COBIT-2019-Foundation Sample Questions & Answers

The 'Culture, Ethics, and Behavior' component of the COBIT 2019 governance system directly addresses the 'people' side of governance. It emphasizes that the individual and collective behavior within an enterprise is a critical success factor for achieving governance and management objectives. The other components are important but do not specifically focus on the organization's underlying values and behavioral norms.

The core purpose of governing and managing enterprise I&T is value creation. COBIT defines this as realizing benefits at an optimal resource cost while optimizing risk. This involves a careful balance among three key elements: benefit realization, risk optimization, and resource optimization. This concept is fundamental to justifying any governance initiative.

Phase 2, 'Where are we now?', is focused on understanding the current state. The most direct and critical activity for this is conducting a process capability assessment. This assessment measures the current performance of selected processes against the COBIT model, providing a clear baseline of the organization's maturity and identifying specific weaknesses that need to be addressed in later phases. Identifying stakeholders (Phase 1) and defining project plans (Phase 4) occur in different phases.

The purpose of BAI06 Managed IT Changes is to enable fast and reliable delivery of change to the business while mitigating the risk of negatively impacting the stability or integrity of the changed environment. This objective includes practices for change request management, impact assessment, authorization, testing, and deployment, directly addressing the issues found by the audit team.

One of the three principles for a governance framework is that it should be 'Aligned to major standards.' COBIT 2019 is not intended to replace other frameworks but to act as an overarching 'umbrella' framework. It explicitly aligns with and references a wide range of relevant standards and frameworks, allowing an organization to integrate them into a single, cohesive governance system.

A core practice within the 'Information' component is the creation and maintenance of a comprehensive information model and classification scheme. This scheme is what allows the agency to categorize data based on criteria like sensitivity, criticality, and regulatory requirements (e.g., public, internal, confidential, restricted). This classification then dictates the security controls, access rights, and handling procedures for that data.

The 'Sourcing Model for I&T' design factor specifically addresses how an enterprise obtains its IT services and infrastructure. This includes options like outsourcing (cloud), insourcing (on-premises), or a hybrid approach. The choice of sourcing model significantly impacts which governance and management objectives need to be prioritized (e.g., APO10 Managed Suppliers becomes more critical in a cloud model).

DSS04 Managed Continuity is specifically focused on establishing and maintaining a plan to enable the business and IT to respond to incidents and disruptions in order to continue operation of critical business processes and required IT services. This includes business impact analysis (BIA), developing recovery plans, and testing those plans to ensure resilience.

This statement is false. The COBIT Performance Management model, which is aligned with CMMI, is staged. To achieve a specific capability level, a process must achieve that level's attributes AND have fully achieved all attributes of the preceding lower levels. For example, to be rated at capability level 4, a process must have a 'Fully' achieved rating for levels 1, 2, and 3, and at least a 'Largely' achieved rating for level 4.

APO05 Managed Portfolio is the most appropriate objective. Its purpose is to manage the portfolio of I&T-enabled investment programs to minimize investment risk and deliver optimal value. This involves defining an investment portfolio, evaluating new investments against it, managing the lifecycle of services and applications, and reporting on portfolio performance. This directly addresses RetailCo's need for a structured process to evaluate, select, and manage their fragmented IT investments to ensure strategic alignment.