Information Governance CGEIT Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A government agency has a policy that assigns the chief information officer (CIO) as the information owner for all data. The agency's privacy office has raised concerns that this centralizes too much authority and does not align with the privacy regulations that require business units to make decisions about personal data. The CIO disagrees, citing the need for consistent governance. What is the most appropriate resolution?

   • ACreate a committee of the CIO and privacy office that makes all data decisions jointly.
   • BMaintain the CIO as the sole information owner to ensure consistent governance across the agency.
   • CTransfer all information ownership to the privacy office, since they are responsible for regulatory compliance.
   • DAssign information ownership to the business units that create and use the data, while the CIO retains oversight and policy authority.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A law firm has a policy that client files classified as 'highly confidential' must be encrypted when transmitted over email. An attorney needs to send a highly confidential document to a client, but the client's email system does not support the firm's encryption tool. What is the most appropriate action?

   • APrint the document and mail it to the client via courier.
   • BAsk the client to set up the firm's encryption tool before the document is sent.
   • CSend the document unencrypted, since the client is the intended recipient and the attorney-client privilege applies.
   • DUse a secure file-sharing portal that supports encryption and send the client a link to access the document.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A large insurance company is restructuring its information governance program. The current policy assigns information ownership to the IT department for all systems. The new chief data officer (CDO) argues that business units should own the data, while IT should remain the custodian. The IT department resists, citing that they have the technical expertise to manage the data. What is the most appropriate way to implement the CDO's vision?

   • AKeep IT as the information owner, since they have the technical expertise to manage the systems.
   • BCreate a hybrid model where IT and business units share ownership equally, with joint decision rights.
   • CTransfer all information ownership to the business units immediately and reduce IT's role to technical support.
   • DDevelop a formal data ownership framework that assigns business units as owners, IT as custodians, and defines decision rights and escalation paths.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a key requirement for the effective enforcement of an information governance policy?

   • ARelying solely on employee self-reporting of violations.
   • BEnsuring the policy is never updated to maintain consistency.
   • CRegular monitoring and auditing of compliance with the policy.
   • DMaking the policy confidential to prevent employees from circumventing it.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a critical step in the process of developing an information governance policy?

   • AConducting a risk assessment to identify regulatory, legal, and business requirements that the policy must address.
   • BDrafting the policy in isolation by a single IT manager to ensure technical accuracy.
   • CPublishing the policy immediately to all employees to ensure rapid adoption.
   • DDeleting all previous policies to avoid confusion.
   Reveal Solution Discussion Select an answer first