Isaca NIST-COBIT-2019 Practice Exam Questions & Answers

5 Free Questions · Last reviewed: September 16, 2026 · Prepared & Reviewed by the ValidExamDumps Editorial Team

Exam Facts

Isaca NIST-COBIT-2019 Exam Details

Key details for this exam, checked against the published exam outline

50 Practice Questions (Our Bank)
90 minutes Exam Duration
USD 275 Exam Fee
Exam Code
NIST-COBIT-2019
Full Name
ISACA Implementing the NIST Cybersecurity Framework using COBIT 2019
Issuing Body
ISACA
Question Format (Our Bank)
Multiple Choice
Delivery
Online proctored
Eligibility
Candidates must have successfully passed the COBIT 2019 Foundation exam or the COBIT 2019 Bridge exam
Practice Questions

Free NIST-COBIT-2019 Practice Questions

Each question shows the correct answer and an explanation of why it is right

VA
ValidExamDumps Editorial Team Every question and its answer is checked by our NIST-COBIT-2019 exam preparation team, who also write the explanation shown with each one. How we research and review these pages
Question 1 Domain 3Framework Implementation

Documenting opportunities for improvement occurs within which implementation phase?

Correct Answer: B
Explanation

The objective of COBIT Implementation Phase 2 is to define the scope of the implementation using COBIT's mapping of enterprise goals to IT-related goals and the associated IT processes, and to consider how risk scenarios could also highlight key processes on which to focus. This phase also involves documenting the current capability and performance of the selected processes and identifying opportunities for improvement12.

Reference 7 Phases in COBIT Implementation | COBIT Certification - Simplilearn COBIT 2019 Design and Implementation COBIT Implementation, page 31.

Question 2 Domain 3Framework Implementation

What is the MOST important reason to compare framework profiles?

Correct Answer: C
Explanation

The most important reason to compare framework profiles is to identify gaps between the current and target state of cybersecurity activities and outcomes, and to prioritize the actions needed to address them12. Framework profiles are the alignment of the functions, categories, and subcategories of the NIST Cybersecurity Framework with the business requirements, risk tolerance, and resources of the organization3. By comparing the current profile (what is being achieved) and the target profile (what is needed), an organization can assess its cybersecurity posture and develop a roadmap for improvement4.

Question 3 Domain 2Cybersecurity Framework Structure

Which information should be collected for a Current Profile?

Correct Answer: A
Explanation

The implementation status is the information that should be collected for a Current Profile, because it indicates the degree to which the cybersecurity outcomes defined by the CSF Subcategories are currently being achieved by the organization12. The implementation status can be expressed using a four-level scale: Not Performed, Partially Performed, Performed, and Informative Reference Not Applicable34.

Question 4 Domain 1Overview of the Cybersecurity Framework

Which of the following should be a PRIMARY consideration when creating an action plan to address gaps identified in CSF Step 6: Determine, Analyze,

and Prioritize Gaps?

Correct Answer: A
Explanation

According to the NIST Cybersecurity Framework, mission drivers are a primary consideration when creating an action plan to address gaps identified in CSF Step 6, as they help to align the cybersecurity program with the organization's objectives, priorities, and risk appetite. Mission drivers also help to determine the resources needed and the cost-benefit analysis of the proposed solutions12.

Reference 7 Steps to Implement & Improve Cybersecurity with NIST Cybersecurity Framework v1.1 - CSF Tools - Identity Digital, page 7.

Question 5 Domain 3Framework Implementation

When aligning to the NIST Cybersecurity Framework, what should occur after tier levels and framework core outcomes are determined?

Correct Answer: C
Explanation

According to the NIST Cybersecurity Framework, after determining the tier levels and framework core outcomes, the next step is to compare the current and target profiles, which describe the organization's current and desired cybersecurity posture based on the framework core functions, categories, and subcategories1. This comparison helps to identify the gaps and prioritize the actions for improvement2.

Reference Cybersecurity Framework Components | NIST What is the NIST Cybersecurity Framework? | IBM

Get Full Access

50 questions covering all exam domains, starting from $20

Study Guide

What the Isaca NIST-COBIT-2019 Exam Covers

Exam domains verified against: Official Isaca NIST-COBIT-2019 exam guide, last checked September 2026.

Domain 1: Overview of the Cybersecurity Framework 10%

This section covers the NIST Cybersecurity Framework's foundational principles and core functions. You need to understand the framework's purpose in supporting regulatory compliance and organizational security strategy.

Sample question from this domain above: Q4

Domain 2: Cybersecurity Framework Structure 15%

This domain focuses on the framework's architecture, including its core functions, implementation tiers, and how organizations assess their maturity. You will learn how these elements support strategic security planning and governance.

Sample question from this domain above: Q3

Domain 3: Framework Implementation 75%

This section covers the practical deployment of the NIST Cybersecurity Framework within organizations using COBIT 2019. You will study methodologies for framework adoption, tools for managing implementation, and best practices for maintaining governance and cybersecurity controls.

Sample questions from this domain above: Q1Q2Q5

FAQ

NIST-COBIT-2019 Exam FAQ

Common questions about the exam itself

What prerequisites do I need before taking the NIST-COBIT-2019 exam?
You must have already successfully passed the COBIT 2019 Foundation exam or completed the COBIT 2019 Bridge exam. This ensures you have foundational knowledge of COBIT 2019 before learning how to integrate it with the NIST Cybersecurity Framework.
How difficult is the NIST-COBIT-2019 exam?
The exam tests practical understanding rather than pure memorization, with 75% of content focused on framework implementation. This requires hands-on knowledge of how to actually deploy the NIST Cybersecurity Framework within real organizations alongside COBIT 2019 governance practices.
Who is the target audience for NIST-COBIT-2019 certification?
The exam targets professionals involved in building or improving cybersecurity programs who have foundational knowledge of both COBIT 2019 and security concepts. This includes IT governance professionals, security practitioners, and compliance specialists looking to align governance with cybersecurity.
What job roles does NIST-COBIT-2019 certification lead to?
This certification is designed for professionals in IT governance, cybersecurity governance, risk and compliance roles, and those managing enterprise governance of information and technology (EGIT). It especially suits security professionals building integrated governance and cybersecurity programs.
How long should I prepare for the NIST-COBIT-2019 exam?
Preparation time varies based on your COBIT 2019 foundation knowledge, but most candidates benefit from structured training alongside self-study. Since you already know COBIT 2019, focus your preparation on understanding how the NIST framework maps to COBIT processes and implementation methodologies.
What happens on exam day for NIST-COBIT-2019?
You will take a 90-minute online proctored exam with 50 multiple-choice questions covering three domains. The exam is administered remotely with live proctoring, so you need a quiet testing environment and a stable internet connection.
What is the relationship between NIST-COBIT-2019 and the COBIT 2019 Foundation exam?
NIST-COBIT-2019 is an advanced credential that builds on COBIT 2019 Foundation knowledge. While Foundation covers the COBIT framework structure, this exam teaches you how to apply COBIT alongside the NIST Cybersecurity Framework to create integrated cybersecurity governance.
Which domain of NIST-COBIT-2019 is most challenging?
Framework Implementation accounts for 75% of the exam content and is the most challenging because it requires practical knowledge of deployment methodologies and real-world application. Candidates should focus on understanding how to map NIST framework steps to COBIT governance processes.
Can I retake the NIST-COBIT-2019 exam if I fail?
Yes, you can retake the exam if needed, though specific retake policies and any waiting periods should be confirmed with ISACA. Check the ISACA credentialing policies for details on retake fees and scheduling.
How does NIST-COBIT-2019 fit into the broader COBIT certification path?
This is a specialized credential separate from the main COBIT 2019 hierarchy. It extends your COBIT 2019 Foundation knowledge into cybersecurity framework implementation, targeting professionals who need to integrate NIST standards into their COBIT governance programs.