CITM Practice Questions

A hot site is a fully equipped alternate facility, including office space with desks, computers, network connectivity, and all necessary systems, ready for immediate use. In the context of a business continuity plan (BCP), the request to "facilitate a desk" implies providing a fully functional workspace where employees can resume critical operations with minimal delay. A hot site is the only option that meets this requirement for immediate operational readiness, making it the most suitable recommendation to management for ensuring business continuity for its workers.

B. Cold site: This is merely an empty space with basic utilities like power and cooling. It lacks the desks, computers, and connectivity needed for workers to operate.

C. Warm site: This site is partially equipped but requires additional hardware and configuration before it can be fully operational, causing a delay in recovery.

D. Mobile site: This refers to a transportable facility, not its state of readiness. A mobile site can be configured as hot, warm, or cold, so this option is not specific enough.

1. National Institute of Standards and Technology (NIST). (2010). Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems. Section 3.4.2, "Alternate Site," defines a hot site as "A fully configured alternate site that is ready to operate within a few hours of a disaster declaration." It contrasts this with cold sites ("no equipment") and warm sites ("partially equipped").

2. Laudon, K. C., & Laudon, J. P. (2018). Management Information Systems: Managing the Digital Firm (15th ed.). Pearson. In Chapter 8, "Securing Information Systems," the text discusses disaster recovery planning and describes a hot site as a facility that "provides a duplicate of the entire system, including furniture and office equipment, and is ready for immediate use." (p. 327).

The situation describes a high-impact incident (a processing error in a critical financial system) occurring during a time-sensitive business period (financial year closing). The demand from senior management to implement a fix immediately to prevent further business disruption necessitates an emergency change. According to IT Service Management principles, emergency changes are those that must be implemented as soon as possible to resolve a high-impact incident. The assessment and authorization process for these changes is expedited to ensure a swift resolution, with full documentation and review often occurring after the change has been implemented.

A. Normal: Normal changes are subject to a full authorization and scheduling process, which is too slow for this urgent scenario.

B. Standard: Standard changes are pre-authorized, low-risk, and routine. This scenario involves an unexpected error, not a routine activity.

C. Exceptional: While the situation is exceptional, "Emergency Change" is the specific, formal term used in IT service management frameworks for this type of urgent change.

1. AXELOS. (2019). ITIL® Foundation, ITIL 4 Edition. TSO (The Stationery Office). In Section 5.2.4, "Change enablement," an emergency change is defined as a "change that must be implemented as soon as possible; for example, to resolve an incident or implement a security patch." This directly aligns with the scenario of fixing a critical error to prevent further business process delays. The description of normal and standard changes in the same section confirms they are inappropriate for this situation.

In the context of corporate hiring protocols, particularly for IT staff who will have access to sensitive information and systems, "additional screening" refers to background verification checks. These are security measures that go beyond verifying the qualifications listed on a resume. A criminal record check is a fundamental component of this process. It is conducted to assess a candidate's trustworthiness and mitigate potential insider threats, thereby protecting the organization's assets, data, and reputation. This type of screening is considered a critical control in personnel security management.

A. Salary demands: This is a standard part of the initial negotiation and recruitment process, not a security-focused background screening.

B. Number of years working experience: This is a standard qualification check verified through resumes and reference calls during the initial evaluation stages.

D. Educational level: This is a basic qualification check, typically verified early in the hiring process, and is not considered "additional" screening.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Annex A, Control A.6.1.1 ("Screening") states, "Background verification checks on all candidates to be employed shall be carried out prior to joining the organization and on an ongoing basis, taking into account applicable laws, regulations and ethics. They should be proportional to the business requirements, the classification of the information to be accessed and the perceived risks." This control implicitly includes checks like criminal records for roles with significant risk.

2. Whitman, M. E., & Mattord, H. J. (2019). Management of Information Security (6th ed.). Cengage Learning. In Chapter 5, "Personnel and Security," the section on "Employment Criteria and Screening" details the importance of background checks. It explicitly lists criminal background checks, credit checks, and education verification as key components of screening potential employees for information security-sensitive positions (pp. 188-189).

3. Stanford University. (2023). Administrative Guide Memo 2.1.5: Recruitment and Selection. Section 4, "Background Checks," outlines that a background check, which may include a criminal history check, is a required condition of employment for certain positions, particularly those with access to sensitive data or financial assets. This demonstrates the real-world application of additional screening in a reputable institutional setting.

The SMART framework, an acronym for Specific, Measurable, Achievable, Relevant, and Time-bound, is a foundational technique for setting clear and trackable goals. Management By Objectives (MBO) is a performance management model where managers and employees collaboratively set objectives for a specific period. The success of the MBO process is critically dependent on these objectives adhering to SMART criteria to ensure they are unambiguous and their achievement can be objectively verified. Therefore, an instruction to use SMART conditions for appraisals directly points to the implementation of the MBO method.

B. Graphic rating scales: This method evaluates employees based on a predefined set of traits or behaviors using a scale, not on the achievement of specific, time-bound objectives.

C. Ranking: This is a comparative method that ranks employees against their peers and does not involve setting or evaluating individual SMART goals.

D. Performance ranking method: This is synonymous with the ranking method; it focuses on relative employee comparison rather than achievement against absolute, pre-set objectives.

1. Doran, G. T. (1981). There's a S.M.A.R.T. way to write management's goals and objectives. Management Review, 70(11), 35–36. This seminal article introduces the SMART acronym as a framework for writing effective management objectives.

2. Rodgers, R., & Hunter, J. E. (1991). Impact of management by objectives on organizational productivity. Journal of Applied Psychology, 76(2), 322–336. This meta-analysis highlights that the core of MBO's effectiveness lies in setting specific and challenging goals, principles which are encapsulated by the SMART framework. (See abstract and introduction, p. 322). DOI: https://doi.org/10.1037/0021-9010.76.2.322

3. University of California, Berkeley. (n.d.). SMART Goals. People & Culture. Retrieved from https://hr.berkeley.edu/hr-network/central-guide-managing-hr/managing-hr/managing-successfully/performance-management/smart-goals. This official university resource explicitly details the SMART criteria as a primary tool for effective performance management and goal setting, which is the central mechanism of MBO.

The IT service lifecycle, a core concept in service management frameworks like ITIL, is divided into distinct phases. The Service Operation phase focuses on the day-to-day activities required to deliver and support services at agreed-upon levels. This includes communicating outages (A), reporting on performance (B), and managing escalations (C). In contrast, 'Define service strategy' (D) is the primary purpose of the Service Strategy phase, which is the initial phase of the lifecycle. This phase is concerned with setting the overall goals, policies, and direction for IT services to ensure they align with and support the organization's business objectives. Therefore, defining the strategy is not an activity performed within Service Operation.

A. Communicate scheduled outages: This is a key operational communication activity within Service Operation, managed through processes like Incident and Change Management to inform users and manage service availability.

B. Report service performance: Monitoring and reporting on service levels against Service Level Agreements (SLAs) is a fundamental control and monitoring activity performed during the Service Operation phase.

C. Escalation: This is an integral part of operational processes like Incident Management, ensuring that issues are resolved by the appropriate personnel in a timely manner, which is central to Service Operation.

1. AXELOS, ITIL® Service Operation (2011 ed.). TSO (The Stationery Office).

Section 1.1, "Purpose of service operation": This section details that the purpose of Service Operation is to "coordinate and carry out the activities and processes required to deliver and manage services at agreed levels to business users and customers." This encompasses activities like managing incidents (which includes escalation), events (like outages), and monitoring/reporting.

2. AXELOS, ITIL® Service Strategy (2011 ed.). TSO (The Stationery Office).

Section 1.1, "Purpose of service strategy": This section explicitly states the purpose is to "provide guidance on how to design, develop and implement service management not only as an organizational capability but also as a strategic asset." This confirms that defining strategy is the core of the Service Strategy phase, not the Service Operation phase.

3. University of Washington, IT Service Management Office, "ITIL Processes."

Service Operation Page: This educational resource describes Service Operation as the phase that "delivers the day-to-day services" and lists core processes like Incident Management (which includes escalation) and Event Management (which includes communicating service status).

Service Strategy Page: This resource defines Service Strategy as the phase that "helps an IT organization improve and develop the management of its IT services over the long term," clearly separating it from daily operational tasks.

Risk treatment involves selecting and implementing options for addressing risk. When an organization outsources part of its operations, it contractually shifts the responsibility and associated operational risks to an external vendor. This strategy is known as risk transfer. The organization pays the vendor to assume the risk and manage the specific function, thereby lowering its own exposure due to internal constraints. While the organization may retain ultimate accountability, the direct operational and financial consequences of the risk are transferred to the third party.

A. Sharing: While related, risk sharing typically implies a partnership or joint venture where risk is distributed among parties, not a complete hand-off of operational responsibility to a single external entity.

B. Retention: This is the opposite of the action taken. Risk retention (or acceptance) means consciously deciding to accept the risk and its potential consequences without taking further action to reduce it.

D. Modification: Risk modification (or mitigation) involves implementing internal controls, changing processes, or taking other actions to reduce the likelihood or impact of the risk, rather than moving it to an external party.

1. COBIT 2019 Framework: Governance and Management Objectives. In the section for the management objective APO12 Managed Risk, a key practice is to define a risk response. The framework lists "Share/transfer the risk by transferring risk to other parties (e.g., through insurance or outsourcing)" as a primary risk response option. (ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018, p. 103).

2. ISO 31000:2018, Risk management — Guidelines. Section 6.5.2 discusses the selection of risk treatment options. It lists "sharing the risk" and provides a note: "Risk sharing involves agreeing with another party or parties to bear or distribute the risk... Mechanisms for risk sharing can include... the use of contracts." Outsourcing is a contractual mechanism that transfers risk, fitting within this definition. The term "Transferred" is a more specific description of this action than the broader category "Sharing."

3. Carnegie Mellon University, Heinz College Courseware. In materials for the course 95-752: Management of Information Systems, risk management strategies are defined. "Risk Transference" is described as: "Shifting the responsibility for a risk to a third party. Examples: Outsourcing, Insurance." This directly aligns outsourcing with the concept of risk transfer.

The main strategic objective of a job rotation program is to support the long-term continuity and resilience of the organization. By systematically moving employees through different roles, the organization cross-trains its workforce, which mitigates the risks associated with single points of failure (i.e., critical knowledge or skills residing with only one person). This practice is a fundamental component of succession planning and knowledge management, ensuring that essential business operations can persist through staff turnover, absences, or other disruptions. While other options are valid benefits, they are secondary to this primary goal of ensuring organizational stability and continuity.

B. This is a method used within job rotation to achieve the main objective, not the main objective itself.

C. Increased job satisfaction is a positive outcome and can help reduce turnover, but it is a secondary benefit, not the primary strategic driver.

D. This describes the employee's experience within the program, which facilitates learning, but it is not the core organizational purpose.

---

1. Campion, M. A., Cheraskin, L., & Stevens, M. J. (1994). Career-related antecedents and outcomes of job rotation. Academy of Management Journal, 37(6), 1518–1542. The study notes that job rotation is used for employee development with the aim of succession planning, stating, "organizations may use job rotation to develop employees to fill future vacancies" (p. 1520). This directly supports the objective of long-term organizational continuity.

(DOI: https://doi.org/10.2307/256808)

2. Ortega, J. (2001). Job Rotation as a Learning Mechanism. Management Science, 47(10), 1361-1370. This paper models job rotation as a mechanism for both employer and employee learning. The employer learns about employee skills, which is critical for "optimal job assignment" and filling future roles, thereby ensuring operational effectiveness and continuity over the long term. (Section 1: Introduction, p. 1361).

3. MIT Sloan School of Management. (2013). Revitalizing the Organization: An Action-Learning Approach to Change. Course 15.341, Organizational Processes. Course materials discuss how developing a broad skill base in employees through practices like job rotation builds organizational capability and resilience, which are essential for long-term adaptation and survival. This aligns with the strategic goal of continuity. (Available via MIT OpenCourseWare).

The calculation follows the standard quantitative risk analysis formulas. First, determine the Single Loss Expectancy (SLE) by multiplying the Asset Value (AV) by the Exposure Factor (EF).

SLE = AV EF

SLE = $200,000.00 0.25 = $50,000.00

Next, use the formula for Annual Loss Expectancy (ALE), which is ALE = SLE ARO (Annualized Rate of Occurrence). To find the ARO, rearrange the formula:

ARO = ALE / SLE

ARO = $100,000.00 / $50,000.00 = 2

Therefore, the Annualized Rate of Occurrence is 2, meaning the event is expected to happen twice per year.

A. 0.4: This is a result of an incorrect calculation. The correct mathematical application of the risk formulas does not yield this value.

B. 1: An ARO of 1 would imply the ALE is equal to the SLE ($50,000), which contradicts the given ALE of $100,000.

1. National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST Special Publication 800-30, Rev. 1). U.S. Department of Commerce. Page F-3, Appendix F, Section F.3. This document defines the relationship between the key terms: "Annualized Loss Expectancy (ALE) is the product of the single loss expectancy (SLE) and the annualized rate of occurrence (ARO)."

2. Peltier, T. R. (2010). Information Security Risk Analysis (3rd ed.). Auerbach Publications. Chapter 7, "Risk Analysis Methodologies," details the quantitative risk analysis process, explicitly stating the formulas ALE = SLE × ARO and SLE = Asset Value × EF. (This is a widely cited academic and professional text in the field).

3. University of Washington. (n.d.). Risk Management Guide. Office of the CISO. Retrieved from https://ciso.uw.edu/education/risk-management-guide/. The guide defines the formulas under the "Quantitative Risk Assessment" section, stating, "ALE = SLE x ARO."

The main objective of regular vendor management meetings is to conduct a formal review of the vendor's performance. This process is centered on verifying that the services and products delivered align with the agreed-upon terms, conditions, and service levels stipulated in the contract. The ultimate goal is to ensure that the vendor's contribution continues to effectively support the organization's business processes and objectives. While discussions on improvements or costs may occur, they are typically secondary to this primary function of performance verification and contractual compliance.

A. Exploring improvement programs is a valuable activity, but it follows the primary verification of contractual performance, making it a secondary objective.

B. Identifying possible price increases is a specific financial topic, not the overarching, regular purpose of performance and relationship management meetings.

D. Discussing improvement programs, similar to exploring them, is a component of the relationship but not the main objective, which is to ensure current obligations are met.

1. ITIL® 4: Supplier Management Practice Guide. AXELOS, 2020. Section 2.4, "Practice success factors," emphasizes that supplier management must "ensure that suppliers and their performance are managed appropriately to support the seamless provision of quality products and services." This includes regular performance reviews against contractual targets.

2. ITIL® Foundation: ITIL 4 Edition. AXELOS, 2019. Section 5.2.17, "Supplier management," describes the purpose of the practice as ensuring that suppliers contribute to the "seamless provision of quality products and services." This is achieved by managing performance, which is the focus of review meetings.

3. Pearlson, K. E., Saunders, C. S., & Galletta, D. F. (2019). Managing and Using Information Systems: A Strategic Approach (7th ed.). Wiley. Chapter 9, "Sourcing," discusses the importance of ongoing vendor relationship management, which includes monitoring performance against service level agreements (SLAs) to ensure the contract's value is realized and business needs are met.

The Software Development Life Cycle (SDLC) is a structured process that consists of distinct phases. The "development" phase (also known as construction or programming) is primarily concerned with the creation of the software itself. Core activities within this phase include writing code based on design specifications, performing unit and integration testing to ensure individual components work correctly, and documenting the code and technical architecture.

In contrast, "Implementation" (also known as deployment) is a separate, subsequent phase in the SDLC. This phase focuses on installing the completed and tested software into the production environment, making it available for end-users. It involves activities like system installation, configuration, data migration, and user training, which occur after the core development work is finished.

A. Code writing is the central and defining activity of the software development phase, where design specifications are translated into executable software.

B. Testing, specifically unit testing and integration testing, is an integral part of the development phase to verify the correctness of the code being written.

C. Documenting, such as creating in-code comments and technical specifications, is a crucial and continuous activity performed during the development phase.

1. University of Washington, IT Connect. "Software Development Lifecycle (SDLC)". This educational resource outlines a 7-step SDLC process where "Step 4: Build / Development" is clearly distinct from "Step 6: Deployment," which it equates with implementation. This source establishes that development and implementation are separate, sequential phases.

2. ISO/IEC/IEEE 12207:2017, Systems and software engineering — Software life cycle processes. This international standard defines formal life cycle processes. It specifies a "Software implementation process" (Clause 6.4.3) that includes software construction (coding) and testing. It defines a separate "Deployment process" (Clause 6.3.4) for "installing a system... into the operational environment." This standard provides a formal distinction between the activities.

3. Turban, E., Volonino, L., & Wood, G. R. (2015). Information Technology for Management: Digital Strategies for Insight, Action, and Sustainable Performance (10th ed.). Wiley. In Chapter 13, "Implementing and Managing IT," the authors describe the SDLC phases used in IT management. They clearly separate the "Programming" (construction) stage from the "Implementation" stage, defining the latter as the process of converting to the new system, which includes deployment and user-facing activities.