Important Exin CITM Exam Questions

Answer: A

Explanation:

In ITIL's problem management process, poor registration of problems (A) is the most likely cause of low-quality problem resolution. Effective problem management requires accurate logging of incidents and problems, including detailed descriptions, to enable proper root cause analysis and resolution. If problems are poorly registered (e.g., incomplete or inaccurate data), it hinders diagnosis and resolution, leading to customer dissatisfaction.

Wrong allocation of problems (B): Incorrect assignment to teams can delay resolution but is less fundamental than poor registration, which affects the entire process.

Errors in priority (C): Incorrect prioritization may delay urgent issues, but poor registration impacts resolution quality more directly.

Lack of budget (D): May limit resources, but the scenario points to process quality, not resource constraints.

Answer: A

Explanation:

A parallel test (A) in business continuity planning involves running systems at both the primary and alternate sites simultaneously to compare data and ensure the alternate site can handle operations effectively. This test verifies data replication and system functionality without interrupting normal operations, aligning with the managers' desire to compare data before a full interruption test.

Simulation test (B): This involves simulating a disaster scenario to test response procedures without activating the alternate site, so it doesn't focus on data comparison.

Structured walk-through test (C): This is a tabletop exercise where team members discuss and review the plan without executing systems or comparing data.

Checklist test (D): This involves reviewing the business continuity plan against a checklist to ensure completeness, not comparing data between sites.

According to ISO 22301 or business continuity management frameworks, a parallel test is used to validate recovery capabilities while maintaining operations at the primary site, making it ideal for the scenario described.

Answer: C

Explanation:

The correct sequence for a risk assessment, as per ISO 31000 and ISO/IEC 27001, is: Establish context --- identify --- analyse --- evaluate --- treatment (C).

Establish context: Define the scope, objectives, and criteria for the risk assessment (e.g., organizational goals, assets, and risk appetite).

Identify: Identify potential risks (e.g., threats and vulnerabilities) that could impact objectives.

Analyse: Assess the likelihood and impact of identified risks to determine their severity.

Evaluate: Compare risks against risk criteria to prioritize them for treatment.

Treatment: Implement controls or strategies to mitigate, avoid, transfer, or accept risks.

Option A: Incorrect, as ''monitor and review'' is a post-treatment step, not the starting point.

Option B: Incorrect, as ''communication'' is not a distinct step in risk assessment; it's embedded throughout.

Option D: Incorrect, as it skips ''establish context,'' which is essential for defining the assessment's scope.

This sequence ensures a structured, systematic approach to risk assessment, aligning with organizational objectives.

Answer: C

Explanation:

In risk management, the Annual Loss Expectancy (ALE) is calculated as:

ALE = Single Loss Expectancy (SLE) Annualized Rate of Occurrence (ARO), where SLE = Asset Value Exposure Factor (EF).

Given:

Asset Value = $200,000

Exposure Factor (EF) = 25% = 0.25

ALE = $100,000

Calculate SLE:

SLE = Asset Value EF = $200,000 0.25 = $50,000

Calculate ARO:

ALE = SLE ARO

$100,000 = $50,000 ARO

ARO = $100,000 $50,000 = 2

Thus, the Annualized Rate of Occurrence (ARO) is 2 (C), meaning the incident is expected to occur twice per year.

0.4 (A): Incorrect; implies a lower frequency (0.4 times per year).

1 (B): Incorrect; would yield an ALE of $50,000, not $100,000.

Answer: B

Explanation:

When implementing a new system, the customer's concern about a large impact on the user base suggests the need for a low-risk, controlled adoption strategy. In application management, the parallel adoption approach (B) involves running both the old and new systems simultaneously for a period, allowing users to transition gradually while ensuring the new system functions correctly. This minimizes disruption, as the old system remains operational as a fallback if issues arise with the new system.

Big bang (A): This approach involves switching entirely to the new system at once, which is high-risk and likely to cause significant disruption, especially for a concerned user base. It's unsuitable here due to the potential for widespread impact.

Coordinated (C): This is not a standard term in application deployment strategies. It may imply a managed transition but lacks the specificity of parallel or phased approaches.

Phased (D): This involves rolling out the new system incrementally (e.g., by department or module), which reduces risk but doesn't provide the same level of safety as parallel, where both systems run concurrently to ensure continuity.

The parallel approach is ideal for mitigating risks during a critical system transition, as it allows validation of the new system's performance while maintaining business continuity. According to ITIL or SDLC frameworks, parallel adoption is often recommended for mission-critical systems to ensure stability and user acceptance.