Test your basic knowledge |

CGEIT: Certified In The Governance Of Enterprise It

Subjects : certifications, cgeit, it-skills

Instructions:

Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. 3 Governance Objectives
quantitative risk analysis approach - damage cost per year * enter frequency
Benefits realization - risk optimization - resource optimization
implementation - information security - assurance - Risk
Threat analysis - vulnerability assessment - gap analysis - (positive and negative / opportunities and threats)

2. Return on security investment ROSI
Preventive controls - detective controls - corrective controls (troubleshooting instructions)
Saving the cost of damage (eg ALE) minus cost of mitigation
Scoping - formal enactment - clear Vogaben at exceptions - verification of compliance
inherent risk - control risk: insufficient control system - detection risk: insufficient testing

3. COBIT framework
pain points - improvment opportunities
An internally controlled collection and analysis of values. In a control self-assessment fill out one or more units surveyed questionnaires - which can then be evaluated independently. This survey can help the units (individuals - groups - department
basic ingredients - basic principles - enterprise enablers - goals cascade - maturity model
policy - principles - statements

4. risk governance
An internally controlled collection and analysis of values. In a control self-assessment fill out one or more units surveyed questionnaires - which can then be evaluated independently. This survey can help the units (individuals - groups - department
executive tasks: prioritization - resource alloc - project tracking
risk and risk response evaluation
performance monitoring - to demostrate the effectivness if IT and communicate about it - Performance - risk and capabilities

5. Three different control categories?
TQM - BPM /BPR (... reengineering) - BSC - Six Sigma - CMMI
Preventive controls - detective controls - corrective controls (troubleshooting instructions)
5 gov processes (GL - PR) - std (users realize - risks opt opt ress) and framework - stakeholder transparency create - it gov: provide direction - evaluate performance - it Mgmnt: translate strategy into direction - and report performance mesure - 32
only known processes enabling

6. Best practices in dealing with policies Policies (not principles)
unavoidable risk
create an environment conductive to innovate - Maintain / understand the enterprise environment - monitor / scan the technology environment - assess the potential of emerging tech.- recommend appropriate further initiatives - monitor the implication
Used in business administration figures - references which can be the progress or the level of compliance with regard to important objectives or critical success factors measured within an organization and / or calculated - Important KPIs in the serv
Scoping - formal enactment - clear Vogaben at exceptions - verification of compliance

7. Riskit vs. COBIT
risk that something will NOT be revealed - ill-prepared - not tested properly - misinterpreted findings weighted wrong
executive tasks: prioritization - resource alloc - project tracking
TQM - BPM /BPR (... reengineering) - BSC - Six Sigma - CMMI
COBIT provides the means of risk management - Riskit provides the ends.

8. Hierarchy of policies
pain points - improvment opportunities
what are the drivers - where are we now - where do we want to be - what needs to be done (project plan) - how do we get there (execute) - did we get there - how to keep the momentum going
iter (interview - test analysis - detecting / hold / summarize - Discuss with auditee
policy - principles - statements

9. The 3 themes of the ICS economic / financial risk
who should do what? - establishing accountability - VR / goals objectives - GL translate strategy into action (automation - cost - risk mgmt)
Observations / findings - risks - recommendation / report
operational risk (HR - Law - Nature - IT) - reputational risk
QA

10. Balanced scorecard (BSC)
A strategic performance management tool - a semi-standard structured report - supported by proven design methods and automation tools - that can be used by managers to keep track of the execution of activities by the staff within their control and .
The identification of measures that answer the question 'What must we excel at?'
critical success factors
QA

11. Risk analysis techniques
Threat analysis - vulnerability assessment - gap analysis - (positive and negative / opportunities and threats)
a risk Arising from execution of a company's business functions. It is a very broad concept Which Focuses on the risks you Arising from the people - systems and processes through Which a company operates. It therefore includes other categories examin
inadequate or failed internal processes
stratecic establish alignment / framework - value delivery - risk management - resource mgmt - performance mgmt / stakeholer transparency

12. IT Strategy Committee
Observations / findings - risks - recommendation / report
quantitative risk analysis approach - damage cost per year * enter frequency
VR level - integration and business strategy it - Chaired by a business executive / board member
enterprise risk management

13. Balanced scorecard - Internal Business Processes

14. Risk treatment process
Define risk owners (possibly delegate to process owners) - avoid the formation - reduction - sharing - acceptance - cost benefit measures to keep the residual risk within defined tolerance limits
create an environment conductive to innovate - Maintain / understand the enterprise environment - monitor / scan the technology environment - assess the potential of emerging tech.- recommend appropriate further initiatives - monitor the implication
general: magmt change - security - operations control Application: do everything to do with app. pgm. has zb source management - authentication validation
Encourages the identification of measures that answer the question 'How do customers see us?'

15. Structure of the 32 COBIT processes mgmt.
(hierarchy) 5 domains (EDM - po ad ds me) - processes 37 - 211 practices
plan: align - plan - Organize (PO) - build: build - Aquire - Implement (AI) - run: Deliver - servie - Support (DS) - Monitor: Monitor - Evaluate - control ME
who should do what? - establishing accountability - VR / goals objectives - GL translate strategy into action (automation - cost - risk mgmt)
extract optimal value from investments it - value management: processes - monitor - portfolio management: funds - human - investment management: business case - Manging program / projects

16. application vs. controls. IT general controls
general: magmt change - security - operations control Application: do everything to do with app. pgm. has zb source management - authentication validation
Tests - Extensive testing
a risk Arising from execution of a company's business functions. It is a very broad concept Which Focuses on the risks you Arising from the people - systems and processes through Which a company operates. It therefore includes other categories examin
An internally controlled collection and analysis of values. In a control self-assessment fill out one or more units surveyed questionnaires - which can then be evaluated independently. This survey can help the units (individuals - groups - department

17. CSFs
Scenarios set in a risk environment
critical success factors
operational risk (HR - Law - Nature - IT) - reputational risk
Preventive controls - detective controls - corrective controls (troubleshooting instructions)

18. Function point analysis
Review process for software system - The functional size is determined - where you split the functional requirements of an application into small - meaningful to the user activities that elementary processes. Same elementary processes are evaluated o
basic ingredients - basic principles - enterprise enablers - goals cascade - maturity model
performance monitoring - to demostrate the effectivness if IT and communicate about it - Performance - risk and capabilities
Encourages the identification of measures that answer the question? 'How can we continue to improve and create value. '

19. IT governance life cycle
plan: align - plan - Organize (PO) - build: build - Aquire - Implement (AI) - run: Deliver - servie - Support (DS) - Monitor: Monitor - Evaluate - control ME
what are the drivers - where are we now - where do we want to be - what needs to be done (project plan) - how do we get there (execute) - did we get there - how to keep the momentum going
stratecic establish alignment / framework - value delivery - risk management - resource mgmt - performance mgmt / stakeholer transparency
Tests - Extensive testing

20. Entity level controls
inadequate or failed internal processes
Controls at the corporate level - are internal controls that help Ensure that management directives pertaining to the entire entity are Carried out. They are the second level of a top-down approach to understanding the risks of an organization. Gener
Preventive controls - detective controls - corrective controls (troubleshooting instructions)
Encourages the identification of measures that answer the question 'How do customers see us?'

21. Escrow contracts
Controls at the corporate level - are internal controls that help Ensure that management directives pertaining to the entire entity are Carried out. They are the second level of a top-down approach to understanding the risks of an organization. Gener
create an environment conductive to innovate - Maintain / understand the enterprise environment - monitor / scan the technology environment - assess the potential of emerging tech.- recommend appropriate further initiatives - monitor the implication
Trust Service Contracts
iter (interview - test analysis - detecting / hold / summarize - Discuss with auditee

22. Control risk
risk that something will NOT be revealed - ill-prepared - not tested properly - misinterpreted findings weighted wrong
risk that the controls are inadequate
Benefits realization - risk optimization - resource optimization
Encourages the identification of measures that answer the question? 'How can we continue to improve and create value. '

23. ISO 27000
(hierarchy) 5 domains (EDM - po ad ds me) - processes 37 - 211 practices
COBIT provides the means of risk management - Riskit provides the ends.
informations inherited
implementation - information security - assurance - Risk

24. Risk analysis methodology
Scenarios set in a risk environment
Used in business administration figures - references which can be the progress or the level of compliance with regard to important objectives or critical success factors measured within an organization and / or calculated - Important KPIs in the serv
TQM - BPM /BPR (... reengineering) - BSC - Six Sigma - CMMI
Preventive controls - detective controls - corrective controls (troubleshooting instructions)

25. 5 focus area of IT Governance
stratecic establish alignment / framework - value delivery - risk management - resource mgmt - performance mgmt / stakeholer transparency
To take the residual risk a company is willing risk
Value analysis - was initially applied WA - to identify and eliminate unnecessary costs. WA is equally successful in improving the performance and function of resources other than the costs. In the course of time - extended the WA applications from p
operational risk (HR - Law - Nature - IT) - reputational risk

26. COBIT professional guides
a technique for analysis and presentation of responsibilities - the name is derived from the initial letters of the words Responsible - Accountable - Consulted and Informed.
Signature - statement - audit trail
implementation - information security - assurance - Risk
operational risk (HR - Law - Nature - IT) - reputational risk

27. Methods for continuous process improvement
general: magmt change - security - operations control Application: do everything to do with app. pgm. has zb source management - authentication validation
Scenarios set in a risk environment
VR level - integration and business strategy it - Chaired by a business executive / board member
TQM - BPM /BPR (... reengineering) - BSC - Six Sigma - CMMI

28. IT Steering Committee
policy - principles - statements
Tests - Extensive testing
plan-prepare-execute-track-report
executive tasks: prioritization - resource alloc - project tracking

29. Use of balanced scorecards
performance monitoring - to demostrate the effectivness if IT and communicate about it - Performance - risk and capabilities
Controls at the corporate level - are internal controls that help Ensure that management directives pertaining to the entire entity are Carried out. They are the second level of a top-down approach to understanding the risks of an organization. Gener
(hierarchy) 5 domains (EDM - po ad ds me) - processes 37 - 211 practices
a technique for analysis and presentation of responsibilities - the name is derived from the initial letters of the words Responsible - Accountable - Consulted and Informed.

30. Anual loss expectancy ALE
Saving the cost of damage (eg ALE) minus cost of mitigation
quantitative risk analysis approach - damage cost per year * enter frequency
Benefits realization - risk optimization - resource optimization
unavoidable risk

31. Audit risk consists of...
what are the drivers - where are we now - where do we want to be - what needs to be done (project plan) - how do we get there (execute) - did we get there - how to keep the momentum going
A quality management standard describes the requirements that must be satisfied by the management system of a company in order to meet a certain standard in the implementation of quality management. It can serve both informative for implementation wi
Preventive controls - detective controls - corrective controls (troubleshooting instructions)
inherent risk - control risk: insufficient control system - detection risk: insufficient testing

32. Derivation Cobit practices / control objectives
Benefits realization management (BRM) (also benefits management or benefits realization) is the explicit planning - delivery and management of whole life benefits from an investment. An investment is only successful if Intended benefits are Realised
Trust Service Contracts
A strategic performance management tool - a semi-standard structured report - supported by proven design methods and automation tools - that can be used by managers to keep track of the execution of activities by the staff within their control and .
(hierarchy) 5 domains (EDM - po ad ds me) - processes 37 - 211 practices

33. Balanced scorecard - Customer

34. To address three types of risk in the ICS
Controls at the corporate level - are internal controls that help Ensure that management directives pertaining to the entire entity are Carried out. They are the second level of a top-down approach to understanding the risks of an organization. Gener
Financial - Operational - Reputation
Value analysis - was initially applied WA - to identify and eliminate unnecessary costs. WA is equally successful in improving the performance and function of resources other than the costs. In the course of time - extended the WA applications from p
a risk Arising from execution of a company's business functions. It is a very broad concept Which Focuses on the risks you Arising from the people - systems and processes through Which a company operates. It therefore includes other categories examin

35. Raci carts (RACI)
a technique for analysis and presentation of responsibilities - the name is derived from the initial letters of the words Responsible - Accountable - Consulted and Informed.
Review process for software system - The functional size is determined - where you split the functional requirements of an application into small - meaningful to the user activities that elementary processes. Same elementary processes are evaluated o
Encourages the identification of measures that answer the question? 'How can we continue to improve and create value. '
critical success factors

36. COBIT cascading goals
Business goals with Gov. goals priorisiern - IT goals with U-prioritize targets (script 82) - prioritize process with IT goals
Review process for software system - The functional size is determined - where you split the functional requirements of an application into small - meaningful to the user activities that elementary processes. Same elementary processes are evaluated o
Encourages the identification of measures that answer the question 'How do customers see us?'
5 gov processes (GL - PR) - std (users realize - risks opt opt ress) and framework - stakeholder transparency create - it gov: provide direction - evaluate performance - it Mgmnt: translate strategy into direction - and report performance mesure - 32

37. KPI
Review process for software system - The functional size is determined - where you split the functional requirements of an application into small - meaningful to the user activities that elementary processes. Same elementary processes are evaluated o
Benefits realization - risk optimization - resource optimization
general: magmt change - security - operations control Application: do everything to do with app. pgm. has zb source management - authentication validation
Used in business administration figures - references which can be the progress or the level of compliance with regard to important objectives or critical success factors measured within an organization and / or calculated - Important KPIs in the serv

38. Valit content framework
extract optimal value from investments it - value management: processes - monitor - portfolio management: funds - human - investment management: business case - Manging program / projects
what are the drivers - where are we now - where do we want to be - what needs to be done (project plan) - how do we get there (execute) - did we get there - how to keep the momentum going
performance monitoring - to demostrate the effectivness if IT and communicate about it - Performance - risk and capabilities
TQM - BPM /BPR (... reengineering) - BSC - Six Sigma - CMMI

39. Balanced scorecard - Learning and Growt

40. IT Governance and COBIT
5 gov processes (GL - PR) - std (users realize - risks opt opt ress) and framework - stakeholder transparency create - it gov: provide direction - evaluate performance - it Mgmnt: translate strategy into direction - and report performance mesure - 32
processes are assets that create value for the customer
An internally controlled collection and analysis of values. In a control self-assessment fill out one or more units surveyed questionnaires - which can then be evaluated independently. This survey can help the units (individuals - groups - department
VR level - integration and business strategy it - Chaired by a business executive / board member

41. ISO 31000
implementation - information security - assurance - Risk
Threat analysis - vulnerability assessment - gap analysis - (positive and negative / opportunities and threats)
enterprise risk management
Define risk owners (possibly delegate to process owners) - avoid the formation - reduction - sharing - acceptance - cost benefit measures to keep the residual risk within defined tolerance limits

42. ISO 9000
(hierarchy) 5 domains (EDM - po ad ds me) - processes 37 - 211 practices
extract optimal value from investments it - value management: processes - monitor - portfolio management: funds - human - investment management: business case - Manging program / projects
operational risk (HR - Law - Nature - IT) - reputational risk
A quality management standard describes the requirements that must be satisfied by the management system of a company in order to meet a certain standard in the implementation of quality management. It can serve both informative for implementation wi

43. Inherent risk
processes are assets that create value for the customer
(hierarchy) 5 domains (EDM - po ad ds me) - processes 37 - 211 practices
unavoidable risk
Scoping - formal enactment - clear Vogaben at exceptions - verification of compliance

44. Operational risk is...

45. Risk appetite
Tests - Extensive testing
risk and risk response evaluation
Scenarios set in a risk environment
To take the residual risk a company is willing risk

46. The report stage of a review
Encourages the identification of measures that answer the question 'How do customers see us?'
Scenarios set in a risk environment
Observations / findings - risks - recommendation / report
pain points - improvment opportunities

47. Detection risk
risk that something will NOT be revealed - ill-prepared - not tested properly - misinterpreted findings weighted wrong
inadequate or failed internal processes
Scoping - formal enactment - clear Vogaben at exceptions - verification of compliance
inherent risk - control risk: insufficient control system - detection risk: insufficient testing

48. Control self assessment Self-assessment (kd) or a Control Self Assessment (CSA supervised self-assessment
a technique for analysis and presentation of responsibilities - the name is derived from the initial letters of the words Responsible - Accountable - Consulted and Informed.
quantitative risk analysis approach - damage cost per year * enter frequency
processes are assets that create value for the customer
An internally controlled collection and analysis of values. In a control self-assessment fill out one or more units surveyed questionnaires - which can then be evaluated independently. This survey can help the units (individuals - groups - department

49. A widely used definition of operational risk is the one contained in the Basel II [1] regulations. This definition states that operational risk is the risk of loss resulting from ____________ - people and systems - or from external events.
risk that something will NOT be revealed - ill-prepared - not tested properly - misinterpreted findings weighted wrong
inadequate or failed internal processes
Encourages the identification of a few relevant high-level financial measures. In Particular - designers were encouraged to choose measures that helped inform the answer to the question 'How do we look to shareholders?'
Benefits realization - risk optimization - resource optimization

50. Types of assertions
Benefits realization - risk optimization - resource optimization
plan: align - plan - Organize (PO) - build: build - Aquire - Implement (AI) - run: Deliver - servie - Support (DS) - Monitor: Monitor - Evaluate - control ME
implementation - information security - assurance - Risk
Signature - statement - audit trail