Free Exin CITM Practice Exam with Questions & Answers

Inrisk management, after controls are implemented to mitigate risks, the remaining risk that the organization is willing to accept is calledresidual risk(C). According to frameworks likeISO/IEC 27001andCOBIT, residual risk represents the level of risk that persists after applying controls, deemed acceptable based on the organization’s risk appetite. For example, if a control reduces the likelihood or impact of a threat (e.g., data breach), the remaining exposure is the residual risk, which the organization monitors but does not further mitigate unless necessary.

Reduced risk (A):Not a standard term; implies a general decrease but lacks specificity.

Lowered risk (B):Similar to reduced risk, not a recognized term in risk management frameworks.

Modified risk (D):Implies risk alteration but is not a standard term for post-control risk levels.

Residual risk is a critical concept in risk management, ensuring organizations understand and accept the remaining exposure after mitigation efforts.

For abusiness continuity planrequiring a site to facilitate desks for workers, ahot site(A) is recommended. A hot site is a fully equipped, operational facility with real-time data replication, allowing immediate resumption of operations with minimal downtime. According toISO 22301, hot sites are ideal for critical operations requiring desks, IT infrastructure, and immediate availability for workers to continue business processes post-disaster.

Cold site (B):A basic facility with minimal equipment, requiring significant setup time, unsuitable for immediate worker use.

Warm site (C):Partially equipped with some infrastructure but not fully operational, requiring setup time.

Mobile site (D):A temporary, portable solution, less suitable for sustained operations compared to a hot site.

When implementing a new system, the customer’s concern about a large impact on the user base suggests the need for a low-risk, controlled adoption strategy. Inapplication management, theparalleladoption approach (B) involves running both the old and new systems simultaneously for a period, allowing users to transition gradually while ensuring the new system functions correctly. This minimizes disruption, as the old system remains operational as a fallback if issues arise with the new system.

Big bang (A):This approach involves switching entirely to the new system at once, which is high-risk and likely to cause significant disruption, especially for a concerned user base. It’s unsuitable here due to the potential for widespread impact.

Coordinated (C):This is not a standard term in application deployment strategies. It may imply a managed transition but lacks the specificity of parallel or phased approaches.

Phased (D):This involves rolling out the new system incrementally (e.g., by department or module), which reduces risk but doesn’t provide the same level of safety as parallel, where both systems run concurrently to ensure continuity.

Theparallelapproach is ideal for mitigating risks during a critical system transition, as it allows validation of the new system’s performance while maintaining business continuity. According toITILorSDLCframeworks, parallel adoption is often recommended for mission-critical systems to ensure stability and user acceptance.

In corporate hiring protocols,additional screeningtypically refers to background checks beyond basic qualifications, such as verifying a candidate’scriminal record. This is critical for IT roles, where employees may have access to sensitive systems and data, ensuring trustworthiness and compliance with security policies.

Salary demands (A) are negotiated during the hiring process, not screened. Number of years of experience (B) and educational level (D) are verified through resumes and standard checks, not typically classified as “additional screening,” which focuses on security-related checks like criminal records.

Acompensating controlis an alternative control implemented when the preferred control cannot be applied due to constraints (e.g., technical, financial, or operational). According to frameworks likeCOBITorISO/IEC 27001, compensating controls provide equivalent or partial risk mitigation when the primary control is infeasible.

Deterrent controls (A) discourage violations, detective controls (C) identify incidents, and corrective controls (D) address issues after they occur. Only compensating control (B) fits the scenario of a second-best alternative due to constraints.

The correct sequence for arisk assessment, as perISO 31000andISO/IEC 27001, is:Establish context — identify — analyse — evaluate — treatment(C).

Establish context:Define the scope, objectives, and criteria for the risk assessment (e.g., organizational goals, assets, and risk appetite).

Identify:Identify potential risks (e.g., threats and vulnerabilities) that could impact objectives.

Analyse:Assess the likelihood and impact of identified risks to determine their severity.

Evaluate:Compare risks against risk criteria to prioritize them for treatment.

Treatment:Implement controls or strategies to mitigate, avoid, transfer, or accept risks.

Option A:Incorrect, as “monitor and review” is a post-treatment step, not the starting point.

Option B:Incorrect, as “communication” is not a distinct step in risk assessment; it’s embedded throughout.

Option D:Incorrect, as it skips “establish context,” which is essential for defining the assessment’s scope.

This sequence ensures a structured, systematic approach to risk assessment, aligning with organizational objectives.

For a budget proposal that must beas accurate as possibleand supported by aWork Breakdown Structure (WBS)orProduct Breakdown Structure (PBS), thebottom-up estimate(A) is preferred. This method involves estimating costs for each task or deliverable in the WBS/PBS, then aggregating them to calculate the total budget. According toPMBOK, bottom-up estimation leverages detailed data, ensuring high accuracy, especially when a WBS is available.

Rough Order of Magnitude (ROM) (B):A high-level estimate with low accuracy (±50%), used early in projects, not suitable for detailed budgeting.

Analogous estimate (C):Relies on historical data from similar projects, less accurate than bottom-up when detailed WBS data exists.

Budget estimate (D):A general term, not a specific technique, and less precise than bottom-up.

InITIL(Information Technology Infrastructure Library), anemergency changeis implemented to address urgent issues that significantly impact business operations, such as a processing error during financial year closing. Emergency changes are fast-tracked to restore service or prevent further disruption, bypassing some standard change management processes while still requiring approval.

Normal changes (A) follow the full change management process, standard changes (B) are pre-approved and routine, and exceptional (C) is not a standard ITIL term. Emergency change (D) fits the scenario of urgent action to avoid business delays.

The primary reason for includinganonymous feedbackin feedback collection is topromote honest feedback while avoiding fear for backfiring on the participant(B). Anonymity encourages participants to provide candid, truthful responses without worrying about repercussions, such as criticism or retaliation, which is critical inservice managementfor gathering accurate insights into service quality or issues. According toITIL’s continual service improvement (CSI), honest feedback is essential for identifying areas for improvement.

Avoidance of non-compliance (A):Anonymity is unrelated to regulatory compliance in this context.

Easier processing of data (C):Anonymity may complicate data processing by removing identifiers, not simplifying it.

Reduced time (D):Anonymity doesn’t inherently reduce the time required for feedback.

SMART(Specific, Measurable, Achievable, Relevant, Time-bound) is a goal-setting framework commonly associated withManagement By Objectives (MBO). MBO involves setting clear, measurable objectives for employees, aligning individual performance with organizational goals. In appraisal meetings, using SMART conditions ensures that performance goals are clearly defined and trackable, which is a hallmark of MBO.

Graphic rating scales (B) involve rating employees on a scale for various traits, not necessarily tied to SMART goals. Ranking (C) and Performance ranking method (D) focus on comparing employees, which doesn’t align with SMART’s emphasis on individual, objective-based performance evaluation.