Assessing Corporate Cybersecurityintermediate
A bank’s leadership uses COBIT to create a structured risk-governance process. Which domain is specifically associated with evaluating, directing, and monitoring enterprise governance?
Answer
Evaluate, Direct and Monitor (EDM)
Explanation
### Why this is right
EDM is the governance domain. The course’s bank case specifically describes leadership using COBIT’s EDM03 for a structured risk-governance process, so the governance domain is the relevant choice.
### The concept
COBIT separates governance from management. Governance evaluates needs and options, sets direction, and monitors results. Management domains support planning, implementation, service delivery, and assessment. The case also describes APO13 as security management, but that is a management objective rather than the governance domain asked for here.
### The other options
- **Build, Acquire and Implement (BAI)**: concerns assessing requirements, acquiring technology, and implementing it.
- **Deliver, Service and Support (DSS)**: concerns delivering and supporting information technology.
- **Align, Plan and Organize (APO)**: concerns planning and organizing information technology to meet objectives.
### Terms
- **Risk governance**: direction and oversight of how enterprise risks are evaluated and managed.
- **EDM03**: the COBIT objective used in the supplied bank case for a structured risk-governance process.
### Remember
Leadership direction and oversight point to governance, not a technology implementation domain.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free