Isaca NIST-COBIT-2019 Exam Questions Instant Access

Question 1

The activity of determining an appropriate target capability level for each process occurs within which implementation phase?

APhase 4 - What Needs to Be Done?

BPhase 3 - Where Do We Want to Be?

CPhase 2 - Where Are We Now?

Answer : B

The activity of determining an appropriate target capability level for each process occurs within Implementation Phase 3, as it helps to set an improvement target and identify gaps and potential solutions using COBIT's guidance. This involves creating a detailed business case and a high-level program plan for the implementation12.

Reference Defining Target Capability Levels in COBIT 2019: A Proposal for Refinement COBIT 2019 Design and Implementation COBIT Implementation, page 31.

Question 2

In which CSF step should an enterprise document its existing category and subcategory outcome achievements?

AStep 1: Prioritize and Scope

BStep 3: Create a Current Profile

CStep 4: Conduct a Risk Assessment

Answer : B

This CSF step involves documenting the existing category and subcategory outcome achievements, by using the implementation status to indicate the degree to which the cybersecurity outcomes defined by the CSF Subcategories are currently being achieved by the organization12. The Current Profile reflects the current cybersecurity posture of the organization, and helps to identify the gaps and opportunities for improvement3 .

Question 3

Which of the following is a PRIMARY input into Steps 2 and 3: Orient and Create a Current Profile?

AEvaluating business cases

BUpdating business cases

CDefining business cases

Answer : C

Defining business cases is a primary input into Steps 2 and 3: Orient and Create a Current Profile, because it involves identifying the business drivers, mission, objectives, and risk appetite of the organization, as well as the scope and boundaries of the cybersecurity program12. A business case is a document that provides the rationale and justification for initiating a cybersecurity project or program, and describes the expected benefits, costs, risks, and alternatives34.

Question 4

Which of the following is associated with the "Detect" core function of the NIST Cybersecurity Framework?

AInformation Protection Processes and Procedures

BAnomalies and Events

CRisk Assessment

Answer : B

Anomalies and Events is one of the six categories within the Detect function of the NIST Cybersecurity Framework. The Anomalies and Events category aims to ensure that anomalous activity is detected in a timely manner and the potential impact of events is understood12.

Question 5

Which of the following COBIT and NIST implementation steps may be reversed depending on the culture of the organization?

AStep 4: Conduct a Risk Assessment and Step 6: Determine, Analyze, and Prioritize Gaps

BStep 3: Create a Current Profile and Step 5: Create a Target Profile

CStep 1: Prioritize and Scope and Step 2: Orient

Answer : C

According to the ISACA guide, the order of these two steps may be reversed depending on the culture of the organization and the level of stakeholder engagement1. Some organizations may prefer to start with a broad orientation of the NIST CSF and COBIT 2019 before scoping and prioritizing the implementation, while others may want to define the scope and priorities first and then orient the stakeholders accordingly.

Reference Implementing the NIST Cybersecurity Framework Using COBIT 2019, page 17.

Question 6

Which of the following COBIT 2019 governance principles corresponds to the CSF application stating that CSF profiles support flexibility in content and

structure?

AA governance system should be customized to the enterprise needs, using a set of design
factors as parameters.

BA governance system should focus primarily on the enterprise's IT function and information
processing.

CA governance system should clearly distinguish between governance and management
activities and structures.

Answer : A

This principle corresponds to the CSF application stating that CSF profiles support flexibility in content and structure, because both emphasize the need for tailoring the governance system to the specific context and requirements of the enterprise12. The CSF profiles are based on the enterprise's business drivers, risk appetite, and current and target cybersecurity posture3. The COBIT 2019 design factors are a set of parameters that influence the design and operation of the governance system, such as enterprise strategy, size, culture, and regulatory environment4.

Question 7

Analysis is one of the categories within which of the following Core Functions?

ADetect

BRespond

CRecover

Answer : A

Analysis is one of the six categories within the Detect function of the NIST Cybersecurity Framework. The Analysis category aims to identify the occurrence of a cybersecurity event by performing data aggregation, correlation, and analysis12.

Isaca Implementing the NIST Cybersecurity Framework using COBIT 2019 NIST-COBIT-2019 Exam Questions