Free COBIT-2019-Foundation sample questions

Correct answer: False

This statement is false. The principle 'Governance distinct from Management' clarifies that governance and management have different activities, objectives, and structures. Governance (Evaluate, Direct, Monitor) sets the direction and monitors performance, while Management (Plan, Build, Run, Monitor) executes activities to achieve the enterprise objectives set by governance. Management is therefore accountable to the governance body for its performance.

Correct answer: EDM02 Ensured Benefits Delivery

EDM02 is a governance objective focused on optimizing the value contribution to the business from the business processes, IT services, and IT assets resulting from investments made by IT at acceptable costs. This directly addresses the board's need for assurance that the digital transformation program delivers its intended value, stays within budget, and manages risks from a strategic, oversight perspective. It involves portfolio management and monitoring the value of programs, which is exactly what FinSecure Bank needs.

Correct answer: A standard process is defined and used across the organization, tailored from a common set of assets.

Capability Level 2 ('Managed') means the process is implemented and its performance is managed. However, to reach Level 3 ('Established'), the organization must define and deploy a standard process that is used consistently across applicable projects and departments. This standard process is tailored from the organization's set of standard processes and related assets. Quantitative management is characteristic of Level 4, and continuous improvement is the focus of Level 5.

Correct answer: Culture, Ethics, and Behavior

The 'Culture, Ethics, and Behavior' component of the COBIT 2019 governance system directly addresses the 'people' side of governance. It emphasizes that the individual and collective behavior within an enterprise is a critical success factor for achieving governance and management objectives. The other components are important but do not specifically focus on the organization's underlying values and behavioral norms.

Correct answer: Value Creation

The core purpose of governing and managing enterprise I&T is value creation. COBIT defines this as realizing benefits at an optimal resource cost while optimizing risk. This involves a careful balance among three key elements: benefit realization, risk optimization, and resource optimization. This concept is fundamental to justifying any governance initiative.

Correct answer: Conducting a process capability assessment for a selected set of COBIT objectives.

Phase 2, 'Where are we now?', is focused on understanding the current state. The most direct and critical activity for this is conducting a process capability assessment. This assessment measures the current performance of selected processes against the COBIT model, providing a clear baseline of the organization's maturity and identifying specific weaknesses that need to be addressed in later phases. Identifying stakeholders (Phase 1) and defining project plans (Phase 4) occur in different phases.

Correct answer: BAI06 Managed IT Changes

The purpose of BAI06 Managed IT Changes is to enable fast and reliable delivery of change to the business while mitigating the risk of negatively impacting the stability or integrity of the changed environment. This objective includes practices for change request management, impact assessment, authorization, testing, and deployment, directly addressing the issues found by the audit team.

Correct answer: Aligned to major standards

One of the three principles for a governance framework is that it should be 'Aligned to major standards.' COBIT 2019 is not intended to replace other frameworks but to act as an overarching 'umbrella' framework. It explicitly aligns with and references a wide range of relevant standards and frameworks, allowing an organization to integrate them into a single, cohesive governance system.

Correct answer: Creating and maintaining an information model and classification scheme.

A core practice within the 'Information' component is the creation and maintenance of a comprehensive information model and classification scheme. This scheme is what allows the agency to categorize data based on criteria like sensitivity, criticality, and regulatory requirements (e.g., public, internal, confidential, restricted). This classification then dictates the security controls, access rights, and handling procedures for that data.

Correct answer: Sourcing Model for I&T

The 'Sourcing Model for I&T' design factor specifically addresses how an enterprise obtains its IT services and infrastructure. This includes options like outsourcing (cloud), insourcing (on-premises), or a hybrid approach. The choice of sourcing model significantly impacts which governance and management objectives need to be prioritized (e.g., APO10 Managed Suppliers becomes more critical in a cloud model).