COBIT5 COBIT 5 Foundation Exam Topics and Questions

This is the heaviest topic on the exam, and it demands you know how a governance system is constructed. You will face questions that test whether you can identify which component does what, how they fit together, and why each one matters to the overall objective. The topic is conceptual rather than procedural, so rote lists will not save you.

How Governance System and Components is tested

At thirty percent, this topic determines whether you pass. Items test your ability to distinguish between processes, structures, policies, culture, people, and information as distinct components, and to recognize what happens when one is missing or misaligned. The exam expects you to know why organizations need a governance system in the first place, not just what one contains. You lose marks when you confuse a component's purpose with its label, or when you treat governance as a synonym for control. The trap is choosing the answer that sounds authoritative but describes the wrong layer of the system. Weight this heavy means you cannot afford to skim the component definitions or rely on intuition about what governance ought to mean.

Once you understand the system's components, the exam shifts to what those components are meant to achieve. Governance objectives are not the same as management objectives, and the distinction is examinable. The framework groups these objectives in a particular way, and you need to know which area does what and how governance oversight differs from day-to-day management activity.

How Governance and Management Objectives is tested

At twenty-three percent, this topic will appear in roughly one question out of every four. Items test whether you can tell governance from management in a scenario, and whether you know what each objective area is intended to achieve. The exam does not ask you to recite a list. It presents a situation and expects you to identify which objective applies, or which type of activity is being described. You lose marks when you pick the answer that describes a management task but label it governance, or when you choose an objective that sounds plausible but belongs to the wrong grouping. The relationship between oversight and execution is the examinable distinction, and the weight means you cannot treat this as a secondary topic.

The framework rests on a set of core principles, and you will be tested on what they mean and why they matter. These principles guide how governance and management are approached, and they support consistent decision-making across the enterprise. At thirteen percent, this is not a light topic. You need to know each principle well enough to apply it, not just name it.

How Principles is tested

Items from this topic expect you to recognize which principle applies in a given context, or what a principle implies for how governance is structured. The exam does not ask you to define a principle in abstract terms. It gives you a scenario and tests whether you can connect the principle to the decision or approach described. You lose marks when you choose the principle that sounds most relevant to IT in general rather than the one that matches the specific governance challenge in the stem. The trap is picking the answer that feels right because it mentions a familiar concept, even though it describes the wrong principle. At thirteen percent, this topic will appear multiple times, and each item will turn on your ability to apply a principle rather than recall its wording.

Before the exam tests how you apply the framework, it tests whether you understand what the framework is for and how it is organized. This topic covers the overall purpose and structure, how the framework aligns IT with business goals, and the basic concepts you need before anything else makes sense. At twelve percent, it carries enough weight to cost you a pass if you skip the fundamentals.

How Framework Introduction is tested

Items here test whether you know why the framework exists, what problem it solves, and how its structure supports that purpose. The exam expects you to recognize how the framework helps align IT with business goals, and to identify which part of the framework addresses a particular need. You lose marks when you confuse the framework's purpose with its content, or when you pick an answer that describes a benefit without connecting it to the framework's design. The trap is choosing the option that sounds like good governance practice in general, even though it does not reflect how COBIT 5 approaches the issue. Weight this heavy means you cannot treat the introduction as background reading. The exam will test it directly, and the questions will assume you know the framework's organizing logic.

After structure and objectives, the exam turns to how you roll the system out. Implementation is not a heavy topic at eight percent, but it is tested in enough depth that you need to know the general approach, the typical phases or considerations involved, and what commonly goes wrong. The focus is on the method, not on detailed project plans.

– Approach and phases

The exam expects you to recognize the general approach to putting governance and management practices into operation. This means knowing what happens first, what follows, and why the sequence matters. You will be asked to identify which phase or consideration applies in a scenario, or what needs to be in place before the next step can begin. The framework describes a structured way to roll out governance, and the exam tests whether you can match an activity to the right part of that structure. The trap is assuming implementation is linear and that every organization follows the same path. The approach accommodates variation, and you need to know where flexibility is built in and where it is not.

– Challenges and enablers

Implementation does not succeed or fail on process alone. The exam tests your understanding of what commonly blocks progress and what makes rollout easier. Challenges include resistance, unclear ownership, and misalignment between governance objectives and operational reality. Enablers include executive support, clear communication, and the right level of tailoring. You will be asked to identify which factor is at play in a scenario, or what would help overcome a described obstacle. The exam does not want a list of best practices. It wants you to recognize the challenge or enabler that fits the context, and to distinguish between a governance issue and a management one. You lose marks when you pick the answer that sounds like good advice but does not address the specific barrier or enabler in the question.

How Implementation is tested

At eight percent, this topic will appear in a handful of items. Each one presents a scenario and asks you to identify which phase, consideration, challenge, or enabler applies. The exam does not ask you to design an implementation plan or to sequence every activity. It tests whether you know the general approach and can recognize what is happening in a given situation. You lose marks when you confuse a governance rollout activity with a management one, or when you choose an answer that describes a good practice but belongs to a different phase. The trap is picking the option that sounds most comprehensive, even though the question asks for a specific element of the approach. The weight is moderate, but the topic is wide enough that you cannot guess your way through it.

No two organizations govern IT the same way, and the exam tests whether you know how to tailor the system to fit. This topic covers why a standard approach does not work for every enterprise, what factors drive customization, and how design considerations ensure the system matches organizational needs. At seven percent, it is lighter than implementation, but it still demands precision.

– Why tailoring matters

The exam expects you to recognize that a governance system must be adapted to the enterprise, not applied as a template. You will be tested on the reasons why a one-size-fits-all approach fails, and on what happens when an organization tries to implement governance without adjusting for its own context. The framework provides guidance on tailoring, and the exam tests whether you know when and why that guidance applies. You lose marks when you choose the answer that describes a standard practice but ignores the need for customization, or when you pick an option that sounds flexible but does not address the specific factor that drives tailoring in the scenario. The trap is assuming that more tailoring is always better, or that less is always safer. The exam wants you to know what drives the decision.

– Factors and design considerations

Tailoring is not arbitrary. The exam tests your knowledge of the factors that determine how a governance system is customized, and the design considerations that guide those choices. Factors include enterprise size, industry, risk appetite, regulatory environment, and IT maturity. Design considerations include which processes to prioritize, which structures to put in place, and how to balance governance oversight with operational efficiency. You will be asked to identify which factor or consideration applies in a scenario, or what should change when a particular factor shifts. The exam does not want a list of every possible variable. It wants you to recognize the one that matters in the context given, and to distinguish between a factor that drives design and a constraint that limits it.

How Designing a Tailored Governance System is tested

At seven percent, this topic will appear in a small number of items. Each one presents a scenario and asks you to identify which factor drives tailoring, or which design consideration applies. The exam does not ask you to build a governance system from scratch. It tests whether you know why tailoring is necessary, what drives it, and how the system changes in response to organizational context. You lose marks when you confuse a factor with a design consideration, or when you pick an answer that describes a general governance principle but does not address the tailoring question. The trap is choosing the option that sounds most rigorous, even though the question asks for the factor that fits the specific enterprise described. The weight is moderate, but the topic is precise, and you cannot afford to guess.

Governance does not end when the system is in place. The exam tests whether you know how performance is measured, how progress toward objectives is tracked, and how results are used to drive improvement. At four percent, this is a light topic, but the questions still demand precision. You need to know the concepts, not just the vocabulary.

– Measurement concepts

The exam expects you to recognize how governance and management activities are measured, and what concepts are used to track whether objectives are being achieved. This includes understanding the difference between a measure and a metric, knowing what a baseline is for, and recognizing when a performance indicator is fit for purpose. You will be asked to identify which concept applies in a scenario, or what type of measurement would answer a particular question. The exam does not want definitions. It wants you to know which concept fits the situation described, and to distinguish between measuring governance performance and measuring management performance. The trap is picking the answer that sounds most quantitative, even though the question asks for the concept that matches the objective being tracked.

– Using results for improvement

Measurement is pointless unless the results inform action. The exam tests whether you know how performance data is used to guide improvement, and what happens when results show that objectives are not being met. This includes recognizing when a change to the governance system is needed, when a management practice should be adjusted, and when the problem lies in the measurement itself rather than the performance. You will be asked to identify what action follows from a set of results, or what the results indicate about the system. The exam does not ask you to design an improvement plan. It tests whether you can connect performance data to the right response, and whether you know the difference between correcting a process and changing a governance objective.

How Performance Management is tested

At four percent, this topic will appear in only a few items. Each one presents a scenario involving measurement or performance data, and asks you to identify which concept applies or what the results mean. The exam does not test calculation or detailed metrics. It tests whether you know how performance is tracked, what the concepts mean in practice, and how results are used to guide improvement. You lose marks when you confuse a measure with a metric, or when you pick an answer that describes a good measurement practice but does not fit the governance or management context in the question. The trap is choosing the option that sounds most analytical, even though the question asks for the concept or action that matches the scenario. The weight is light, but the questions are precise, and you cannot afford to guess.

The final topic is the lightest, but it is still tested. A business case justifies decisions, and the exam expects you to know its purpose, what goes into it, and how it connects objectives to value. At three percent, you will see only a few items, but each one will test whether you know what a business case does in a governance context.

– Purpose and elements

The exam expects you to recognize why a business case is needed, and what it contains. Purpose matters more than format. A business case supports governance and management decisions by showing how an initiative or investment aligns with objectives, what it will cost, what value it will deliver, and what risks it carries. You will be asked to identify which element belongs in a business case for a given scenario, or what the business case is meant to achieve. The exam does not want a list of every possible component. It wants you to know which elements are essential, and to distinguish between a business case and a project plan. The trap is picking the answer that describes a good governance practice but does not belong in the business case itself.

– Linking objectives to value

A business case is not complete unless it connects what you plan to do with what you expect to achieve. The exam tests whether you know how objectives are linked to expected value and outcomes, and how that link is made explicit. This includes recognizing when a business case shows clear alignment and when it does not, and knowing what happens when the link between objectives and value is weak or missing. You will be asked to identify what the business case demonstrates, or what is missing from a described business case. The exam does not ask you to write one. It tests whether you can recognize the connection between objectives and value, and whether you know what that connection looks like in a governance or management context.

How Business Case is tested

At three percent, this topic will appear in only one or two items. Each one presents a scenario involving a decision or investment, and asks you to identify the purpose of the business case, what it should contain, or how it links objectives to value. The exam does not test detailed financial analysis or project documentation. It tests whether you know what a business case is for in a governance context, and what makes one fit for purpose. You lose marks when you confuse a business case with a project plan, or when you pick an answer that describes a desirable outcome but does not belong in the business case itself. The trap is choosing the option that sounds most comprehensive, even though the question asks for the specific element or link that fits the scenario. The weight is light, but the questions are precise.