Home
Isaca
NIST-COBIT-2019 Exam Questions

Isaca NIST-COBIT-2019 Practice Exam Questions & Answers

7 Free Questions Last reviewed October 30, 2026 Prepared & Reviewed by the ValidExamDumps Editorial Team

Exam details Free questions Study guide FAQ

50 Practice Questions (Our Bank)

90 minutes Exam Duration

USD 275 Official Exam Fee

Exam Facts

Isaca NIST-COBIT-2019 Exam Details

Key details for this exam, checked against the published exam outline

Exam Code: NIST-COBIT-2019
Full Name: ISACA Implementing the NIST Cybersecurity Framework using COBIT 2019
Issuing Body: ISACA
Question Format (Our Bank): Multiple Choice
Delivery: Online proctored
Eligibility: Candidates must have successfully passed the COBIT 2019 Foundation exam or the COBIT 2019 Bridge exam
Full Question Set: 50 questions Get All Questions

Practice Questions

Free NIST-COBIT-2019 Practice Questions

Each question shows the correct answer and an explanation of why it is right

ValidExamDumps Editorial Team Every question and its answer is checked by our NIST-COBIT-2019 exam preparation team, who also write the explanation shown with each one. How we research and review these pages

Question 1 Domain 1 Overview of the Cybersecurity Framework

During Step 3: Create a Current Profile, an enterprise outcome has reached a 95% subcategory maturity level. How would this level of achievement be

described in the COBIT Performance Management Rating Scale?

ALargely Achieved

BPartially Achieved

CFully Achieved

Correct Answer C

Explanation

According to the COBIT Performance Management Rating Scale, a subcategory maturity level of 95% corresponds to the rating of Fully Achieved, which means that the outcome is achieved above 85%12. This indicates that the enterprise has a high degree of capability and maturity in the subcategory, and that the practices and activities are performed consistently and effectively34.

Question 2 Domain 3 Framework Implementation

During CSF implementation, when is an information security manager MOST likely to identify key enterprise and supporting alignment goals as

previously understood?

ACSF Steps 5: Create a Target Profile and 6: Determine, Analyze, and Prioritize Gaps

BCSF Step 1: Prioritize and Scope

CCSF Steps 2: Orient and 3: Create a Current Profile

Correct Answer B

Explanation

This CSF step corresponds to the COBIT objective of knowledge and understanding of enterprise goals, because it involves identifying the business drivers, mission, objectives, and risk appetite of the organization, as well as the scope and boundaries of the cybersecurity program12. This step helps to ensure that the cybersecurity activities and outcomes are aligned with the enterprise goals and strategy34.

Question 3 Domain 2 Cybersecurity Framework Structure

Which of the following is one of the objectives of CSF Step 6: Determine, Analyze and Prioritize Gaps?

ATranslate improvement opportunities into justifiable, contributing projects.

BDirect stakeholder engagement, communication, and reporting.

CCommunicate the I&T strategy and direction.

Correct Answer A

Explanation

One of the objectives of CSF Step 6 is to translate improvement opportunities into justifiable, contributing projects, which means to develop an action plan that addresses the gaps between the current and target profiles, and that aligns with the organization's mission drivers, risk appetite, and resource constraints12.

Reference Getting Started with the NIST Cybersecurity Framework: A Quick Start Guide, page 8. NIST CSF: The seven-step cybersecurity framework process

Get the complete NIST-COBIT-2019 question set $20~~$40~~

Get Full Access

Question 4 Domain 3 Framework Implementation

Which of the following is an objective of COBIT Implementation Phase 3-Where Do We Want to Be?

AIdentify critical processes or other components addressed in the improvement plan.

BDetermine the target capability for processes within governance and management

Cobjectives.

DIntegrate the metrics for project performance and benefits realization.

Correct Answer B

Explanation

This is an objective of COBIT Implementation Phase 3: Where Do We Want to Be?, because it involves defining the desired state of the enterprise's governance and management system, based on the stakeholder needs, drivers, and scope12. This objective also includes using the COBIT Performance Management system to assess the current and target capability levels of the processes that support the governance and management objectives34.

Question 5 Domain 3 Framework Implementation

Which of the following should an organization review to gain a better understanding of the likelihood and impact of cybersecurity events?

ARelevant internal or external capability benchmarks

BCybersecurity frameworks, standards, and guidelines

CCyber threat information from internal and external sources

Correct Answer C

Explanation

According to the NIST Cybersecurity Framework, an organization should review cyber threat information from internal and external sources to gain a better understanding of the likelihood and impact of cybersecurity events. This information can help the organization to identify potential threats, vulnerabilities, and consequences, and to assess the current and target profiles of its cybersecurity posture12.

Reference Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, page 19. COBIT VS NIST : A Comprehensive Analysis - ITSM Docs

Question 6 Domain 3 Framework Implementation

Which of the following is the MOST beneficial result of an effective CSF implementation plan?

ACybersecurity risk management practices are formalized and institutionalized.

BKey stakeholders understand the quick wins of the cybersecurity program.

CKey stakeholders understand the cybersecurity requirements of the chosen vendors.

Correct Answer A

Explanation

The most beneficial result of an effective CSF implementation plan is that cybersecurity risk management practices are formalized and institutionalized, which means that the organization has established and maintained a consistent and comprehensive approach to managing cybersecurity risks across its systems, processes, and people. This result can help the organization to reduce the likelihood and impact of cybersecurity events, improve its resilience and compliance, and enhance its reputation and trust12.

Reference Public Draft: The NIST Cybersecurity Framework 2, page 1. Cybersecurity Framework | NIST

Question 7 Domain 1 Overview of the Cybersecurity Framework

Within the CSF Core structure, which type of capability can be implemented to help practitioners recognize potential or realized risk to enterprise assets?

AProtection capability

BResponse capability

CDetection capability

Correct Answer C

Explanation

The Detection capability is the type of capability within the CSF Core structure that can help practitioners recognize potential or realized risk to enterprise assets. The Detection capability consists of six categories that enable timely discovery of cybersecurity events, such as Anomalies and Events, Security Continuous Monitoring, and Detection Processes12.

Full Access

Get the complete NIST-COBIT-2019 question set

Starting from 50% OFF

$20 ~~$40~~

50 questions covering all exam domains
Correct answers with explanations, like the free questions above
PDF and online practice test
90 days of free updates

Get Full Access

One-time paymentInstant download

Study Guide

What the Isaca NIST-COBIT-2019 Exam Covers

Exam domains verified against the Official Isaca NIST-COBIT-2019 exam guide, last checked October 2026.

Domain 1 Overview of the Cybersecurity Framework

10%

This section covers the NIST Cybersecurity Framework's foundational principles and core functions. You need to understand the framework's purpose in supporting regulatory compliance and organizational security strategy.

Sample questions from this domain above Q1 Q7

Domain 2 Cybersecurity Framework Structure

15%

This domain focuses on the framework's architecture, including its core functions, implementation tiers, and how organizations assess their maturity. You will learn how these elements support strategic security planning and governance.

Sample question from this domain above Q3

Domain 3 Framework Implementation

75%

This section covers the practical deployment of the NIST Cybersecurity Framework within organizations using COBIT 2019. You will study methodologies for framework adoption, tools for managing implementation, and best practices for maintaining governance and cybersecurity controls.

Sample questions from this domain above Q2 Q4 Q5 Q6

FAQ

NIST-COBIT-2019 Exam FAQ

Common questions about the exam itself

What prerequisites do I need before taking the NIST-COBIT-2019 exam?

You must have already successfully passed the COBIT 2019 Foundation exam or completed the COBIT 2019 Bridge exam. This ensures you have foundational knowledge of COBIT 2019 before learning how to integrate it with the NIST Cybersecurity Framework.

How difficult is the NIST-COBIT-2019 exam?

The exam tests practical understanding rather than pure memorization, with 75% of content focused on framework implementation. This requires hands-on knowledge of how to actually deploy the NIST Cybersecurity Framework within real organizations alongside COBIT 2019 governance practices.

Who is the target audience for NIST-COBIT-2019 certification?

The exam targets professionals involved in building or improving cybersecurity programs who have foundational knowledge of both COBIT 2019 and security concepts. This includes IT governance professionals, security practitioners, and compliance specialists looking to align governance with cybersecurity.

What job roles does NIST-COBIT-2019 certification lead to?

This certification is designed for professionals in IT governance, cybersecurity governance, risk and compliance roles, and those managing enterprise governance of information and technology (EGIT). It especially suits security professionals building integrated governance and cybersecurity programs.

How long should I prepare for the NIST-COBIT-2019 exam?

Preparation time varies based on your COBIT 2019 foundation knowledge, but most candidates benefit from structured training alongside self-study. Since you already know COBIT 2019, focus your preparation on understanding how the NIST framework maps to COBIT processes and implementation methodologies.

What happens on exam day for NIST-COBIT-2019?

You will take a 90-minute online proctored exam with 50 multiple-choice questions covering three domains. The exam is administered remotely with live proctoring, so you need a quiet testing environment and a stable internet connection.

What is the relationship between NIST-COBIT-2019 and the COBIT 2019 Foundation exam?

NIST-COBIT-2019 is an advanced credential that builds on COBIT 2019 Foundation knowledge. While Foundation covers the COBIT framework structure, this exam teaches you how to apply COBIT alongside the NIST Cybersecurity Framework to create integrated cybersecurity governance.

Which domain of NIST-COBIT-2019 is most challenging?

Framework Implementation accounts for 75% of the exam content and is the most challenging because it requires practical knowledge of deployment methodologies and real-world application. Candidates should focus on understanding how to map NIST framework steps to COBIT governance processes.

Can I retake the NIST-COBIT-2019 exam if I fail?

Yes, you can retake the exam if needed, though specific retake policies and any waiting periods should be confirmed with ISACA. Check the ISACA credentialing policies for details on retake fees and scheduling.

How does NIST-COBIT-2019 fit into the broader COBIT certification path?

This is a specialized credential separate from the main COBIT 2019 hierarchy. It extends your COBIT 2019 Foundation knowledge into cybersecurity framework implementation, targeting professionals who need to integrate NIST standards into their COBIT governance programs.

Other Isaca Exams

Free practice questions for more Isaca certification exams

COBIT-2019 Practice Questions COBIT 2019 Foundation Exam COBIT-Design-and-Implementation Practice Questions ISACA COBIT Design and Implementation Certificate COBIT5 Practice Questions COBIT 5 Foundation AAIA Practice Questions ISACA Advanced in AI Audit AAIR Practice Questions ISACA Advanced in AI Risk AAISM Practice Questions ISACA Advanced in AI Security Management Exam CCOA Practice Questions ISACA Certified Cybersecurity Operations Analyst CDPSE Practice Questions Certified Data Privacy Solutions Engineer

All Isaca exams

NIST-COBIT-2019 Full question set $20 ~~$40~~ 50% OFF

Get Full Access