Free cobit-2019-design-and-implementation sample questions

Correct answer: The selected ERP system may not align with the defined target state and improvement plan.

Skipping Phase 3 ('Where do we want to be?') and Phase 4 ('What needs to be done?') means no target state has been defined and no detailed improvement plan has been created. Purchasing a solution without this context risks misalignment with actual business needs and strategic goals, leading to wasted investment and unresolved governance gaps.

Correct answer: It prioritizes objectives related to agility, innovation, and managing business change, such as BAI01 (Managed Programs) and BAI05 (Managed Organizational Change).

A 'Growth/Acquisition' strategy demands the ability to rapidly integrate new businesses, manage complex programs of change, and innovate to capture new markets. Therefore, objectives focused on program management, organizational change, and innovation (like BAI02) become paramount.

Correct answers: Processes; Culture, ethics and behavior

In a DevOps environment, processes must be highly automated and integrated into the CI/CD pipeline. To meet regulatory and risk requirements, these processes (e.g., for change control, security testing, deployment) must be robust, auditable, and efficient, making their design critical.

DevOps relies heavily on a culture of shared responsibility ('you build it, you run it'). In a high-risk, regulated environment, fostering a strong culture of security, compliance, and ethical behavior ('DevSecOps') is paramount to prevent catastrophic failures. This cultural component is as critical as the automated processes.

Correct answer: MEA01 Managed Performance and Conformance Monitoring

MEA01 is specifically designed to monitor performance against agreed-upon targets and ensure conformance with requirements. This directly supports the objective of Phase 6, which is to track progress, measure benefits realization, and report on the achievement of business case goals.

Correct answer: False

This is false. The essence of the COBIT 2019 design process is to tailor the governance system, including target capability levels, to the specific needs and context of the enterprise. The Design Guide provides suggested levels based on design factors, but these are inputs to the decision, not mandatory prescriptions.

Correct answer: It suggests a higher target capability level is needed to ensure security processes are well-defined, managed, and optimized.

A sophisticated threat landscape necessitates a mature and robust security posture. This translates to requiring a higher target capability level (e.g., 3, 4, or 5) for DSS05 to ensure security processes are not just performed, but are well-defined, quantitatively managed, and continuously optimized to counter advanced threats.

Correct answer: Board of Directors / Governing Body

In COBIT, the governing body (e.g., Board of Directors) is ultimately Accountable (A) for governance, which includes setting the direction for risk management and approving the enterprise risk policy. This aligns with their fiduciary duty to oversee risk for the entire organization.

Correct answer: AG05 Delivery of I&T services in line with business requirements.

The alignment goal AG05 directly addresses the need for I&T to deliver services that meet the expectations and requirements of the business, which in this case are defined by the customer-oriented service culture. This includes service levels, quality, and responsiveness to customer needs.

Correct answer: Implement ongoing monitoring of continuity plan testing metrics and regularly report them to the risk committee.

Phase 7 is about sustaining the improvements. The most effective way to do this is to embed the new way of working into ongoing operations through continuous monitoring and reporting. Tracking metrics and reporting to a governance body like the risk committee ensures visibility, accountability, and a driver for continuous improvement.

Correct answer: The design would prioritize high capability levels for compliance and risk processes (e.g., MEA03, APO12), while accepting lower levels for innovation and agility processes (e.g., BAI02, APO04).

This represents a balanced resolution. The design must meet the non-negotiable compliance requirements, dictating high capability for processes like MEA03 (Managed Compliance) and APO12 (Managed Risk). The 'Slow/Follower' tech strategy means the agency can de-prioritize and accept lower capability in areas related to innovation and managing emerging technologies, thus resolving the conflict.