Question 1

As part of the business continuity plan preparations, management wants a site arrangement to facilitate a desk for the workers. Which site do you recommend?

Accepted Answer

A

Explanation: A hot site is a fully equipped alternate facility, including office space with desks, computers, network connectivity, and all necessary systems, ready for immediate use. In the context of a business continuity plan (BCP), the request to "facilitate a desk" implies providing a fully functional workspace where employees can resume critical operations with minimal delay. A hot site is the only option that meets this requirement for immediate operational readiness, making it the most suitable recommendation to management for ensuring business continuity for its workers.

Question 2

During financial year closing, a processing error in a critical financial system occurs. Senior
management demands a change to be implemented in order to not further delay the business
processes. Which sort of change is applied?

Accepted Answer

D

Explanation: The situation describes a high-impact incident (a processing error in a critical financial system) occurring during a time-sensitive business period (financial year closing). The demand from senior management to implement a fix immediately to prevent further business disruption necessitates an emergency change. According to IT Service Management principles, emergency changes are those that must be implemented as soon as possible to resolve a high-impact incident. The assessment and authorization process for these changes is expedited to ensure a swift resolution, with full documentation and review often occurring after the change has been implemented.

Question 3

A selection process for new IT staff has started. The Human Resource department has requested to
follow the corporate staff hiring protocol. One mandatory item to be included is additional screening.
What is verified by doing this?

Accepted Answer

C

Explanation: In the context of corporate hiring protocols, particularly for IT staff who will have access to sensitive information and systems, "additional screening" refers to background verification checks. These are security measures that go beyond verifying the qualifications listed on a resume. A criminal record check is a fundamental component of this process. It is conducted to assess a candidate's trustworthiness and mitigate potential insider threats, thereby protecting the organization's assets, data, and reputation. This type of screening is considered a critical control in personnel security management.

Question 4

On behalf of senior management, the Human Resource management department instructs all unit managers to perform appraisal meetings using SMART conditions. Which method is expected to be followed?

Accepted Answer

A

Explanation: The SMART framework, an acronym for Specific, Measurable, Achievable, Relevant, and Time-bound, is a foundational technique for setting clear and trackable goals. Management By Objectives (MBO) is a performance management model where managers and employees collaboratively set objectives for a specific period. The success of the MBO process is critically dependent on these objectives adhering to SMART criteria to ensure they are unambiguous and their achievement can be objectively verified. Therefore, an instruction to use SMART conditions for appraisals directly points to the implementation of the MBO method.

Question 5

Being part of service management, business relationship management follows the principles of the service lifecycle. Which of the below is not part of activities defined in service operation?

Accepted Answer

D

Explanation: The IT service lifecycle, a core concept in service management frameworks like ITIL, is divided into distinct phases. The Service Operation phase focuses on the day-to-day activities required to deliver and support services at agreed-upon levels. This includes communicating outages (A), reporting on performance (B), and managing escalations (C). In contrast, 'Define service strategy' (D) is the primary purpose of the Service Strategy phase, which is the initial phase of the lifecycle. This phase is concerned with setting the overall goals, policies, and direction for IT services to ensure they align with and support the organization's business objectives. Therefore, defining the strategy is not an activity performed within Service Operation.

Question 6

Due to technical and operational constraints, the preferred control to lower the risks identified is to
outsource part of IT operations to an external vendor. What type of risk treatment is applied here?

Accepted Answer

C

Explanation: Risk treatment involves selecting and implementing options for addressing risk. When an organization outsources part of its operations, it contractually shifts the responsibility and associated operational risks to an external vendor. This strategy is known as risk transfer. The organization pays the vendor to assume the risk and manage the specific function, thereby lowering its own exposure due to internal constraints. While the organization may retain ultimate accountability, the direct operational and financial consequences of the risk are transferred to the third party.

Question 7

Your organization considers a job rotation program. What is the main objective?

Accepted Answer

A

Explanation: The main strategic objective of a job rotation program is to support the long-term continuity and resilience of the organization. By systematically moving employees through different roles, the organization cross-trains its workforce, which mitigates the risks associated with single points of failure (i.e., critical knowledge or skills residing with only one person). This practice is a fundamental component of succession planning and knowledge management, ensuring that essential business operations can persist through staff turnover, absences, or other disruptions. While other options are valid benefits, they are secondary to this primary goal of ensuring organizational stability and continuity.

Question 8

One of the company’s assets is valued at $200,000.00. Based on historical data, the exposure factor is
25%, and the Annual Loss Expectancy (ALE) is calculated at $100,000.00. What is the Annualized Rate
of Occurrence (ARO)?

Accepted Answer

C

Explanation: The calculation follows the standard quantitative risk analysis formulas. First, determine the Single Loss Expectancy (SLE) by multiplying the Asset Value (AV) by the Exposure Factor (EF). SLE = AV EF SLE = $200,000.00 0.25 = $50,000.00 Next, use the formula for Annual Loss Expectancy (ALE), which is ALE = SLE ARO (Annualized Rate of Occurrence). To find the ARO, rearrange the formula: ARO = ALE / SLE ARO = $100,000.00 / $50,000.00 = 2 Therefore, the Annualized Rate of Occurrence is 2, meaning the event is expected to happen twice per year.

Question 9

Vendor management meetings take place several times per year. What is the main objective for these meetings?

Accepted Answer

C

Explanation: The main objective of regular vendor management meetings is to conduct a formal review of the vendor's performance. This process is centered on verifying that the services and products delivered align with the agreed-upon terms, conditions, and service levels stipulated in the contract. The ultimate goal is to ensure that the vendor's contribution continues to effectively support the organization's business processes and objectives. While discussions on improvements or costs may occur, they are typically secondary to this primary function of performance verification and contractual compliance.

Question 10

From the list below, which activity is not considered to be an activity in the software development phase?

Accepted Answer

D

Explanation: The Software Development Life Cycle (SDLC) is a structured process that consists of distinct phases. The "development" phase (also known as construction or programming) is primarily concerned with the creation of the software itself. Core activities within this phase include writing code based on design specifications, performing unit and integration testing to ensure individual components work correctly, and documenting the code and technical architecture. In contrast, "Implementation" (also known as deployment) is a separate, subsequent phase in the SDLC. This phase focuses on installing the completed and tested software into the production environment, making it available for end-users. It involves activities like system installation, configuration, data migration, and user training, which occur after the core development work is finished.

Free Exin CITM Actual Exam Questions