ISACA COBIT 2019 Practice Exams
Last updated on Oct 21,2026- Exam Code: COBIT 2019
- Exam Name: COBIT 2019 Foundation
- Certification Provider: ISACA
- Latest update: Oct 21,2026
Question #1
What is the PRIMARY benefit of conducting a high-level risk analysis during governance design?
- A . Establishing a risk response strategy
- B . Identifying enterprise key risk indicators (KRl)
- C . Prioritizing governance and management objectives
- D . Communicating IT and business risk scenarios
Correct Answer: C
C
Explanation:
The high-level risk analysis is a process that involves identifying, assessing, and prioritizing the information and technology risks that an enterprise faces in relation to its governance system design. The high-level risk analysis helps to determine the level of risk appetite and tolerance that an enterprise has for its information and technology activities, as well as the level of control and assurance that is required for its governance framework. The primary benefit of conducting a high-level risk analysis during governance design is to prioritize governance and management objectives. The governance and management objectives are the statements of what an enterprise wants to achieve in terms of its information and technology governance. The governance and management objectives are derived from the enterprise goals, which are the high-level statements of what an enterprise wants to achieve in terms of its mission, vision, values, and strategy. By conducting a high-level risk analysis, an enterprise can identify the areas of risk that have the most impact on its enterprise goals, and therefore prioritize the governance and management objectives that address those risks. This will also help to align the governance framework with the enterprise’s strategy and objectives12
Reference: 1: COBIT 2019 Design Guide: page 41-43 2: COBIT 2019 Framework: Introduction and Methodology: page 25-26
C
Explanation:
The high-level risk analysis is a process that involves identifying, assessing, and prioritizing the information and technology risks that an enterprise faces in relation to its governance system design. The high-level risk analysis helps to determine the level of risk appetite and tolerance that an enterprise has for its information and technology activities, as well as the level of control and assurance that is required for its governance framework. The primary benefit of conducting a high-level risk analysis during governance design is to prioritize governance and management objectives. The governance and management objectives are the statements of what an enterprise wants to achieve in terms of its information and technology governance. The governance and management objectives are derived from the enterprise goals, which are the high-level statements of what an enterprise wants to achieve in terms of its mission, vision, values, and strategy. By conducting a high-level risk analysis, an enterprise can identify the areas of risk that have the most impact on its enterprise goals, and therefore prioritize the governance and management objectives that address those risks. This will also help to align the governance framework with the enterprise’s strategy and objectives12
Reference: 1: COBIT 2019 Design Guide: page 41-43 2: COBIT 2019 Framework: Introduction and Methodology: page 25-26
Question #2
Which of the following is CRITICAL to ensuring I&T-related decisions are aligned with the enterprise’s strategies and objectives?
- A . Compliance with legal, contractual and regulatory requirements is confirmed.
- B . Technology and innovation processes are overseen by the board.
- C . Assurance on controls is obtained from independent IT auditors.
Correct Answer: B
B
Explanation:
The oversight of technology and innovation processes by the board is critical to ensuring I&T-related decisions are aligned with the enterprise’s strategies and objectives. The board is the highest governing body of the enterprise that provides direction, oversight, and accountability for the enterprise’s performance. Technology and innovation processes are the activities that enable the enterprise to leverage information and technology to create value, achieve strategic goals, and respond to changing business needs. The oversight of technology and innovation processes by the board ensures that I&T-related decisions are consistent with the enterprise’s vision, mission, values, policies, and risk appetite.13
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System
B
Explanation:
The oversight of technology and innovation processes by the board is critical to ensuring I&T-related decisions are aligned with the enterprise’s strategies and objectives. The board is the highest governing body of the enterprise that provides direction, oversight, and accountability for the enterprise’s performance. Technology and innovation processes are the activities that enable the enterprise to leverage information and technology to create value, achieve strategic goals, and respond to changing business needs. The oversight of technology and innovation processes by the board ensures that I&T-related decisions are consistent with the enterprise’s vision, mission, values, policies, and risk appetite.13
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System
Question #3
Which of the following components should be considered for inclusion when considering the threat landscape design factor?
- A . Compliance and assurance capabilities
- B . Impact and probability levels
- C . Information flows including security policy
- D . Information security focus areas
Correct Answer: D
D
Explanation:
The component that should be considered for inclusion when considering the threat landscape design factor is information security focus areas. The threat landscape is one of the 11 design factors defined in COBIT 2019, and it refers to the current and emerging threats that may affect the enterprise’s information and technology assets, such as cyberattacks, natural disasters, human errors, etc. Information security focus areas are the specific domains or topics that need to be addressed by the governance system to ensure adequate protection of information and technology assets from potential threats, such as identity and access management, data protection, incident response, etc. The answer is based on the COBIT 2019 Design Guide4, page 17.
Reference: 4: COBIT 2019 Design Guide | Digital | English
D
Explanation:
The component that should be considered for inclusion when considering the threat landscape design factor is information security focus areas. The threat landscape is one of the 11 design factors defined in COBIT 2019, and it refers to the current and emerging threats that may affect the enterprise’s information and technology assets, such as cyberattacks, natural disasters, human errors, etc. Information security focus areas are the specific domains or topics that need to be addressed by the governance system to ensure adequate protection of information and technology assets from potential threats, such as identity and access management, data protection, incident response, etc. The answer is based on the COBIT 2019 Design Guide4, page 17.
Reference: 4: COBIT 2019 Design Guide | Digital | English
Question #4
When defining a governance implementation roadmap. what is the NEXT step after planning the program?
- A . Initiate the
- B . Realize benefits.
- C . Review effectiveness.
- D . Execute the plan.
Correct Answer: D
D
Explanation:
The governance implementation roadmap is a document that outlines the steps and activities involved in designing and implementing a governance system for an enterprise using COBIT 2019. The governance implementation roadmap consists of seven phases: what are the drivers; where are we now; where do we want to be; what needs to be done; how do we get there; did we get there; how do we keep up momentum. The next step after planning the program is to execute the plan. This means that after developing a detailed business case and high-level program plan for implementing a governance system in phase four (what needs to be done), the enterprise should proceed to phase five (how do we get there), which involves executing the program plan according to the defined scope, approach, benefits, costs, risks, and timeline. This phase also involves managing the program resources, deliverables, quality, performance, and stakeholder expectations, as well as monitoring and controlling the program progress and outcomes.
Reference: COBIT 2019 Implementation Guide: page 41-42: COBIT 2019 Implementation Guide:
page 51-52
D
Explanation:
The governance implementation roadmap is a document that outlines the steps and activities involved in designing and implementing a governance system for an enterprise using COBIT 2019. The governance implementation roadmap consists of seven phases: what are the drivers; where are we now; where do we want to be; what needs to be done; how do we get there; did we get there; how do we keep up momentum. The next step after planning the program is to execute the plan. This means that after developing a detailed business case and high-level program plan for implementing a governance system in phase four (what needs to be done), the enterprise should proceed to phase five (how do we get there), which involves executing the program plan according to the defined scope, approach, benefits, costs, risks, and timeline. This phase also involves managing the program resources, deliverables, quality, performance, and stakeholder expectations, as well as monitoring and controlling the program progress and outcomes.
Reference: COBIT 2019 Implementation Guide: page 41-42: COBIT 2019 Implementation Guide:
page 51-52
Question #5
Which of the following should be involved in resolving conflicting priorities in order to finalize the governance system design?
- A . Change advisory board
- B . IT process owners
- C . Enterprise architects
- D . Management of the IT function
Correct Answer: D
D
Explanation:
The management of the IT function is the function that leads and manages the information and technology function in an enterprise, as well as supports and enables the information and technology governance. The management of the IT function includes roles such as CIO, IT managers, IT process owners, IT service owners, etc. The management of the IT function is responsible for resolving conflicting priorities in order to finalize the governance system design. The governance system design is the process of designing and implementing a governance system for an enterprise using COBIT 2019. The governance system design involves tailoring the COBIT 2019 components such as principles, enablers, goals, processes, practices, roles, structures, metrics etc., according to the enterprise’s context and needs. The governance system design also involves considering various design factors such as enterprise strategy archetype; enterprise goals; IT-related goals; risk profile; IT deployment; threat landscape; compliance requirement; operating environment; size of enterprise; culture; stakeholders; etc., that influence how an enterprise designs and implements its governance system using COBIT 2019. By resolving conflicting priorities in order to finalize the governance system design, the management of the IT function ensures that the governance system is appropriate for the enterprise’s strategy objectives performance risks issues opportunities etc., that it delivers value and benefits to the enterprise and its stakeholders that it aligns with the relevant standards guidelines regulations best practices etc., that it meets stakeholder requirements and expectations etc34
Reference: 3: COBIT 2019 Framework: Governance and Management Objectives: page 20-21 4: COBIT 2019 Design Guide: page 33-48
D
Explanation:
The management of the IT function is the function that leads and manages the information and technology function in an enterprise, as well as supports and enables the information and technology governance. The management of the IT function includes roles such as CIO, IT managers, IT process owners, IT service owners, etc. The management of the IT function is responsible for resolving conflicting priorities in order to finalize the governance system design. The governance system design is the process of designing and implementing a governance system for an enterprise using COBIT 2019. The governance system design involves tailoring the COBIT 2019 components such as principles, enablers, goals, processes, practices, roles, structures, metrics etc., according to the enterprise’s context and needs. The governance system design also involves considering various design factors such as enterprise strategy archetype; enterprise goals; IT-related goals; risk profile; IT deployment; threat landscape; compliance requirement; operating environment; size of enterprise; culture; stakeholders; etc., that influence how an enterprise designs and implements its governance system using COBIT 2019. By resolving conflicting priorities in order to finalize the governance system design, the management of the IT function ensures that the governance system is appropriate for the enterprise’s strategy objectives performance risks issues opportunities etc., that it delivers value and benefits to the enterprise and its stakeholders that it aligns with the relevant standards guidelines regulations best practices etc., that it meets stakeholder requirements and expectations etc34
Reference: 3: COBIT 2019 Framework: Governance and Management Objectives: page 20-21 4: COBIT 2019 Design Guide: page 33-48
Question #6
The alignment goal titled "Security of information, processing infrastructure and privacy" is part of which IT balanced scorecard (BSC) dimension?
- A . Internal
- B . Learning and growth
- C . Customer
Correct Answer: A
A
Explanation:
The alignment goal titled “Security of information, processing infrastructure and privacy” is part of the internal dimension of the IT BSC, as it relates to the protection of IT assets and information from unauthorized access, use, disclosure, modification, or destruction2, p. 20.
Reference: 2: COBIT 2019 Framework: Governance and Management Objectives
A
Explanation:
The alignment goal titled “Security of information, processing infrastructure and privacy” is part of the internal dimension of the IT BSC, as it relates to the protection of IT assets and information from unauthorized access, use, disclosure, modification, or destruction2, p. 20.
Reference: 2: COBIT 2019 Framework: Governance and Management Objectives
Question #7
Which of the following components is important to update in a COBIT RACI chart to align with the enterprise’s context, priorities and preferred terminology?
- A . Enterprise process practices and activities
- B . Enterprise roles and organizational structures
- C . Enterprise procedures and job descriptions
Correct Answer: B
B
Explanation:
The enterprise roles and organizational structures component is important to update in a COBIT RACI chart to align with the enterprise’s context, priorities and preferred terminology. A RACI chart is a tool that assigns different levels of responsibility, accountability, consultation, and information to roles and organizational structures for each governance and management objective. A RACI chart consists of four components: enterprise roles and organizational structures, governance and management objectives, enterprise process practices and activities, and RACI assignments. The enterprise roles and organizational structures component should be updated to reflect the specific roles and structures that exist in the enterprise, as well as their names and descriptions.13
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019
Framework: Roles, Responsibilities & RACI Charts
B
Explanation:
The enterprise roles and organizational structures component is important to update in a COBIT RACI chart to align with the enterprise’s context, priorities and preferred terminology. A RACI chart is a tool that assigns different levels of responsibility, accountability, consultation, and information to roles and organizational structures for each governance and management objective. A RACI chart consists of four components: enterprise roles and organizational structures, governance and management objectives, enterprise process practices and activities, and RACI assignments. The enterprise roles and organizational structures component should be updated to reflect the specific roles and structures that exist in the enterprise, as well as their names and descriptions.13
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019
Framework: Roles, Responsibilities & RACI Charts
Question #8
Which element of a business case BEST enables senior leadership to assess the future success of the IT governance program?
- A . Quantified benefits
- B . Qualitative perspective
- C . Investment justification
Correct Answer: C
C
Explanation:
The investment justification element of a business case best enables senior leadership to assess the future success of the IT governance program. A business case is a document that provides the rationale and evidence for initiating, continuing, or terminating a project or program. A business case typically consists of several elements, such as problem statement, objectives, scope, benefits, costs, risks, assumptions, etc. The investment justification element of a business case describes how the project or program aligns with the enterprise strategy and objectives, how it supports the value creation process, how it compares with alternative options, and how it provides a positive return on investment (ROI). The investment justification element enables senior leadership to assess the future success of the IT governance program by showing how it contributes to the enterprise goals and delivers value to the stakeholders.12
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution
C
Explanation:
The investment justification element of a business case best enables senior leadership to assess the future success of the IT governance program. A business case is a document that provides the rationale and evidence for initiating, continuing, or terminating a project or program. A business case typically consists of several elements, such as problem statement, objectives, scope, benefits, costs, risks, assumptions, etc. The investment justification element of a business case describes how the project or program aligns with the enterprise strategy and objectives, how it supports the value creation process, how it compares with alternative options, and how it provides a positive return on investment (ROI). The investment justification element enables senior leadership to assess the future success of the IT governance program by showing how it contributes to the enterprise goals and delivers value to the stakeholders.12
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution
Question #9
Which of the following components of a governance system translates desired behavior into practical guidance?
- A . Culture, ethics and behavior
- B . Principles, policies and frameworks
- C . People, skills and competencies
Correct Answer: B
B
Explanation:
The principles, policies and frameworks component of a governance system translates desired behavior into practical guidance. Principles are the fundamental norms or rules that guide decision-making and actions. Policies are the statements of intent or direction that define what is expected or required. Frameworks are the conceptual models or structures that define the key elements, relationships, and principles of a system. The principles, policies and frameworks component of a governance system translates desired behavior into practical guidance by providing a consistent and coherent basis for information and technology governance and management.14
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System
B
Explanation:
The principles, policies and frameworks component of a governance system translates desired behavior into practical guidance. Principles are the fundamental norms or rules that guide decision-making and actions. Policies are the statements of intent or direction that define what is expected or required. Frameworks are the conceptual models or structures that define the key elements, relationships, and principles of a system. The principles, policies and frameworks component of a governance system translates desired behavior into practical guidance by providing a consistent and coherent basis for information and technology governance and management.14
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System
Question #10
When considering the role of IT design factor, and the design factor value is strategic, which of the following should be a management objective priority?
- A . Managed innovation (APO04)
- B . Managed quality (AP011)
- C . Managed relationships (APO08)
- D . Managed budget and costs (APO06)
Correct Answer: A
A
Explanation:
The IT design factor is a design factor that describes how an enterprise uses information and technology to achieve its goals and objectives. There are six IT design factors defined in COBIT 2019: strategic; operational; data-driven; compliance-driven; innovation-driven; customer intimacy-driven. Each design factor has different implications for the governance and management of information and technology in terms of focus areas, processes, practices, roles, structures, and metrics. When considering the role of IT design factor, and the design factor value is strategic, one of the management objectives that should be a priority is managed innovation (APO04), which involves identifying new opportunities for using information and technology to create value for the enterprise. This management objective supports the strategic role of IT in enabling business transformation, differentiation, competitiveness, growth, and sustainability. This management objective also involves establishing an innovation culture and process that encourages creativity, experimentation, collaboration, learning, and improvement5
Reference: 5: COBIT 2019 Design Guide: page 35-36: COBIT 2019 Process Reference Guide: page 57-59
A
Explanation:
The IT design factor is a design factor that describes how an enterprise uses information and technology to achieve its goals and objectives. There are six IT design factors defined in COBIT 2019: strategic; operational; data-driven; compliance-driven; innovation-driven; customer intimacy-driven. Each design factor has different implications for the governance and management of information and technology in terms of focus areas, processes, practices, roles, structures, and metrics. When considering the role of IT design factor, and the design factor value is strategic, one of the management objectives that should be a priority is managed innovation (APO04), which involves identifying new opportunities for using information and technology to create value for the enterprise. This management objective supports the strategic role of IT in enabling business transformation, differentiation, competitiveness, growth, and sustainability. This management objective also involves establishing an innovation culture and process that encourages creativity, experimentation, collaboration, learning, and improvement5
Reference: 5: COBIT 2019 Design Guide: page 35-36: COBIT 2019 Process Reference Guide: page 57-59