Question 1

How should gaps identified between the current and target profiles be addressed?

Accepted Answer

C

Explanation: According to the NIST Cybersecurity Framework, gaps identified between the current and target profiles should be addressed through a risk-based approach, which enables an organization to gauge the resources needed and prioritize the mitigation of gaps in a cost-effective manner. This approach also aligns the cybersecurity program with the business objectives and risk appetite of the organization12. Reference Examples of Framework Profiles | NIST What is the NIST Cybersecurity Framework? | IBM

Question 2

Combining CSF principles with COBIT 2019 practices helps to ensure value, manage risk, and support mission drivers through support and direction of:

Accepted Answer

B

Explanation: Combining CSF principles with COBIT 2019 practices helps to ensure value, manage risk, and support mission drivers through support and direction of the board of directors and executive management, as they are responsible for setting the vision, strategy, and objectives of the organization, and for overseeing the governance and management of IT-related operations12. Reference Connecting COBIT 2019 to the NIST Cybersecurity Framework - ISACA COBIT 2019 (With Principles, Components, Users and Benefits) Thank you for your visit.

Question 3

What does a CSF Informative Reference within the CSF Core provide?

Accepted Answer

C

Explanation: A CSF Informative Reference within the CSF Core provides a citation to a related activity from another standard or guideline that can help an organization achieve the outcome described in a CSF Subcategory12. For example, the Informative Reference for ID.AM-1 (Physical devices and systems within the organization are inventoried) is COBIT 5 APO01.01, which states "Maintain an inventory of IT assets"3. Reference: 1: Informative Reference: What are they, and how are they used? | NIST 2: Everything to Know About NIST CSF Informative Reference | Axio 3: NIST Cybersecurity Framework v1.1 - CSF Tools - Identity Digital

Question 4

Which of the following COBIT tasks and activities corresponds to CSF Step 1: Prioritize and Scope?

Accepted Answer

A

Explanation: This COBIT task and activity corresponds to CSF Step 1: Prioritize and Scope, because it involves assessing the current state of the enterprise’s governance and management system, as well as its readiness and ability to adopt changes12. This task and activity is part of the COBIT 2019 implementation phase "Where are we now?"3, which aligns with the CSF step of identifying the business drivers, mission, objectives, and risk appetite of the organization4. Reference: 1: COBIT 2019 Implementation Guide 2: COBIT 2019 Implementation - ISACA 3: Connecting COBIT 2019 to the NIST Cybersecurity Framework - ISACA 4: Cybersecurity Framework Components | NIST

Question 5

Which of the following COBIT and NIST implementation steps may be reversed depending on the culture of the organization?

Accepted Answer

C

Explanation: According to the ISACA guide, the order of these two steps may be reversed depending on the culture of the organization and the level of stakeholder engagement1. Some organizations may prefer to start with a broad orientation of the NIST CSF and COBIT 2019 before scoping and prioritizing the implementation, while others may want to define the scope and priorities first and then orient the stakeholders accordingly. Reference Implementing the NIST Cybersecurity Framework Using COBIT 2019, page 17.

Question 6

The CSF Implementation Tiers distinguish three fundamental dimensions of risk management to help enterprises evaluate which of the following?

Accepted Answer

A

Explanation: The CSF Implementation Tiers distinguish three fundamental dimensions of risk management to help enterprises evaluate their cybersecurity posture, which is the alignment of their cybersecurity activities and outcomes with their business objectives and risk appetite12. The Tiers range from Partial (Tier 1) to Adaptive (Tier 4) and describe the degree of rigor, integration, and collaboration of the organization’s cybersecurity risk management practices12. Reference: 1: Cybersecurity Framework Components | NIST 2: Cybersecurity Framework FAQs Framework Components | NIST

Question 7

During CSF life cycle action plan review, which of the following tasks is associated with realizing benefits?

Accepted Answer

B

Explanation: According to the ISACA guide, monitoring performance against objectives is one of the tasks associated with realizing benefits, as it helps to measure the outcomes and value of the CSF implementation, and to identify and address any issues or gaps that may arise1. This task also involves reporting and communicating the results and feedback to the relevant stakeholders and ensuring continuous improvement2. Reference Connecting COBIT 2019 to the NIST Cybersecurity Framework - ISACA Manage Enterprise Cyberrisk by Applying the NIST CSF With COBIT … - ISACA

Question 8

Which of the following is the PRIMARY reason for establishing open communication between all participants and stakeholders as part of the implementation phase?

Accepted Answer

B

Explanation: The primary reason for establishing open communication between all participants and stakeholders as part of the implementation phase is to ensure issues can be identified and resolved, as this can facilitate the collaboration, coordination, and feedback among the involved parties, and help to overcome the challenges and risks that may arise during the implementation12. Reference Connecting COBIT 2019 to the NIST Cybersecurity Framework - ISACA Questions and Answers | NIST

Question 9

Which of the following is an objective of COBIT Implementation Phase 3-Where Do We Want to Be?

Accepted Answer

B

Explanation: This is an objective of COBIT Implementation Phase 3: Where Do We Want to Be?, because it involves defining the desired state of the enterprise’s governance and management system, based on the stakeholder needs, drivers, and scope12. This objective also includes using the COBIT Performance Management system to assess the current and target capability levels of the processes that support the governance and management objectives34. Reference: 1: COBIT 2019 Implementation Guide 2: COBIT 2019 Implementation - ISACA 3: COBIT 2019 Performance Management: Principles and Processes 4: Effective Capability and Maturity Assessment Using COBIT 2019 - ISACA

Question 10

Which of the following functions provides foundational activities for the effective use of the Cybersecurity Framework?

Accepted Answer

B

Explanation: The Identify function provides foundational activities for the effective use of the Cybersecurity Framework, because it assists in developing an organizational understanding of managing cybersecurity risk to systems, people, assets, data, and capabilities12. This understanding enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs12. The Identify function includes outcome categories such as Asset Management, Business Environment, Governance, Risk Assessment, Risk Management Strategy, and Supply Chain Risk Management12. Reference: 1: The Five Functions | NIST 2: Getting Started with the NIST Cybersecurity Framework: A Quick Start Guide

Free ISACA NIST-COBIT-2019 Actual Exam Questions