Isaca Updated COBIT-2019 Exam Questions and Answers by orin

 The threat landscape is a design factor that describes the types and levels of threats that an enterprise faces from internal and external sources that could compromise its information and technology assets. The threat landscape helps to determine the level of security and resilience that an enterprise needs to protect its information and technology assets from unauthorized access, use, disclosure, modification, destruction, or disruption. When tailoring a governance system for an enterprise, one of the most important factors to consider for an operating environment with a high compliance requirement is the threat landscape. The compliance requirement is another design factor that describes the extent and nature of laws, regulations, standards, guidelines, contracts, or agreements that an enterprise must comply with regarding its information and technology activities. The compliance requirement influences the level of control and assurance that an enterprise needs to demonstrate its adherence to the applicable rules and obligations.  By considering the threat landscape in relation to the compliance requirement, an enterprise can ensure that its governance system is appropriate for its risk profile and context, and that it can effectively manage the potential impacts of threats on its compliance status 3 4   References:   3 : COBIT 2019 Design Guide: page 41-43  4 : COBIT 2019 Design Guide: page 47-48

 The component that should be considered for inclusion when considering the threat landscape design factor is information security focus areas. The threat landscape is one of the 11 design factors defined in COBIT 2019, and it refers to the current and emerging threats that may affect the enterprise’s information and technology assets, such as cyberattacks, natural disasters, human errors, etc. Information security focus areas are the specific domains or topics that need to be addressed by the governance system to ensure adequate protection of information and technology assets from potential threats, such as identity and access management, data protection, incident response, etc.  The answer is based on the COBIT 2019 Design Guide 4 , page 17.  References:   4 : COBIT 2019 Design Guide | Digital | English

The number of business processing hours lost due to unplanned service interruptions would be an appropriate metric associated with an enterprise goal of business service continuity and availability. A metric is a quantifiable measure that is used to track and assess the status of a specific process or activity. Business service continuity and availability is one of the 17 generic enterprise goals defined by COBIT that describes the desired outcome of ensuring that critical business services are delivered at agreed levels and are resilient to disruptions.  The number of business processing hours lost due to unplanned service interruptions is a metric that reflects how well this outcome is achieved. 1 3   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance and Management Objectives

A guiding principle in the development of COBIT is that COBIT aligns with other related and relevant I & T standards, frameworks and regulations. This is based on the principle of integration, which states that “governance of enterprise I & T should ensure integration into enterprise governance; alignment with other related standards, frameworks and regulations; and provision of a common language for all stakeholders” . COBIT does not include or replace other standards, frameworks or regulations, but rather complements them by providing a holistic and comprehensive approach to governance of enterprise I & T.