APO03 Manage enterprise architecture is the correct objective. It specifically deals with defining a technology architecture that supports the business strategy and facilitates the integration and interoperability of technology solutions, which is the core concern when implementing a new system like a CRM to ensure it meets business needs now and in the future.

DSS02 Manage service requests and incidents is the correct practice. It encompasses the establishment of a formal incident management system, including categorization, prioritization, and consistent response procedures for all incidents, not just major ones. This practice ensures operational issues are resolved systematically and learning is captured.

Principles, Policies and Procedures, and Organizational Structures is the correct combination. To manage third-party risk, the organization first needs core principles (like risk optimization). These must be translated into concrete policies and procedures for vendor due diligence and contracts. Finally, clear organizational structures (e.g., a vendor management office, defined roles) are needed to execute and oversee these procedures effectively.

EDM02 Ensure benefits delivery is the correct objective. This objective is centered on ensuring that IT-related investments are aligned with business strategy and that their benefits are clearly identified, tracked, and realized. By applying this governance lens, the CIO can shift the conversation from technology features to tangible business outcomes and value, securing necessary stakeholder engagement.

APO07 Manage human resources is the correct practice. While DSS05 covers security services like access provisioning, APO07 specifically addresses the management of the employee lifecycle, including the coordination with other processes (like security) to ensure access rights are granted, modified, and revoked in a timely manner based on job changes and termination. The lack of a documented process for revocation is a core HR process integration issue.

To assess the performance of the management system is correct. Metrics related to project delivery and system uptime are performance indicators for how well IT management processes (like BAI01 and DSS01) are functioning. They are operational management metrics used to tune and improve the execution of day-to-day activities, which falls under assessing the management system’s performance.

Integrating automated compliance checks into the CI/CD pipeline is the most aligned approach. COBIT 2019 emphasizes the use of technology for governance and supports adaptive governance systems. This approach embeds control and assurance activities directly into the development process (aligning with BAI10 Manage configuration), making them continuous, efficient, and scalable, which is appropriate for an agile environment.

Concentrating on core governance activities and a few critical management practices is correct. COBIT 2019 is designed to be tailored. For a resource-constrained organization, the most practical approach is to focus on essential governance (setting direction) and a handful of high-priority management practices that address their most significant risks (like understanding risk and handling incidents), rather than attempting a broad, complex implementation.

To translate stakeholder needs into a clear strategic direction for I&T is correct. The goals cascade is a core mechanism in COBIT 2019 for ensuring alignment. It formally connects what the enterprise wants to achieve (enterprise goals) with what the I&T function must deliver (IT-related goals). This translation is crucial for ensuring that all I&T activities are ultimately contributing to creating value for the enterprise and its stakeholders.

APO03 Manage enterprise architecture is the correct objective. It specifically deals with defining a technology architecture that supports the business strategy and facilitates the integration and interoperability of technology solutions, which is the core concern when implementing a new system like a CRM to ensure it meets business needs now and in the future.0