ISACA • COBIT-Design

COBIT Design & Implementation Certificate Program Practice Test

Validates the ability to design and implement IT governance systems using the COBIT framework, covering governance implementation lifecycle, system design workflow, design factors, and governance improvement programs for enterprise information and technology.

Exam Details

Questions

599

Duration

180 minutes

Passing Score

60%

Difficulty

Associate

Last Updated

Feb 2026

Exam Domain Breakdown

Governance Implementation Lifecycle32%

The Governance System Design Workflow32%

Design Factors for a Governance System15%

COBIT Basic Concepts8%

Implementing & Optimizing I&T Governance Overview7%

Impact of Design Factors3%

Key Topics Decision Matrix3%

Exam Overview

The COBIT Design & Implementation Certificate Program, offered by ISACA, validates a professional's ability to design and implement governance systems for enterprise information and technology using the COBIT 2019 framework. The credential specifically focuses on the governance implementation lifecycle, governance system design workflow, and the application of design factors to tailor COBIT to an organization's specific context. It goes beyond conceptual understanding of COBIT to assess practical skills in building and optimizing governance programs.

This certificate is part of ISACA's broader COBIT credentialing pathway and sits above the COBIT Foundation Certificate in terms of depth and application. It demonstrates that a holder can translate COBIT's principles and enabling factors into a functioning governance system, account for organizational design factors, and drive continuous improvement in IT governance maturity. The credential is globally recognized and applicable across industries that rely on structured IT governance, risk management, and compliance frameworks.

Official exam page

Who Should Take This Exam

This certificate is designed for IT professionals who are actively involved in designing or implementing IT governance frameworks within their organizations. Ideal candidates include IT governance specialists, IT managers, enterprise architects, IT auditors, risk and compliance officers, and consultants who advise organizations on governance transformation. It is also well-suited for professionals pursuing executive-level IT leadership roles who need to demonstrate governance design competency.

Teams responsible for rolling out enterprise-wide IT governance solutions will benefit significantly, as will students and recent graduates who want to differentiate themselves in the IT governance domain. Candidates are expected to have foundational knowledge of COBIT concepts — either through the COBIT Foundation Certificate or equivalent practical experience — before pursuing this more advanced credential.

Prerequisites

ISACA does not mandate a formal prerequisite certification to register for this exam, but candidates are strongly advised to hold the COBIT Foundation Certificate or have equivalent working knowledge of COBIT 2019 concepts, terminology, and the COBIT performance management system. Without this grounding, the design and implementation content will be difficult to contextualize.

Practical experience in IT governance, IT management, or a related field is highly recommended. Familiarity with related frameworks such as ITIL, ISO 27001, and risk management standards will also support comprehension of how COBIT design factors interact with real organizational environments. ISACA offers accredited training courses specifically aligned to this certificate that candidates can use to build readiness before sitting the exam.

Exam Format

The COBIT Design & Implementation exam is a computer-based, remotely proctored assessment consisting of 60 multiple-choice questions. The exam must be completed within 180 minutes (3 hours). A passing score of 60% is required, meaning candidates must answer at least 36 questions correctly. The exam fee is US$275 for both ISACA members and non-members.

Candidates register on a continuous basis with no enrollment windows or restrictions, and can schedule a testing appointment as early as 48 hours after payment. Exam eligibility is valid for 12 months from the registration date, and appointments can be booked up to 90 days in advance. Rescheduling is permitted without penalty if done at least 48 hours before the scheduled appointment. Candidates are allowed up to 4 attempts within a rolling 12-month period.

Skills Measured

1.Governance Implementation Lifecycle (32%): Covers the full lifecycle for implementing or improving IT governance, including understanding the phases of the implementation program, change enablement, and sustaining governance improvements over time.
2.The Governance System Design Workflow (32%): Focuses on the step-by-step process for designing a tailored COBIT governance system, including selecting governance objectives, setting target capability levels, and producing a governance implementation roadmap.
3.Design Factors for a Governance System (15%): Addresses the twelve COBIT design factors — such as enterprise strategy, risk profile, IT role, and sourcing model — that influence how a governance system should be configured for a specific organization.
4.COBIT Basic Concepts (8%): Tests foundational knowledge of the COBIT 2019 framework structure, including core concepts, the governance and management objectives, and the COBIT performance management system.
5.Implementing & Optimizing I&T Governance Overview (7%): Covers the broader context of IT governance implementation programs, including the relationship between governance design and organizational improvement initiatives.
6.Impact of Design Factors (3%): Examines how specific design factor variants affect the prioritization and tailoring of governance and management objectives within the COBIT system.
7.Key Topics Decision Matrix (3%): Assesses ability to use the COBIT decision matrix to map design factor outcomes to priority focus areas within a governance system.

Study Tips

Use the official ISACA COBIT 2019 Design and Implementation Guide as your primary study text — the exam domains map directly to its chapters, and understanding its design workflow and lifecycle phases is essential for the majority of exam questions.
Take an ISACA-accredited COBIT Design & Implementation training course from an authorized partner. These instructors are vetted by ISACA and align their curriculum precisely to the exam objectives, covering the design workflow and lifecycle in structured detail.
Focus the majority of your preparation on the two heaviest domains — Governance Implementation Lifecycle and Governance System Design Workflow — which together account for 64% of the exam. Master the seven-phase implementation lifecycle and the governance system design workflow steps before moving to lower-weighted topics.
Practice applying all twelve COBIT design factors (enterprise strategy, risk profile, threat landscape, compliance requirements, role of IT, sourcing model, IT implementation methods, technology adoption strategy, enterprise size, sector/industry, workforce model, and current IT governance) to hypothetical organizational scenarios, as the exam tests applied knowledge, not just recall.
Attend ISACA's free 60-minute COBIT webinars as supplemental preparation. These sessions cover practical implementation concepts and can reinforce understanding of how COBIT concepts translate into real governance decisions.
Review the ISACA COBIT Design & Implementation Exam Candidate Guide, which is available through the official ISACA credentialing portal. It outlines the domain weights, exam policies, and provides guidance on how questions are structured.
If you have not already earned the COBIT Foundation Certificate, study the Foundation content first to solidify your understanding of COBIT 2019 core concepts (Domain 4, 8% of this exam) before tackling the design and implementation material.

Career Benefits

Earning the COBIT Design & Implementation Certificate positions professionals for roles in IT governance leadership, including IT Governance Manager, Governance Consultant, IT Auditor, Risk and Compliance Manager, and Chief Information Officer. Professionals with COBIT credentials and governance expertise in North America commonly earn salaries exceeding $100,000, with ISACA reporting average practitioner salaries around $114,949 and roles such as IT Auditor reaching up to $106,000 and CISOs well above that range.

The credential is recognized globally across both public and private sectors, making it valuable for professionals operating in regulated industries such as financial services, healthcare, and government. Compared to the COBIT Foundation Certificate, this credential demonstrates hands-on design and implementation capability rather than conceptual awareness alone — a distinction that is meaningful to employers evaluating candidates for governance program leadership. It also complements other ISACA credentials such as CISA, CISM, and CGEIT, and can be combined with ITIL or ISO 27001 expertise to build a comprehensive IT governance and risk management profile.

Sample Questions

Preview — answers shown

5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 599 questions.

1. A logistics company implements DSS04 Managed Continuity and must establish information flows between governance and management layers. The Board of Directors (EDM layer) requires regular reporting on continuity preparedness. Which information flow direction and content is most appropriate? (Select one!)

ACircular flow creating feedback loop between EDM direction, DSS04 execution, and MEA01 performance monitoring

BUpward flow from DSS04 to EDM providing continuity test results, recovery capability assessments, and residual risk status

CDownward flow from EDM to DSS04 providing strategic direction on acceptable recovery time objectives and continuity investment priorities

DLateral flow between DSS04 and APO12 Managed Risk coordinating continuity planning with enterprise risk management

Explanation

Information flows between governance (EDM) and management layers include downward flows conveying strategic direction and upward flows providing performance and status reports. The Board of Directors requiring regular reporting on continuity preparedness represents the management layer (DSS04) reporting upward to the governance layer (EDM) with performance information. This upward flow should include test results, capability assessments, and risk status enabling EDM to monitor achievement. While downward flow from EDM providing direction exists, the question specifically addresses Board reporting requirements. Lateral flows between management objectives exist but do not address governance reporting needs. While feedback loops exist, the specific reporting requirement described represents upward management-to-governance reporting. Understanding information flow patterns between governance and management layers is essential for implementing effective communication and oversight.

2. A retail organization implements a performance management system using COBIT metrics. The governance team defines percentage of IT investments aligned with strategy as a Key Goal Indicator (KGI) at the EDM level. Which relationship correctly describes how this metric functions in the COBIT performance management hierarchy? (Select one!)

AThis metric should be classified as a KPI rather than KGI because it measures investment alignment

BA KGI at the EDM level serves as a KPI for APO management objectives, cascading performance measures downward

CKGIs are always lagging indicators and cannot influence lower-level KPIs

DKGIs and KPIs operate independently without hierarchical relationships

Explanation

A KGI at lower level serves as KPI to parent KGI is the COBIT performance management cascade principle. In this case, the EDM-level KGI (outcome measure) for investment alignment becomes a KPI (performance driver) for APO objectives like APO05 Managed Portfolio and APO06 Managed Budget and Costs, which must perform well to achieve the EDM outcome. KGIs as lagging indicators is partially correct, but the statement that they cannot influence lower-level KPIs is incorrect—they define what lower levels must achieve. The metric is correctly classified as KGI because it measures the outcome (what has been accomplished) at governance level. KGIs and KPIs have explicit hierarchical cascade relationships in COBIT, not independent operation.

3. During Design Workflow Step 3 (Refine the Scope of the Governance System), a design team identifies conflicting priorities: Design Factor 1 (Enterprise Strategy) recommends high priority for APO06 Managed Budget and Costs due to Cost Leadership strategy, while Design Factor 7 (Role of IT) configured as Strategic recommends comprehensive governance requiring significant investment. How should the design team resolve this inherent conflict? (Select one!)

AEscalate to the board of directors for executive decision since design factors cannot resolve the conflict

BImplement both recommendations by pursuing cost leadership within strategic IT initiatives

CFacilitate stakeholder workshops to negotiate priorities and document the agreed resolution rationale

DDefault to Design Factor 1 since enterprise strategy always takes precedence over other design factors

Explanation

The COBIT design workflow explicitly requires stakeholder workshops to resolve conflicting priorities identified during scope refinement. Design factors provide analytical input, but conflicts require human judgment considering enterprise-specific context, constraints, and priorities. No single design factor automatically takes precedence. Attempting to implement conflicting recommendations without resolution creates incoherent governance systems. While board involvement may be appropriate for major strategic decisions, the design team's role is to facilitate stakeholder negotiation and document rationale. The design canvas specifically includes conflict identification and resolution as a key activity in Step 3, and conflict resolution through stakeholder engagement is a core change enablement principle.

4. A capability assessment evaluates BAI03 Managed Solutions Identification and Build using ISO/IEC 33004 rating scale. The assessment finds that the organization has documented standard processes at the enterprise level with tailoring guidelines, but lacks quantitative performance baselines and statistical process control. Evidence shows 72 percent achievement of the established process definition attributes. What capability level rating should the assessment assign? (Select one!)

ALevel 3 Established with rating F (Fully)

BLevel 2 Managed with rating P (Partially)

CLevel 4 Predictable with rating P (Partially)

DLevel 3 Established with rating L (Largely)

Explanation

Level 3 Established with rating L (Largely) is correct because the organization demonstrates well-defined processes with organizational assets, standard process documentation, and tailoring guidelines—all characteristic of Level 3 capability. The 72 percent achievement falls within the Largely rating range of 50-85 percent. Level 3 requires enterprise-wide standards and organizational procedures, which the evidence confirms exist. The absence of quantitative performance baselines and statistical process control indicates the organization has not achieved Level 4 Predictable. Level 2 Managed only requires project-level planning and documentation without organizational standards. Rating F (Fully) requires over 85 percent achievement. Level 4 Predictable is incorrect because the organization lacks the measured and controlled processes with statistical techniques required for that level.

5. A university implements MEA02 Managed System of Internal Control to provide transparency regarding internal control adequacy. The internal audit department conducts control testing and discovers gaps in segregation of duties for financial systems and inadequate monitoring of privileged access. Which relationship demonstrates how MEA02 serves broader governance objectives? (Select one!)

AMEA02 Key Goal Indicator cascades to DSS05 Managed Security Services operational security metrics

BMEA02 Key Performance Indicator serves as input to APO01 Managed IT Management Framework only

CMEA02 Key Goal Indicator serves as Key Performance Indicator for EDM03 Ensured Risk Optimization

DMEA02 operates independently without hierarchical relationships to other objectives

Explanation

MEA02 Key Goal Indicator serves as Key Performance Indicator for EDM03 Ensured Risk Optimization demonstrates the goals and metrics hierarchy. A KGI at lower level serves as KPI to parent KGI creating a measurement cascade. MEA02 provides assurance that internal controls are adequate which serves as a leading indicator for EDM03's governance objective of ensuring risks are identified and managed. MEA02 does not operate independently but supports governance oversight. MEA02 outputs inform multiple objectives not just APO01. MEA02 KGI does not cascade to DSS05 because DSS operates at the same management level not higher governance level.

One-time access to this exam

Full access to all 599 questions

Or $15/mo for all 201 exams

Detailed explanations

Free preview stays available