The ISACA NIST-COBIT-2019 Questions & Practice Test are Available On-Demand
Valid NIST-COBIT-2019 Exam Dumps Ensure you a HIGH SCORE
NEW QUESTION # 30
The seven high-level CSF steps generally align to which of the following in COBIT 2019?
- A. High-level categories
- B. High-level phases
- C. High-level functions
Answer: B
Explanation:
The seven high-level CSF steps generally align to the high-level phases of the COBIT 2019 implementation guide, which are: What are the drivers?; Where are we now?; Where do we want to be?; What needs to be done?; How do we get there?; Did we get there?; and How do we keep the momentum going?12. These phases provide a structured approach for implementing a governance system using COBIT 2019, and can be mapped to the CSF steps of Prioritize and Scope, Orient, Create a Current Profile, Conduct a Risk Assessment, Create a Target Profile, Determine, Analyze and Prioritize Gaps, and Implement Action Plan34.
References: 1: COBIT 2019 Implementation Guide 2: COBIT 2019 Implementation - ISACA 3: Implementing the NIST Cybersecurity Framework Using COBIT 2019 | ISACA 4: REVIEW OF IMPLEMENTING THE NIST CYBERSECURITY FRAMEWORK USING COBIT 2019.
NEW QUESTION # 31
An organization is concerned that there will be resistance in attempts to close gaps between the current and target profiles. Which of the following is the BEST approach to gain support for the process?
- A. Communicate management opinions regarding the project.
- B. Identify quick wins for implementation first.
- C. Implement organization-wide training on the CSF.
Answer: B
Explanation:
Identifying quick wins for implementation first is the best approach to gain support for the process, as it can demonstrate the value and feasibility of the project, and motivate the stakeholders to overcome the resistance and embrace the change12. Quick wins are those actions that can be implemented rapidly and easily, and that can produce visible and measurable results3.
References7 Phases in COBIT Implementation | COBIT Certification - SimplilearnImplementing the NIST Cybersecurity Framework Using COBIT 2019, page 17.What is a Quick Win? - Definition from Techopedia
NEW QUESTION # 32
Which of the following functions provides foundational activities for the effective use of the Cybersecurity Framework?
- A. Identify
- B. Protect
- C. Detect
Answer: A
Explanation:
The Identify function provides foundational activities for the effective use of the Cybersecurity Framework, because it assists in developing an organizational understanding of managing cybersecurity risk to systems, people, assets, data, and capabilities12. This understanding enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs12. The Identify function includes outcome categories such as Asset Management, Business Environment, Governance, Risk Assessment, Risk Management Strategy, and Supply Chain Risk Management12.
References: 1: The Five Functions | NIST 2: Getting Started with the NIST Cybersecurity Framework: A Quick Start Guide
NEW QUESTION # 33
Which of the following represents a best practice for completing CSF Step 3: Create a Current Profile?
- A. Procuring solutions that are cost-effective and fit the organization's technical architecture
- B. Engaging in a dialogue and obtaining input to determine appropriate goals, tiers, and Activities
- C. Assessing current availability, performance, and capacity to create a baseline
Answer: B
Explanation:
This represents a best practice for completing CSF Step 3: Create a Current Profile, because it involves collaborating with relevant stakeholders to identify the current cybersecurity outcomes and implementation status of the organization12. Engaging in a dialogue and obtaining input can help to ensure that the Current Profile reflects the business drivers, mission, objectives, and risk appetite of the organization, as well as the scope and boundaries of the cybersecurity program34.
References: 1: Cybersecurity Framework Components | NIST 2: Getting Started with the NIST Cybersecurity Framework: A Quick Start Guide3 3: Implementing the NIST Cybersecurity Framework Using COBIT 2019 | ISACA 4: NIST CSF: The seven-step cybersecurity framework process5
NEW QUESTION # 34
During CSF implementation, when is an information security manager MOST likely to identify key enterprise and supporting alignment goals as previously understood?
- A. CSF Steps 5: Create a Target Profile and 6: Determine, Analyze, and Prioritize Gaps
- B. CSF Steps 2: Orient and 3: Create a Current Profile
- C. CSF Step 1: Prioritize and Scope
Answer: C
Explanation:
This CSF step corresponds to the COBIT objective of knowledge and understanding of enterprise goals, because it involves identifying the business drivers, mission, objectives, and risk appetite of the organization, as well as the scope and boundaries of the cybersecurity program12. This step helps to ensure that the cybersecurity activities and outcomes are aligned with the enterprise goals and strategy34.
References: 1: Cybersecurity Framework Components | NIST 2: Implementing the NIST Cybersecurity Framework Using COBIT 2019 | ISACA 3: COBIT 2019 Design and Implementation COBIT Implementation
4: COBIT 2019 Foundation | Skillsoft Global Knowledge
NEW QUESTION # 35
Which of the following is the MOST important input for prioritizing resources during program initiation?
- A. Replacement cost
- B. Business impact assessment
- C. Risk register
Answer: B
Explanation:
A business impact assessment (BIA) is the most important input for prioritizing resources during program initiation, because it helps to identify and evaluate the potential effects of disruptions to critical business functions and processes12. A BIA can help to determine the recovery objectives, priorities, and strategies for the program, as well as the resource requirements and dependencies34.
References: 1: Business Impact Analysis | Ready.gov 2: Business Impact Analysis - ISACA 3: COBIT 2019 Implementation Guide 4: COBIT 2019 Implementation - ISACA
NEW QUESTION # 36
Which of the following is a framework principle established by NIST as an initial framework consideration?
- A. Ensuring regulatory compliance
- B. Impact on global operations
- C. Avoiding business risks
Answer: A
Explanation:
One of the framework principles established by NIST is to ensure that the framework is consistent and aligned with existing regulatory and legal requirements that are relevant to cybersecurity12.
References: 1: Cybersecurity Framework | NIST 2: Framework Documents | NIST
NEW QUESTION # 37
Which of the following is the MOST beneficial result of an effective CSF implementation plan?
- A. Key stakeholders understand the cybersecurity requirements of the chosen vendors.
- B. Key stakeholders understand the quick wins of the cybersecurity program.
- C. Cybersecurity risk management practices are formalized and institutionalized.
Answer: C
Explanation:
The most beneficial result of an effective CSF implementation plan is that cybersecurity risk management practices are formalized and institutionalized, which means that the organization has established and maintained a consistent and comprehensive approach to managing cybersecurity risks across its systems, processes, and people. This result can help the organization to reduce the likelihood and impact of cybersecurity events, improve its resilience and compliance, and enhance its reputation and trust12.
ReferencesPublic Draft: The NIST Cybersecurity Framework 2, page 1.Cybersecurity Framework | NIST
NEW QUESTION # 38
Within the CSF Core structure, which type of capability can be implemented to help practitioners recognize potential or realized risk to enterprise assets?
- A. Response capability
- B. Detection capability
- C. Protection capability
Answer: B
Explanation:
The Detection capability is the type of capability within the CSF Core structure that can help practitioners recognize potential or realized risk to enterprise assets. The Detection capability consists of six categories that enable timely discovery of cybersecurity events, such as Anomalies and Events, Security Continuous Monitoring, and Detection Processes12.
References: 1: The Five Functions | NIST 2: Cybersecurity Framework | NIST
NEW QUESTION # 39
Which of the following is an objective of COBIT Implementation Phase 3 - Where Do We Want to Be?
- A. Identify critical processes or other components addressed in the improvement plan.
- B. Determine the current capability of selected processes.
- C. Create a detailed business case and high-level program plan.
Answer: C
Explanation:
The objective of COBIT Implementation Phase 3 is to set an improvement target and identify gaps and potential solutions using COBIT's guidance. This involves creating a detailed business case and a high-level program plan for the implementation.
ReferencesCOBIT 2019 Design and Implementation COBIT Implementation, page 31.7 Phases in COBIT Implementation | COBIT Certification - Simplilearn
NEW QUESTION # 40
During Step 3: Create a Current Profile, an enterprise outcome has reached a 95% subcategory maturity level.
How would this level of achievement be
described in the COBIT Performance Management Rating Scale?
- A. Partially Achieved
- B. Largely Achieved
- C. Fully Achieved
Answer: C
Explanation:
According to the COBIT Performance Management Rating Scale, a subcategory maturity level of 95% corresponds to the rating of Fully Achieved, which means that the outcome is achieved above 85%12. This indicates that the enterprise has a high degree of capability and maturity in the subcategory, and that the practices and activities are performed consistently and effectively34.
References:
1: Performance Management of Processes - Testprep Training Tutorials
2: COBIT 2019 and COBIT 5 Comparison - ISACA
3: COBIT 2019 Performance Management: Principles and Processes
4: Effective Capability and Maturity Assessment Using COBIT 2019 - ISACA
NEW QUESTION # 41
Which of the following is a PRIMARY input into Steps 2 and 3: Orient and Create a Current Profile?
- A. Evaluating business cases
- B. Updating business cases
- C. Defining business cases
Answer: C
Explanation:
Defining business cases is a primary input into Steps 2 and 3: Orient and Create a Current Profile, because it involves identifying the business drivers, mission, objectives, and risk appetite of the organization, as well as the scope and boundaries of the cybersecurity program12. A business case is a document that provides the rationale and justification for initiating a cybersecurity project or program, and describes the expected benefits, costs, risks, and alternatives34.
References: 1: Cybersecurity Framework Components | NIST 2: Implementing the NIST Cybersecurity Framework Using COBIT 2019 | ISACA 3: Business Case Development - ISACA 4: How to Write a Business Case for Cybersecurity Projects | Infosec
NEW QUESTION # 42
The activity of determining an appropriate target capability level for each process occurs within which implementation phase?
- A. Phase 4 - What Needs to Be Done?
- B. Phase 2 - Where Are We Now?
- C. Phase 3 - Where Do We Want to Be?
Answer: C
Explanation:
The activity of determining an appropriate target capability level for each process occurs within Implementation Phase 3, as it helps to set an improvement target and identify gaps and potential solutions using COBIT's guidance. This involves creating a detailed business case and a high-level program plan for the implementation12.
ReferencesDefining Target Capability Levels in COBIT 2019: A Proposal for RefinementCOBIT 2019 Design and Implementation COBIT Implementation, page 31.
NEW QUESTION # 43
The PRIMARY function of COBIT Implementation Phase 7: How Do We Keep the Momentum Going is to provide an opportunity for which of the following?
- A. Ensuring frequent stakeholder communication
- B. Documenting improvements in a prioritized action plan
- C. Closing the loop for communication workflow
Answer: C
Explanation:
The primary function of COBIT Implementation Phase 7 is to provide an opportunity for closing the loop for communication workflow, which means to ensure that the results and feedback of the implementation are reported and communicated to the relevant stakeholders, and that the lessons learned and best practices are captured and shared for future reference12.
References7 Phases in COBIT Implementation | COBIT Certification - SimplilearnCOBIT 2019 Design and Implementation COBIT Implementation, page 31.
NEW QUESTION # 44
Combining CSF principles with COBIT 2019 practices helps to ensure value, manage risk, and support mission drivers through support and direction of:
- A. the chief information security manager and the data protection officer.
- B. the chief information officer and IT management.
- C. the board of directors and executive management.
Answer: C
Explanation:
Combining CSF principles with COBIT 2019 practices helps to ensure value, manage risk, and support mission drivers through support and direction of the board of directors and executive management, as they are responsible for setting the vision, strategy, and objectives of the organization, and for overseeing the governance and management of IT-related operations12.
ReferencesConnecting COBIT 2019 to the NIST Cybersecurity Framework - ISACACOBIT 2019 (With Principles, Components, Users and Benefits)
NEW QUESTION # 45
Identifying external compliance requirements is MOST likely to occur during which of the following COBIT implementation phases?
- A. Phase 3 - Where Do We Want to Be?
- B. Phase 4 - What Needs to Be Done?
- C. Phase 2 - Where Are We Now?
Answer: C
Explanation:
Identifying external compliance requirements is most likely to occur during COBIT Implementation Phase 2:
Where Are We Now?, because this phase involves assessing the current state of the enterprise's governance and management system, as well as its strengths, weaknesses, opportunities, and threats12. This phase also includes identifying the relevant stakeholders, drivers, and scope of the implementation program . Therefore, this phase requires a thorough understanding of the external laws, regulations, and contractual obligations that apply to the enterprise and its I&T activities.
References: 1: COBIT 2019 Implementation Guide 2: COBIT 2019 Implementation - ISACA : Connecting COBIT 2019 to the NIST Cybersecurity Framework - ISACA : 7 Phases of COBIT Implementation:
Explained - The Knowledge Academy : Compliance with External Requirements - Morland-Austin
NEW QUESTION # 46
During CSF life cycle action plan review, which of the following tasks is associated with realizing benefits?
- A. Developing business cases indicating success factors
- B. Monitoring performance against objectives
- C. Documenting risk issues and remediation plans
Answer: B
Explanation:
According to the ISACA guide, monitoring performance against objectives is one of the tasks associated with realizing benefits, as it helps to measure the outcomes and value of the CSF implementation, and to identify and address any issues or gaps that may arise1. This task also involves reporting and communicating the results and feedback to the relevant stakeholders and ensuring continuous improvement2.
ReferencesConnecting COBIT 2019 to the NIST Cybersecurity Framework - ISACAManage Enterprise Cyberrisk by Applying the NIST CSF With COBIT ... - ISACA
NEW QUESTION # 47
......
NIST-COBIT-2019 Exam Practice Questions prepared by ISACA Professionals: https://pass4sure.test4cram.com/NIST-COBIT-2019_real-exam-dumps.html