100% Real & Accurate COBIT-2019 Questions and Answers with Free and Fast Updates
Get Unlimited Access to COBIT-2019 Certification Exam Cert Guide
NEW QUESTION # 19
Responsibility for developing an EGIT business case outline and details resides with which of the following?
- A. IT managers and IT process owners
- B. Risk and compliance function and IT audit
- C. CIO and program steering committee
- D. Board of directors and business executives
Answer: C
Explanation:
Explanation
The EGIT business case outline and details are documents that describe the rationale, objectives, scope, approach, benefits, costs, risks, and timeline of the EGIT implementation program. The EGIT business case outline and details provide the basis for obtaining approval, funding, resources, and support for the program from the stakeholders. The responsibility for developing an EGIT business case outline and details resides with the CIO and program steering committee. The CIO is the senior executive responsible for leading and managing the information and technology function in an enterprise. The CIO has a role in developing, reviewing, validating, and approving the EGIT business case outline and details, ensuring that they are aligned with the enterprise's strategy, objectives, needs, and expectations. The CIO also has a role in communicating and presenting the EGIT business case outline and details to other stakeholders such as the board, executives, business managers, IT managers, etc., and obtaining their buy-in and commitment for the program. The program steering committee is a group of senior stakeholders who provide strategic direction, oversight, guidance, and approval for the EGIT implementation program. The program steering committee has a role in developing, reviewing, validating, and approving the EGIT business case outline and details, ensuring that they are consistent with the enterprise's vision, mission, values, strategy goals,and objectives. The program steering committee also has a role in monitoring and controlling the execution of the EGIT implementation program plan against the EGIT business case outline and details34 References: 3: COBIT 2019 Implementation Guide: page 37-38 4: COBIT 2019 Implementation Guide: page 39-40
NEW QUESTION # 20
The alignment goal titled "Enabling and supporting business processes by integrating applications and technology" is aligned to which IT balanced scorecard (BSC) dimension?
- A. Internal
- B. Financial
- C. Customer
Answer: A
Explanation:
Explanation
The IT balanced scorecard (BSC) is a tool that helps to measure and communicate the achievement of IT goals in relation to enterprise goals, using four dimensions: financial, customer, internal, and learning and growth. The alignment goal titled "Enabling and supporting business processes by integrating applications and technology" is aligned to the internal dimension of the IT BSC, as it relates to the efficiency and effectiveness of IT processes that support business processes2, p. 20. References: 2: COBIT 2019 Framework: Governance and Management Objectives
NEW QUESTION # 21
Which of the following is a KEY principle associated with the Accountable (A) role of an organizational structure?
- A. Accountability must be approved by the board.
- B. Accountability cannot be shared.
- C. Accountability can be delegated.
Answer: B
NEW QUESTION # 22
At which stage of the EGIT implementation life cycle should the enterprise determine the impact of an improvement program on IT and the business and how to maintain the improvement momentum?
- A. When defining the EGIT implementation road map
- B. When developing the EGIT implementation program plan
- C. When initiating an EGIT program
- D. When executing the EGIT implementation program plan
Answer: B
Explanation:
Explanation
The EGIT implementation life cycle consists of four stages: initiating an EGIT program, defining the EGIT implementation road map, developing the EGIT implementation program plan, and executing the EGIT implementation program plan. The third stage, developing the EGIT implementation program plan, involves identifying and defining the success metrics for the EGIT continual improvement program. These metrics should be aligned with the enterprise goals and objectives, and should measure the performance and outcomes of the EGIT processes and practices. The success metrics should also be SMART (specific, measurable, achievable, relevant, and time-bound), and should be communicated to all stakeholders involved in the EGIT program. References: : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 26 1 : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 41
NEW QUESTION # 23
Which of the following components should be considered for inclusion when considering the threat landscape design factor?
- A. Impact and probability levels
- B. Information flows including security policy
- C. Compliance and assurance capabilities
- D. Information security focus areas
Answer: D
Explanation:
The component that should be considered for inclusion when considering the threat landscape design factor is information security focus areas. The threat landscape is one of the 11 design factors defined in COBIT 2019, and it refers to the current and emerging threats that may affect the enterprise's information and technology assets, such as cyberattacks, natural disasters, human errors, etc. Information security focus areas are the specific domains or topics that need to be addressed by the governance system to ensure adequate protection of information and technology assets from potential threats, such as identity and access management, data protection, incident response, etc. The answer is based on the COBIT 2019 Design Guide4, page 17.
References: 4: COBIT 2019 Design Guide | Digital | English
NEW QUESTION # 24
l&T-related issues should be considered as part of the design factors for a governance system in order to manage:
- A. risks that have a high impact.
- B. risks that have a high probability.
- C. risks that could materialize.
- D. risks that have already materialized.
Answer: A
Explanation:
According to the COBIT 2019 Framework, L&T-related issues should be considered as part of the design factors for a governance system in order to manage risks that have a high impact. This includes considering the current and potential implications of the L&T-related risks, determining the maximum acceptable levels of risk for the organization and designing the governance system to minimize the risk to acceptable levels. This is outlined in the COBIT Governance of Enterprise IT (GEIT) section of the framework.
NEW QUESTION # 25
Which of the following criteria must be met for a process to meet a higher capability level?
- A. Capability is demonstrated on the most relevant process activities.
- B. All activities of that level are successfully performed.
- C. An identified subset of the activities of that level can be executed effectively.
Answer: B
Explanation:
A process can meet a higher capability level if all activities of that level are successfully performed, in addition to the activities of lower levels. The capability levels range from 0 (incomplete) to 5 (optimizing), and each level has a set of generic attributes that describe the expected performance of the process activities 2
, p. 30. References: 2 : COBIT 2019 Framework: Introduction and Methodology
NEW QUESTION # 26
The enterprise goal titled "Optimization of Business Process Costs" is aligned to which balanced scorecard (BSC) dimension?
- A. Internal
- B. Growth
- C. Customer
Answer: A
Explanation:
The enterprise goal titled "Optimization of Business Process Costs" is aligned to the internal dimension of the balanced scorecard (BSC). The internal dimension focuses on the efficiency and effectiveness of the business processes that deliver value to customers and stakeholders. Optimization of business process costs is one of the 17 generic enterprise goals defined by COBIT that supports the internal dimension.12 References:
COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives
NEW QUESTION # 27
Which of the following is the BEST starting point when translating enterprise goals into actionable governance and management objectives?
- A. Generic enterprise goals
- B. Prioritized enterprise goals
- C. Risk-based enterprise goals
- D. Selective enterprise goals
Answer: B
Explanation:
The best starting point when translating enterprise goals into actionable governance and management objectives is prioritized enterprise goals. The enterprise goals are the high-level statements of what an enterprise wants to achieve in terms of its mission, vision, values, strategy, etc. The enterprise goals are aligned with the stakeholder needs that reflect the expectations and requirements of various internal and external parties that have an interest or stake in the enterprise's information and technology activities. The prioritized enterprise goals are the subset of enterprise goals that have been ranked according to their importance or urgency for the enterprise based on its context and needs. By starting with prioritized enterprise goals when translating them into actionable governance and management objectives, an enterprise can ensure that it focuses on the most critical aspects of its information and technology governance that support its strategy and objectives. This will also help to align its information and technology activities with its stakeholder needs34 References: 3: COBIT 2019 Framework: Introduction and Methodology: page 25-26 4:
COBIT 2019 Design Guide: page 35-36
NEW QUESTION # 28
Which of the following functions would be responsible for executing a contract that retains independent legal consultants to review the level of regulatory compliance of a proposed IT solution?
- A. Procurement office
- B. Executive leadership team
- C. l&T security
- D. Legal office
Answer: D
Explanation:
The legal office is a function that provides legal advice and support to an enterprise on various matters related to its information and technology activities. The legal office also ensures that the enterprise complies with the applicable laws, regulations, standards, guidelines, contracts, or agreements that govern its information and technology activities. One of the responsibilities of the legal office is to execute contracts that retain independent legal consultants to review the level of regulatory compliance of a proposed IT solution.
This means that the legal office is responsible for negotiating, drafting, signing, and enforcing contracts with external legal experts who can provide independent and objective assessment of the compliance status of an IT solution that an enterprise intends to implement or use. The legal office also ensures that the contracts are aligned with the enterprise's strategy, objectives, needs, and expectations, as well as with the relevant compliance requirements34 References: 3: COBIT 2019 Framework: Governance and Management Objectives: page 20-21 4: COBIT 2019 Design Guide: page 47-48
NEW QUESTION # 29
Which of the following is an example of a focus area within COBIT?
- A. Robotic process automation
- B. Internet of Things
- C. Digital transformation
Answer: C
NEW QUESTION # 30
Which of the following roles should be involved when nominating key program roles to create the appropriate governance environment?
- A. Human resources
- B. Business management
- C. IT management
- D. Board and executives
Answer: D
Explanation:
Explanation
The key program roles are the roles that are responsible for leading, directing, managing, supporting, and executing the EGIT implementation program. The nomination of these roles is a critical step in creating the appropriate governance environment for the program. One of the roles that should be involved in this nomination process is the board and executives, who are the highest-level governance body and decision makers in an enterprise. The board and executives provide strategic direction, oversight, guidance, and approval for the EGIT implementation program. They also ensure that the program is aligned with the enterprise's vision, mission, values, strategy, goals, and objectives. The board and executives also appoint or endorse other key program roles such as the program sponsor, program manager, program steering committee, change champion network, etc.References: : COBIT 2019 Implementation Guide, page 37-38 : COBIT 2019 Framework: Governance and Management Objectives, page 19-20
NEW QUESTION # 31
At which stage of the EGIT implementation life cycle should the enterprise determine the impact of an improvement program on IT and the business and how to maintain the improvement momentum?
- A. When defining the EGIT implementation road map
- B. When developing the EGIT implementation program plan
- C. When initiating an EGIT program
- D. When executing the EGIT implementation program plan
Answer: B
Explanation:
The EGIT implementation life cycle consists of four stages: initiating an EGIT program, defining the EGIT implementation road map, developing the EGIT implementation program plan, and executing the EGIT implementation program plan. The third stage, developing the EGIT implementation program plan, involves identifying and defining the success metrics for the EGIT continual improvement program. These metrics should be aligned with the enterprise goals and objectives, and should measure the performance and outcomes of the EGIT processes and practices. The success metrics should also be SMART (specific, measurable, achievable, relevant, and time-bound), and should be communicated to all stakeholders involved in the EGIT program. References: : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 26 1 : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 41
NEW QUESTION # 32
Which of the following should a stakeholder do to optimize the use of COBIT?
- A. Customize COBIT guidance to meet industry best practices.
- B. Ensure COBIT guidance is strictly followed without alterations.
- C. Customize COBIT guidance to meet specific enterprise needs.
Answer: C
Explanation:
Customizable solution that can address the unique needs of any enterprise.
Reference: https://www.escoute.com/finally-a-guide-for-tailoring-a-governance-system-for-information-and- technology/
NEW QUESTION # 33
Which of the following is a KEY principle associated with the Accountable (A) role of an organizational structure?
- A. Accountability must be approved by the board.
- B. Accountability cannot be shared.
- C. Accountability can be delegated.
Answer: B
Explanation:
Explanation
A key principle associated with the Accountable (A) role of an organizational structure is that accountability cannot be shared. This means that only one person can be accountable for each activity or decision, and that person is ultimately liable for the success and achievement of the assigned tasks2, p. 34. References: 2:
COBIT 2019 Framework: Introduction and Methodology
NEW QUESTION # 34
When reviewing the risk profile of an enterprise during the governance design phase, what MUST be established prior to conducting a high-level risk analysis?
- A. Risk response strategy
- B. Risk management framework
- C. Key risk indicators (KRIs)
- D. Enterprise's risk appetite
Answer: D
Explanation:
Before conducting a high-level risk analysis during the governance design phase, it is necessary to establish the Enterprise's risk appetite (Option C). The enterprise's risk appetite is a statement of the level of risk that an organization is willing to accept in pursuit of its objectives. This information helps in setting the scope and objectives of the risk analysis, as well as guiding decisions on which risks to prioritize and manage. Understanding the enterprise's risk appetite is crucial in order to effectively assess and manage risks, and to align the governance framework with the enterprise's risk management goals and objectives.
According to the ISACA COBIT 2019 official Manual, it is important to establish the enterprise's risk appetite prior to conducting a high-level risk analysis to ensure that the risk profile and risk assessment results are evaluated within the context of the organization's risk appetite and comfort zone. The risk appetite should be documented and approved by the board of directors or the governing body and should be used to determine the acceptable level of risk the organization is willing to bear.
NEW QUESTION # 35
Which role is responsible for managing the development, implementation, evaluation and ongoing maintenance of new and existing products and services?
- A. Product manager
- B. Service manager
- C. Business process owner
Answer: B
Explanation:
Explanation
According to the COBIT 2019 Design Guide, a service manager is responsible for managing the development, implementation, evaluation and ongoing maintenance of new and existing products and services. A service manager ensures that the products and services meet the needs and expectations of the customers and stakeholders, and that they are aligned with the enterprise strategy and objectives. A service manager also monitors and reports on the performance and quality of the products and services, and initiates improvement actions when necessary.1, p. 64 References: 1: COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution
NEW QUESTION # 36
Which of the following should a stakeholder do to optimize the use of COBIT?
- A. Customize COBIT guidance to meet industry best practices.
- B. Ensure COBIT guidance is strictly followed without alterations.
- C. Customize COBIT guidance to meet specific enterprise needs.
Answer: C
Explanation:
Customizable solution that can address the unique needs of any enterprise.
NEW QUESTION # 37
Which of the following is the PRIMARY benefit or output derived from setting targeted capability levels and performing a capability-level gap analysis for selected processes?
- A. Identification and mitigation of all identified risks
- B. Identification of process improvement opportunities
- C. Development of enterprise goals that align to established targets
- D. Development of a business case outline
Answer: B
Explanation:
Explanation
The capability levels are a measure of how well an enterprise performs its information and technology governance and management processes in terms of process attributes such as process performance, process definition, process deployment, process measurement, process control, process optimization etc. The capability levels range from 0 (incomplete) to 5 (optimizing), indicating the degree of maturity and effectiveness of an enterprise's information and technology governance and management processes. The targeted capability levels are the desired levels of performance that an enterprise wants to achieve for its information and technology governance and management processes, based on its strategy, objectives, needs, and expectations. The targeted capability levels provide a basis for defining the improvement goals and objectives for the processes. The capability-level gap analysis is a process that involves comparing the current capability levels of an enterprise's information and technology governance and management processes with the targeted capability levels, and identifying the gaps or differences between them. The capability-level gap analysis helps to determine the improvement actions and initiatives that are required to close the gaps and achieve the targeted capability levels. The primary benefit or output derived from setting targeted capability levels and performing a capability-level gap analysis for selected processes is identification of process improvement opportunities. This means that by setting targeted capability levels and performing a capability-level gap analysis for selected processes, an enterprise can identify the areas of weakness or inefficiency in its information and technology governance and management processes, and determine the potential solutions or enhancements that can improve its process performance, quality, value, etc. This will also help to align the information and technology governance system with the enterprise's strategy and objectives.References: : COBIT 2019 Design Guide: page 53-54 : COBIT 2019 Process Assessment Model:
page 11-13
NEW QUESTION # 38
The enterprise goal of compliance with external laws and regulations is aligned to which balanced scorecard (BSC) dimension?
- A. Financial
- B. Growth
- C. Internal
Answer: A
Explanation:
Explanation
The enterprise goal of compliance with external laws and regulations is aligned to the financial dimension of the balanced scorecard (BSC). The BSC is a strategic performance management tool that helps enterprises to translate their vision and strategy into operational objectives and measures. The BSC consists of four dimensions: financial, customer, internal, and growth. The financial dimension focuses on the financial performance and value creation of the enterprise. Compliance with external laws and regulations is one of the
17 generic enterprise goals defined by COBIT that supports the financial dimension.12 References: COBIT
2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives
NEW QUESTION # 39
Which of the following inputs MUST be defined before the planning for a new governance framework can be finalized?
- A. Performance management
- B. Enterprise goals
- C. Implementation costs
- D. Risk frameworks
Answer: B
Explanation:
The planning for a new governance framework requires defining the inputs that will guide the design and implementation of the framework. One of the most important inputs is the enterprise goals, which are the high- level statements of what the enterprise wants to achieve in terms of its mission, vision, values, and strategy.
The enterprise goals provide the direction and purpose for the governance framework, and help to align the governance objectives, enablers, principles, and practices with the enterprise's needs and expectations. The enterprise goals also help to identify the relevant stakeholders, their roles and responsibilities, and their requirements and expectations from the governance framework 3 4 References: 3 : COBIT 2019 Framework: Introduction and Methodology, page 25-26 4 : COBIT 2019 Design Guide, page 23-24
NEW QUESTION # 40
Which of the following metrics would BEST enable an enterprise to evaluate an alignment goal specifically related to security of information and privacy?
- A. Ratio and extent of erroneous business decisions in which erroneous I&T-related information was a key factor
- B. Number of critical business processes supported by up-to-date infrastructure and applications
- C. Number of confidentiality incidents causing financial loss, business disruption or public embarrassment.
Answer: C
Explanation:
The number of confidentiality incidents causing financial loss, business disruption or public embarrassment would be the best metric to enable an enterprise to evaluate an alignment goal specifically related to security of information and privacy. A metric is a quantifiable measure that is used to track and assess the status of a specific process or activity. An alignment goal is an intermediate goal that links the enterprise goals with the governance and management objectives. Security of information and privacy is one of the 17 generic alignment goals defined by COBIT that describes how information and technology can support the protection of sensitive information and personal data. The number of confidentiality incidents causing financial loss, business disruption or public embarrassment is a metric that reflects how well this alignment goal is achieved.
12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework:
Governance System
NEW QUESTION # 41
......
Reliable Study Materials for COBIT-2019 Exam Success For Sure: https://ensurepass.testkingfree.com/ISACA/COBIT-2019-practice-exam-dumps.html