit any documentation of model behavior to protect proprietary methods
  4. Limit governance to the initial procurement approval

Explanation

AI governance requires assigned ownership, defined human oversight, and ongoing monitoring for bias and performance drift, because model behavior changes over time. Procurement approval alone addresses only the entry point.

Question 39Technology Strategy and Governance

An organization's technology investment board approves funding but has no mechanism to halt underperforming initiatives. Which governance gap does this represent?

  1. Insufficient stakeholder representation on the board
  2. Overreliance on external consultants
  3. Absence of stage-gate decision points with authority to stop or redirect investment Correct answer.
  4. Inadequate documentation of meeting minutes

Explanation

Governance must include decision points at which investment can be continued, changed, or stopped based on evidence. An approval-only process lacks the control needed to contain failing investments.

Question 40Technology Strategy and Governance

A multinational must satisfy conflicting data protection regimes across regions while operating a shared platform. Which governance design is most defensible?

  1. Defer to whichever regulator is most likely to audit first
  2. Apply the strictest regional requirement uniformly to every region
  3. Define a common control baseline with documented regional overlays and a single accountable owner for cross-border conflicts Correct answer.
  4. Allow each region to define its own independent platform controls

Explanation

A common baseline with explicit regional overlays balances consistency with local legal obligations and creates a clear record of how conflicts are resolved. Independent regional controls fragment the platform and obscure accountability.

Question 41Enterprise Architecture and Systems Integration

In a service-oriented integration architecture, what is the primary purpose of a message broker?

  1. To render the user interface for client devices
  2. To decouple producers from consumers through asynchronous message queuing Correct answer.
  3. To compile application source code into deployable binaries
  4. To enforce referential integrity inside a relational database

Explanation

A message broker sits between producers and consumers, buffering messages and enabling asynchronous, loosely coupled communication. It does not compile code, render interfaces, or manage database constraints.

Question 42Enterprise Architecture and Systems Integration

Which integration style most directly exposes a system's internal data model to consumers and is therefore generally discouraged for cross-enterprise integration?

  1. Shared database integration Correct answer.
  2. Remote procedure call
  3. API gateway mediation
  4. Event-driven messaging

Explanation

Shared database integration couples consumers to the provider's schema, so any internal schema change can break consumers. The other styles hide the internal model behind an interface or message contract.

Question 43Enterprise Architecture and Systems Integration

What does the acronym SOAP stand for in web services?

  1. Standard Object Authentication Process
  2. Secure Online Application Protocol
  3. Simple Object Access Protocol Correct answer.
  4. Service Oriented Architecture Pattern

Explanation

SOAP is the Simple Object Access Protocol, an XML-based messaging protocol for exchanging structured information. The other expansions are invented and do not correspond to the standard.

Question 44Enterprise Architecture and Systems Integration

In REST architecture, which HTTP method is defined as safe and idempotent for retrieving a representation of a resource?

  1. GET Correct answer.
  2. POST
  3. CONNECT
  4. PATCH

Explanation

GET retrieves a representation without changing server state, making it both safe and idempotent. POST creates or processes data and is neither safe nor idempotent.

Question 45Enterprise Architecture and Systems Integration

Which enterprise integration pattern routes a message to exactly one recipient among many possible channels based on message content?

  1. Aggregator
  2. Publish-subscribe channel
  3. Content-based router Correct answer.
  4. Splitter

Explanation

A content-based router inspects message content and forwards each message to a single appropriate channel. Publish-subscribe fans out to many subscribers, while splitters and aggregators change message cardinality rather than selecting one destination.

Question 46Enterprise Architecture and Systems Integration

What is the main benefit of using an API gateway in a microservices architecture?

  1. It replaces the need for service discovery entirely
  2. It guarantees strong consistency across all service databases
  3. It provides a single entry point that handles cross-cutting concerns like authentication and rate limiting Correct answer.
  4. It eliminates the need for any network communication between services

Explanation

An API gateway centralizes concerns such as authentication, throttling, and routing behind one client-facing endpoint. It does not remove inter-service networking, guarantee distributed consistency, or make service discovery unnecessary.

Question 47Enterprise Architecture and Systems Integration

Which statement best describes the role of an enterprise service bus (ESB)?

  1. It mediates, routes, and transforms messages between heterogeneous systems Correct answer.
  2. It compiles and packages microservice containers for deployment
  3. It provides the physical network switching fabric for the data center
  4. It stores the authoritative master data for the enterprise

Explanation

An ESB is middleware that mediates communication, performing routing, transformation, and protocol adaptation between disparate systems. It is not a master data store, a network switch, or a container build tool.

Question 48Enterprise Architecture and Systems Integration

What distinguishes a canonical data model from a point-to-point interface model in enterprise integration?

  1. A canonical model requires every system to share one physical database
  2. A canonical model defines a shared common format that each system maps to, reducing the number of transformations Correct answer.
  3. A canonical model removes the need for any message transformation
  4. A canonical model is only applicable to synchronous request-response calls

Explanation

A canonical data model establishes one shared schema so each system maps to and from it, avoiding a transformation for every pair of systems. It does not require a shared physical database, eliminate all transformations, or restrict itself to synchronous calls.

Question 49Enterprise Architecture and Systems Integration

An integration team needs guaranteed at-least-once delivery across an unreliable network between two systems. Which mechanism best supports this requirement?

  1. Synchronous HTTP calls with no retry logic
  2. A shared database table read by polling only once
  3. Persistent message queues with consumer acknowledgements Correct answer.
  4. In-memory publish-subscribe without persistence

Explanation

Persistent queues retain messages until acknowledged, and acknowledgements let the broker redeliver if a consumer fails, yielding at-least-once delivery. Non-persistent or fire-and-forget approaches can lose messages during failures.

Question 50Enterprise Architecture and Systems Integration

A consumer must process messages from a queue exactly once in business terms even though the transport guarantees only at-least-once delivery. Which technique addresses this?

  1. Switching the queue to a fan-out topology
  2. Disabling consumer acknowledgements
  3. Increasing the queue's message size limit
  4. Idempotent processing keyed on a unique message identifier Correct answer.

Explanation

Because at-least-once transport can redeliver, consumers must deduplicate or make processing idempotent using a unique message key so repeated deliveries have no additional effect. Changing size, topology, or acknowledgements does not prevent duplicate side effects.