Cobit Exam Questions and Answers

Enterprise stakeholder needs - ANSWER 1. Maintain high quality information to support business decisions 2. Generate business value from IT 3. Achieve operational excellence through the reliable and efficient applicati ...

Enterprise stakeholder needs - ANSWER 1. Maintain high quality information to support business decisions 2. Generate business value from IT 3. Achieve operational excellence through the reliable and efficient application of technology 4. Maintain an acceptable level of risk 5. Optimize the cost of IT 6. Ensure regulatory compliance COBIT DRIVERS - ANSWER 1.More stakeholder involvement 2. Increasing dependency of third parties 3. Ever increasing volume of information 4. IT becoming an integral part of the business 5. A need for an end to end management and governance framework 6. Better control over user based IT solutions 7. Alignment with other guidance and integration of ISACA frameworks Benefits of COBIT - ANSWER 1. Starting point of governance and management activities 2. Holistic, integrated and complete view of enterprise governance and management of IT 3. Creates a common language between IT and the business 4. IT consistent with generally accepted corporate governance standards COBIT Initially in three volumes - ANSWER 1. Framework 2. Process reference guide 3. Implementation guide COBIT based on - ANSWER 1. 5 principles 2. 7 enables COBIT Enabler guides - ANSWER 1. Enabling processes 2. Enabling information 3. Other enabler guides COBIT Professional Guides - ANSWER 1. Implementation 2. Information Security 3. Assurance 4. Risk 5. Other Professional Guides COBIT Principles (5) - ANSWER 1. Meet stakeholder needs 2. Cover enterprise end to end 3. Apply a Single integrated framework 4. Enable a holistic approach 5. Separate governance from management COBIT Principle 1 - ANSWER 1. Meeting Stakeholder Needs 2. Governance objective - value creation a. Benefit realization b. Risk optimization c. Resource optimization Every enterprise operates in a different context which is determined by - ANSWER 1. External factors(market industry, geopolitics, etc.) 2. Internal factors (culture, organization, risk appetite, etc.) Stakeholder needs have to be transformed into - ANSWER An actionable strategy Goals cascade is the mechanism to - ANSWER Translate stakeholder needs into specific, actionable and customized 1. Enterprise goals 2. IT related goals 3. Enabler goals Goals Cascade - ANSWER 1. Stakeholder drivers (environment, technology evolution) influence 2. Stakeholder needs of benefit realization, resource optimization, risk optimization 3. Which cascades to stakeholder needs and enterprise goals 4. These cased to IT related goals - which consist of enterprise goals mapped to IT related goals 5. These cascade to enabler goals Stakeholder needs are influenced by a number of drivers - ANSWER 1. Strategy changes 2. Changing business and regulatory environment 3. New technologies Enterprise goals - ANSWER 1. Business or balanced scorecard 2. Consists of bsc dimension, enterprise goal 3. Relation to governance objective Balance (Business) Score Card dimension - ANSWER 1. Financial - enterprise goals 2. Customer - enterprise goals 3. Internal - enterprise goals 4. Learning and growth - enterprise goals Relation to governance objectives (primary, secondary, N/A) - ANSWER 1. Benefit realization 2. Risk optimization 3. Resource optimization IT Related Goals - ANSWER IT BSC Dimension (Financial, customer, Internal, Learning and growth) - related goals Goals Cascade Step 1 - ANSWER Stakeholder drivers influence needs which are influenced by a number of drivers a. Strategy changes b. Changing business and regulatory environment c. New technologies Goals Cascade Step 2 - ANSWER Stakeholder needs cascade to enterprise goals a. Stakeholder needs can be translated to a series of generic enterprise goals using the balanced score card dimensions Goals Cascade Step 3 - ANSWER Enterprise goals cascade to IT related goals a. Achievement of enterprise goals requires a number of IT related goals b. Structured along a dimension of an IT balanced scorecard Goals Cascade Step 4 - ANSWER IT related goals cascade to enabler goals a. Achieving IT related goals requires the successful application and use of enablers b. Enablers include i. Processes ii. Organization structures iii. Information c. For each enabler a set of specific relevant goals can be defined Principle 2 - ANSWER Covering the Enterprise end to end 2. Addresses all a. Relevant internal and external IT services b. Internal and external business processes 3. Enablers are enterprise wide and end to end a. Inclusive everything and everyone b. Internal and external IT services c. Internal and external IT business processes 4. Information is a key enabler a. Stakeholders define extensive and complete requirements for information b. Connects the business and its need for adequate information and the IT function Governance enablers - ANSWER Organizational resources for governance a. Frameworks b. Principles c. Structures d. Processes and practices 2. Enterprise resources a. Service capabilities b. People c. information 3. Can be applied to a. Entire enterprise b. An entity c. Tangible or intangible asset 1. Principle 3 - ANSWER Applying a single integrated framework a. Aligns with latest relevant standards 1. Principle 4 - ANSWER Enabling a holistic framework 2. Set of enablers to support the implementation of the governance 1. Enterprise enablers - 7 of them - ANSWER Principles, policies and frameworks 2. Processes 3. Organizational structures 4. Culture, ethics and behavior 5. Information 6. Services, infrastructure and applications Principles, policies and frameworks - ANSWER The vehicle to translate desired behavior into practical guidance for day to day management Processes - ANSWER An organized set of practices and activities to achieve certain objectives Organizational structures - ANSWER The key decision making entities in an enterprise Culture, ethics and behavior - ANSWER An often underestimated success factor in governance and management activities Information - ANSWER All information produced and used by the enterprise Service, infrastructure and applications - ANSWER The infrastructure, technology and applications that provide the enterprise with information technology People, skills and competencies - ANSWER Are required for successful completion of all activities and for making correct decisions or taking corrective actions Each enabler needs the input of - ANSWER Other enablers to fully effective and delivers output to the benefit of other enablers Each enabler has - ANSWER COBIT Principle 2 Principle 5 - ANSWER Separating governance from management 1. Governance and management - ANSWER Encompass different types of activities 2. Require different organizational structures 3. Serve different purposes 1. Governance - ANSWER Responsibility of the board of directors under the leadership of the chairperson 2. Ensures that stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved, monitoring performance and compliance against agreed on direction and objectives 1. Management - ANSWER Responsibility of the executive management under the leadership of the CEO 2. Plans, builds, runs and monitors activities in alignment with the direction set by the governance body to achieve the enterprise objectives 1. Role of governance - ANSWER EDM a. Evaluate b. Direct c. Monitor 1. Role of management - ANSWER PBRM a. Plan (APO) - 13 process b. Build (BAI) - 10 processes c. Run (DSS) - 6 processes d. Monitor (MEA) - 3 processes Order of Governance and Management - ANSWER EDPBRMM 1. Evaluate, Direct, Monitor (6) - Governance - ANSWER EDM01 Ensure Governance Framework Setting and Maintenance 2. EDM02 Ensure Benefits Delivery 3. EDM03 Ensure Risk Optimisation 4. EDM04 Ensure Resource Optimisation 5. EDM05 Ensure Stakeholder Transparency 1. Align Plan and Organize (14) - ANSWER APO01 Manage the IT Management Framework 2. APO02 Manage Strategy 3. APO03 Manage Enterprise Architecture 4. APO04 Manage Innovation 5. APO05 Manage Portfolio 6. APO06 Manage Budget and Costs 7. APO07 Manage Human Resources 8. APO08 Manage Relationships 9. APO09 Manage Service Agreements 10. APO10 Manage Suppliers 11. APO11 Manage Quality 12. APO12 Manage Risk 13. APO13 Manage Security 1. Build, Acquire, Implement (10) - ANSWER BAI01 Manage Programmes and Projects 2. BAI02 Manage Requirements Definition 3. BAI03 Manage Solutions Identification and Build 4. BAI04 Manage Availability and Capacity 5. BAI05 Manage Organisational Change Enablement 6. BAI06 Manage Changes 7. BAI07 Manage Change Acceptance and Transitioning 8. BAI08 Manage Knowledge 9. BAI09 Manage Assets 10. BAI10 Manage Configuration 1. Deliver, Service and Support (6) - ANSWER DSS01 Manage Operations 2. DSS02 Manage Service Requests and Incidents 3. DSS03 Manage Problems 4. DSS04 Manage Continuity 5. DSS05 Manage Security Services 6. DSS06 Manage Business Process Controls 1. Monitor, Evaluate, Assess (3) - ANSWER MEA01 Monitor, Evaluate and Assess Performance and Conformance 2. MEA02 Monitor, Evaluate and Assess the System of Internal Control 3. MEA03 Monitor, Evaluate and Assess Compliance with External Requirements 1. COBIT Enabler 1 - ANSWER Principles, policies and frameworks a. Instruments to communicate the rules of the enterprise to support the governance objectives and enterprise values b. Principles express the organizations core values c. Policies give detailed guidance d. Frameworks provide a structure to define consistent guidance Principle - ANSWER An enabler of governance and management comprised of values and fundamental assumptions of the enterprise, beliefs that guide and set boundaries for decision making and communication within and outside of the enterprise Policies - ANSWER Overall intention and direction as formally expressed by management Framework - ANSWER Provide management with structure, guidance, tools, etc that allow proper governance of IT Effective - ANSWER Achieve the stated purpose Non-intrusive - ANSWER Appear logical and do not create unnecessary resistance by those who must comply with them Policy frameworks - ANSWER Provide a consistent view of policies, navigation to and between policies, a structure for policy maintenance Policy lifecycle - ANSWER Create, review, amend, dispose 1. Policies should be - ANSWER A part of an overall governance and management structure 2. Aligned to the organizations risk appetite 3. Revalidated and updated on a regular basis 1. Policies require statements of - ANSWER Scope and validity 2. Consequence of non-compliance 3. Means of handling exceptions 4. Means by which compliance is monitored 1. Policies relationship with other enablers - ANSWER Processes are most important vehicle for executing policies 2. Organizational structures can define and implement policies 3. Policies are a part of information Cobit enabler 2 - ANSWER Processes- A collection of practices influenced by the enterprise's policies and procedures that takes inputs and produces outputs (eg products or services) Processes are - ANSWER Defined Created Operated Monitored Adjusted/updated Retired Process stakeholders - ANSWER Can be internal and external, their responsibilities are defined in a RACI chart for each process Process goals - ANSWER Are the base of the goals cascade Enabling process - ANSWER Practices to activities to detailed activities Practices - ANSWER Statements of actions to deliver benefits, optimize the level or risk and use of resources Aligned with accepted standards Generic enough for adaptation for each enterprise Applicable to business and IT Organizations should tune practices according to their need Activities - ANSWER Describe set of necessary and sufficient action oriented implementation steps to achieve a governance or management practice, has clear roles and responsibilities Process performance management - ANSWER Metrics should be smart Specific Measurable Actionable Relevant Timely Process goals categories - ANSWER Intrinsic goals - fit for purpose Contextual goals - fit for use Accessibility and security goals - communicated and controlled Enabler 3 - ANSWER Organizational structures Good practices and escalation Enabler 4 - ANSWER Culture, ethics, and behavior 1. Relate to how well the following are achieved 2. Organizational ethics dictated by the enterprise 3. Individual ethics Goals - ANSWER Goals relate to how well the following are achieved Enabler 5 - ANSWER Information Stakeholders for information can be formalized into role types, based on the reason for their interest in information such as architect, owner, consumer, producer, etc. Goals for information quality - ANSWER Seven criteria for information quality 1. Effectiveness 2. Efficiency 3. Integrity 4. Reliability 5. Availability 6. Confidentiality 7. Compliance Information - intrinsic quality - ANSWER Extent that data values confirm to and with actual true values in terms of Accuracy, objectivity, believability reputation Information - contextual and representational quality - ANSWER Extent to which information is applicable to the task of the information user including relevancy, completeness, currency, appropriate amount of information, concise representation, interpretability, understandability, ease of manipulation Information - security/accessibility quality - ANSWER The extent to which information is available or obtainable which includes availability/timeliness, restricted access The information life cycle - ANSWER Business processes/IT processes Generate and process - Data Data - is transformed into information Information is transformed into Knowledge Knowledge creates value Value drives business processes/IT processes Full life cycle of information as described in cobit - ANSWER Plan Design Build/acquire Use/operate Monitor Dispose Proposed structure of information properties - ANSWER A six layer model of information properties and their attributes 1. Physical world - information carrier or media 2. Empiric - attribute that identifies the information access channel (user interface) 3. Syntactic - code/language - representational format or language used to encode information 4. Semantic - information type (eg. Financial), currency (past, present, future), level (degree of detail) 5. Pragmatic - retention period, status (operational or archived), novelty (new, current, old), contingency 6. Social world - context in which information makes sense, is used and has value