ISACA COBIT 2019 Practice Exams
Last updated on Oct 21,2026- Exam Code: COBIT 2019
- Exam Name: COBIT 2019 Foundation
- Certification Provider: ISACA
- Latest update: Oct 21,2026
Question #31
Time-to-market is a metric that is directly related to which of the following enterprise goals?
- A . Managed digital transformation programs
- B . Optimization of internal business process functionality
- C . Portfolio of competitive products and services
Correct Answer: C
C
Explanation:
In COBIT 2019, "Time-to-market" is closely associated with the enterprise goal of maintaining a portfolio of competitive products and services. This metric reflects the enterprise’s ability to deliver new offerings to the market efficiently, which is essential for competitive advantage. The COBIT goals cascade links time-to-market to this objective, emphasizing the importance of quick responsiveness to market demands as part of enterprise strategy.
C
Explanation:
In COBIT 2019, "Time-to-market" is closely associated with the enterprise goal of maintaining a portfolio of competitive products and services. This metric reflects the enterprise’s ability to deliver new offerings to the market efficiently, which is essential for competitive advantage. The COBIT goals cascade links time-to-market to this objective, emphasizing the importance of quick responsiveness to market demands as part of enterprise strategy.
Question #32
Which of the following is an output of the "what needs to be done" phase?
- A . Risk response document
- B . Identified quick wins
- C . High-level program plan
- D . Detailed business case
Correct Answer: C
C
Explanation:
The high-level program plan is a document that describes the rationale, objectives, scope, approach, benefits, costs, risks, and timeline of the EGIT implementation program. The EGIT implementation program is a program that involves designing and implementing a governance system for an enterprise using COBIT 2019. The high-level program plan provides the basis for obtaining approval, funding, resources, and support for the program from the stakeholders. The high-level program plan is an output of the “what needs to be done” phase. The “what needs to be done” phase is the fourth phase of the governance implementation roadmap, which involves defining the target state of information and technology governance in an enterprise that is aligned with its strategy, objectives, and stakeholder needs. This phase also involves identifying the gaps and issues that need to be addressed to achieve the target state, setting the improvement targets and priorities, developing a detailed business case and a high-level program plan for implementing a governance system using COBIT 2019. By developing a high-level program plan as an output of the “what needs to be done” phase, an enterprise can ensure that it has a clear and realistic roadmap for designing and implementing a governance system using COBIT 2019, that it has defined the expected outcomes, benefits, value, etc., from doing so, that it has considered the relevant risks, costs, resources, etc., involved in doing so, that it has obtained stakeholder buy-in and commitment for doing so, etc.
Reference: COBIT 2019 Implementation Guide: page 39-40: COBIT 2019 Implementation Guide: page 41-42
C
Explanation:
The high-level program plan is a document that describes the rationale, objectives, scope, approach, benefits, costs, risks, and timeline of the EGIT implementation program. The EGIT implementation program is a program that involves designing and implementing a governance system for an enterprise using COBIT 2019. The high-level program plan provides the basis for obtaining approval, funding, resources, and support for the program from the stakeholders. The high-level program plan is an output of the “what needs to be done” phase. The “what needs to be done” phase is the fourth phase of the governance implementation roadmap, which involves defining the target state of information and technology governance in an enterprise that is aligned with its strategy, objectives, and stakeholder needs. This phase also involves identifying the gaps and issues that need to be addressed to achieve the target state, setting the improvement targets and priorities, developing a detailed business case and a high-level program plan for implementing a governance system using COBIT 2019. By developing a high-level program plan as an output of the “what needs to be done” phase, an enterprise can ensure that it has a clear and realistic roadmap for designing and implementing a governance system using COBIT 2019, that it has defined the expected outcomes, benefits, value, etc., from doing so, that it has considered the relevant risks, costs, resources, etc., involved in doing so, that it has obtained stakeholder buy-in and commitment for doing so, etc.
Reference: COBIT 2019 Implementation Guide: page 39-40: COBIT 2019 Implementation Guide: page 41-42
Question #33
An enterprise’s business line managers have voiced concerns because the cost of governance-required improvements is perceived as too expensive.
How can the IT governance team BEST address this concern?
- A . Improve the communication of business benefits.
- B . Involve business line managers in the improvement planning process.
- C . Share the return on investment (ROI) analysis.
Correct Answer: C
C
Explanation:
Sharing the return on investment (ROI) analysis is the best way to address the concern of business line managers who perceive the cost of governance-required improvements as too expensive. ROI is a financial metric that measures the profitability or efficiency of an investment by comparing its benefits and costs. ROI analysis is a process of calculating and presenting the ROI of a project or program, as well as its assumptions, risks, and uncertainties. Sharing the ROI analysis with business line managers can help to address their concern by showing them how the governance-required improvements will generate value for the enterprise in terms of increased revenue, reduced costs, enhanced performance, improved quality, etc., as well as how they will outweigh their initial and ongoing costs.12
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution
C
Explanation:
Sharing the return on investment (ROI) analysis is the best way to address the concern of business line managers who perceive the cost of governance-required improvements as too expensive. ROI is a financial metric that measures the profitability or efficiency of an investment by comparing its benefits and costs. ROI analysis is a process of calculating and presenting the ROI of a project or program, as well as its assumptions, risks, and uncertainties. Sharing the ROI analysis with business line managers can help to address their concern by showing them how the governance-required improvements will generate value for the enterprise in terms of increased revenue, reduced costs, enhanced performance, improved quality, etc., as well as how they will outweigh their initial and ongoing costs.12
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution
Question #34
The number of focus areas describing a certain governance topic or issue that can be addressed by governance objectives is:
- A . dependent on process maturity
- B . determined by the size of the enterprise
- C . virtually unlimited
Correct Answer: C
C
Explanation:
The number of focus areas describing a certain governance topic or issue that can be addressed by governance objectives is virtually unlimited. Focus areas are topics or issues that can be addressed by governance objectives, such as digital transformation, cybersecurity, privacy, etc. Focus areas can be defined by any stakeholder or group within or outside the enterprise, depending on their needs and interests. COBIT provides examples of some common focus areas, but they are not exhaustive or prescriptive.13
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution
C
Explanation:
The number of focus areas describing a certain governance topic or issue that can be addressed by governance objectives is virtually unlimited. Focus areas are topics or issues that can be addressed by governance objectives, such as digital transformation, cybersecurity, privacy, etc. Focus areas can be defined by any stakeholder or group within or outside the enterprise, depending on their needs and interests. COBIT provides examples of some common focus areas, but they are not exhaustive or prescriptive.13
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution
Question #35
Which of the following is an important component for an enterprise strategy archetype of growth/acquisition as defined by COBIT 2019?
- A . Support for the portfolio management role with an investment office
- B . Important influence of culture and behavior component for innovation
- C . Skills and competencies
- D . Services, infrastructure, and applications component
Correct Answer: A
A
Explanation:
The enterprise strategy archetype is a design factor that describes how an enterprise uses information and technology to achieve its goals and objectives. There are six enterprise strategy archetypes defined in COBIT 2019: growth/acquisition; operational excellence; customer intimacy; product leadership; data-driven; innovation-driven. Each archetype has different implications for the governance and management of information and technology in terms of focus areas, processes, practices, roles, structures, and metrics. One of the important components for an enterprise strategy archetype of growth/acquisition is support for the portfolio management role with an investment office. Growth/acquisition is a strategy archetype that emphasizes expanding market share, revenue, customer base, or product range through organic growth or acquisition of other businesses or assets. This strategy archetype requires effective portfolio management of information and technology investments and initiatives that support business growth or acquisition objectives. Portfolio management involves selecting, prioritizing, balancing, monitoring, evaluating, and optimizing information and technology investments and initiatives based on their alignment with business strategy, value delivery potential, risk exposure, resource availability, interdependencies, etc. Portfolio management also involves ensuring that information and technology investments and initiatives are integrated with business processes, systems, structures, culture, etc., especially in case of mergers or acquisitions. Support for the portfolio management role with an investment office means providing a dedicated function or unit that assists the portfolio manager in performing portfolio management activities such as planning, analysis, decision making, reporting, etc., as well as providing guidance, tools, methods, frameworks, standards, best practices etc., for portfolio management5
Reference: 5: COBIT 2019 Design Guide: page 35-36: COBIT 2019 Process Reference Guide: page 59-61
A
Explanation:
The enterprise strategy archetype is a design factor that describes how an enterprise uses information and technology to achieve its goals and objectives. There are six enterprise strategy archetypes defined in COBIT 2019: growth/acquisition; operational excellence; customer intimacy; product leadership; data-driven; innovation-driven. Each archetype has different implications for the governance and management of information and technology in terms of focus areas, processes, practices, roles, structures, and metrics. One of the important components for an enterprise strategy archetype of growth/acquisition is support for the portfolio management role with an investment office. Growth/acquisition is a strategy archetype that emphasizes expanding market share, revenue, customer base, or product range through organic growth or acquisition of other businesses or assets. This strategy archetype requires effective portfolio management of information and technology investments and initiatives that support business growth or acquisition objectives. Portfolio management involves selecting, prioritizing, balancing, monitoring, evaluating, and optimizing information and technology investments and initiatives based on their alignment with business strategy, value delivery potential, risk exposure, resource availability, interdependencies, etc. Portfolio management also involves ensuring that information and technology investments and initiatives are integrated with business processes, systems, structures, culture, etc., especially in case of mergers or acquisitions. Support for the portfolio management role with an investment office means providing a dedicated function or unit that assists the portfolio manager in performing portfolio management activities such as planning, analysis, decision making, reporting, etc., as well as providing guidance, tools, methods, frameworks, standards, best practices etc., for portfolio management5
Reference: 5: COBIT 2019 Design Guide: page 35-36: COBIT 2019 Process Reference Guide: page 59-61
Question #36
Which of the following statements BEST describes the features and properties of the COBIT 2019 governance system design workflow?
- A . The governance system design workflow allows for consideration of all design factors in order to develop a customized governance system.
- B . When executing the governance system design workflow, design factors that produce inconsistent priorities for governance and management objectives need to be discarded.
- C . The governance system design workflow only considers enterprise goals.
- D . When executing the governance system design workflow, reliable results can only be obtained by considering all design factors.
Correct Answer: A
A
Explanation:
The governance system design workflow is a workflow that describes how an enterprise can design and implement a governance system using COBIT 2019. The governance system design workflow consists of six steps: determine initial scope; identify relevant design factors; prioritize governance and management objectives; define target capability levels; identify gaps; finalize scope. The governance system design workflow allows for consideration of all design factors in order to develop a customized governance system. The design factors are the characteristics or conditions that influence how an enterprise designs and implements its governance system using COBIT 2019. The design factors include aspects such as enterprise strategy archetype; enterprise goals; IT-related goals; risk profile; IT deployment; threat landscape; compliance requirement; operating environment; size of enterprise; culture; stakeholders; etc. By considering all design factors in the governance system design workflow, an enterprise can ensure that its governance system is appropriate for its context and needs, that it delivers value and benefits to the enterprise and its stakeholders, that it aligns with the relevant standards, guidelines, regulations, best practices, etc., that it meets stakeholder requirements and expectations, etc.
Reference: COBIT 2019 Design Guide: page 33-48
A
Explanation:
The governance system design workflow is a workflow that describes how an enterprise can design and implement a governance system using COBIT 2019. The governance system design workflow consists of six steps: determine initial scope; identify relevant design factors; prioritize governance and management objectives; define target capability levels; identify gaps; finalize scope. The governance system design workflow allows for consideration of all design factors in order to develop a customized governance system. The design factors are the characteristics or conditions that influence how an enterprise designs and implements its governance system using COBIT 2019. The design factors include aspects such as enterprise strategy archetype; enterprise goals; IT-related goals; risk profile; IT deployment; threat landscape; compliance requirement; operating environment; size of enterprise; culture; stakeholders; etc. By considering all design factors in the governance system design workflow, an enterprise can ensure that its governance system is appropriate for its context and needs, that it delivers value and benefits to the enterprise and its stakeholders, that it aligns with the relevant standards, guidelines, regulations, best practices, etc., that it meets stakeholder requirements and expectations, etc.
Reference: COBIT 2019 Design Guide: page 33-48
Question #37
Which of the following enterprise risk management concepts is MOST important to fully understand prior to finalizing the design of an IT governance system?
- A . The enterprise’s risk tolerance
- B . The enterprise’s risk profile
- C . The enterprise’s risk appetite
Correct Answer: B
B
Explanation:
The enterprise’s risk profile is the most important enterprise risk management concept to fully understand prior to finalizing the design of an IT governance system. Enterprise risk management is the process of identifying, analyzing, evaluating, treating, monitoring, and communicating risks that affect the achievement of enterprise objectives. Enterprise risk management concepts include risk appetite (the amount and type of risk that an enterprise is willing to accept), risk tolerance (the acceptable variation in outcomes related to specific performance measures), risk profile (the overall exposure or level of risk that an enterprise faces), etc. The enterprise’s risk profile is the most important concept to fully understand prior to finalizing the design of an IT governance system because it helps to determine the appropriate level of risk optimization for each governance objective.14
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System
B
Explanation:
The enterprise’s risk profile is the most important enterprise risk management concept to fully understand prior to finalizing the design of an IT governance system. Enterprise risk management is the process of identifying, analyzing, evaluating, treating, monitoring, and communicating risks that affect the achievement of enterprise objectives. Enterprise risk management concepts include risk appetite (the amount and type of risk that an enterprise is willing to accept), risk tolerance (the acceptable variation in outcomes related to specific performance measures), risk profile (the overall exposure or level of risk that an enterprise faces), etc. The enterprise’s risk profile is the most important concept to fully understand prior to finalizing the design of an IT governance system because it helps to determine the appropriate level of risk optimization for each governance objective.14
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System
Question #38
Which of the following is a KEY input to be considered when defining drivers for a C08IT implementation?
- A . IT process documentation
- B . Business case outline
- C . Enterprise policies
- D . Stakeholder map
Correct Answer: B
B
Explanation:
The business case outline is a document that provides a high-level overview of the rationale, objectives, scope, approach, benefits, costs, risks, and timeline of the EGIT implementation program. The EGIT implementation program is a program that involves designing and implementing a governance system for an enterprise using COBIT 2019. The business case outline provides the basis for obtaining approval in principle from the stakeholders for initiating the EGIT implementation program. The business case outline is a key input to be considered when defining drivers for a COBIT implementation. The drivers are the internal and external factors that trigger or influence the need for designing and implementing a governance system for an enterprise using COBIT 2019. The drivers include aspects such as business strategy objectives performance risks issues opportunities etc., information and technology strategy objectives performance risks issues opportunities etc., stakeholder needs expectations requirements etc., standards guidelines regulations best practices etc., market conditions competitive pressures customer demands etc., etc. By considering the business case outline when defining drivers for a COBIT implementation an enterprise can ensure that it has a clear understanding of why it needs to design and implement a governance system using COBIT 2019 what are the expected outcomes benefits value etc.,
B
Explanation:
The business case outline is a document that provides a high-level overview of the rationale, objectives, scope, approach, benefits, costs, risks, and timeline of the EGIT implementation program. The EGIT implementation program is a program that involves designing and implementing a governance system for an enterprise using COBIT 2019. The business case outline provides the basis for obtaining approval in principle from the stakeholders for initiating the EGIT implementation program. The business case outline is a key input to be considered when defining drivers for a COBIT implementation. The drivers are the internal and external factors that trigger or influence the need for designing and implementing a governance system for an enterprise using COBIT 2019. The drivers include aspects such as business strategy objectives performance risks issues opportunities etc., information and technology strategy objectives performance risks issues opportunities etc., stakeholder needs expectations requirements etc., standards guidelines regulations best practices etc., market conditions competitive pressures customer demands etc., etc. By considering the business case outline when defining drivers for a COBIT implementation an enterprise can ensure that it has a clear understanding of why it needs to design and implement a governance system using COBIT 2019 what are the expected outcomes benefits value etc.,
Question #39
In the implementation model, when is IT governance implementation risk BEST managed?
- A . Throughout the life cycle
- B . During the planning phase
- C . Just prior to operationalization
Correct Answer: A
A
Explanation:
IT governance implementation risk is best managed throughout the life cycle of the implementation. IT governance implementation risk is the possibility of negative consequences or outcomes that may arise from the design, execution, evaluation, or improvement of the IT governance system. The life cycle of IT governance implementation is a continuous process that involves four phases: what are the drivers, where are we now, where do we want to be, and how do we get there. IT governance implementation risk should be managed throughout the life cycle by identifying, analyzing, evaluating, treating, monitoring, and communicating the risks that may affect the success of the implementation.12
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution
A
Explanation:
IT governance implementation risk is best managed throughout the life cycle of the implementation. IT governance implementation risk is the possibility of negative consequences or outcomes that may arise from the design, execution, evaluation, or improvement of the IT governance system. The life cycle of IT governance implementation is a continuous process that involves four phases: what are the drivers, where are we now, where do we want to be, and how do we get there. IT governance implementation risk should be managed throughout the life cycle by identifying, analyzing, evaluating, treating, monitoring, and communicating the risks that may affect the success of the implementation.12
Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution
Question #40
Ensuring the program team knows and understands the enterprise goals is a part of which of the following implementation phases?
- A . Where are we now?
- B . How do we get there?
- C . Where do we want to be?
- D . What are the drivers?
Correct Answer: C
C
Explanation:
Ensuring the program team knows and understands the enterprise goals is a part of the “Where do we want to be?” phase of the implementation. The implementation of a governance system is divided into seven phases, each with a set of activities and outputs. The “Where do we want to be?” phase involves defining the desired outcomes and target state of the governance system, based on the enterprise’s vision, mission, values, and goals. One of the activities in this phase is to ensure that the program team is aware of and aligned with the enterprise goals, as well as their roles and responsibilities in achieving them. The answer is based on the COBIT 2019 Implementation Guide2, page 34.
Reference: 2: COBIT 2019 Implementation Guide | Digital | English
C
Explanation:
Ensuring the program team knows and understands the enterprise goals is a part of the “Where do we want to be?” phase of the implementation. The implementation of a governance system is divided into seven phases, each with a set of activities and outputs. The “Where do we want to be?” phase involves defining the desired outcomes and target state of the governance system, based on the enterprise’s vision, mission, values, and goals. One of the activities in this phase is to ensure that the program team is aware of and aligned with the enterprise goals, as well as their roles and responsibilities in achieving them. The answer is based on the COBIT 2019 Implementation Guide2, page 34.
Reference: 2: COBIT 2019 Implementation Guide | Digital | English