Exin EPI Certified Information Technology Manager CITM Exam Questions

Answer : A

A parallel test (A) in business continuity planning involves running systems at both the primary and alternate sites simultaneously to compare data and ensure the alternate site can handle operations effectively. This test verifies data replication and system functionality without interrupting normal operations, aligning with the managers' desire to compare data before a full interruption test.

Simulation test (B): This involves simulating a disaster scenario to test response procedures without activating the alternate site, so it doesn't focus on data comparison.

Structured walk-through test (C): This is a tabletop exercise where team members discuss and review the plan without executing systems or comparing data.

Checklist test (D): This involves reviewing the business continuity plan against a checklist to ensure completeness, not comparing data between sites.

According to ISO 22301 or business continuity management frameworks, a parallel test is used to validate recovery capabilities while maintaining operations at the primary site, making it ideal for the scenario described.

Answer : C

Given the constraints of little to no budget and limited time, internet job boards are the ideal sourcing method. They are cost-effective (often free or low-cost), allow quick posting of job openings, and reach a wide pool of candidates, enabling rapid hiring.

Word of mouth (A) is informal and may not yield qualified candidates quickly. Internal IT staff based on SWOT analysis (B) is not a standard recruitment method and takes time to analyze. Recruitment agencies (D) are expensive and slower due to their processes, making them unsuitable for low-budget, urgent hiring.

Answer : C

Reviewing an IT service catalog, as per ITIL service asset and configuration management, focuses on ensuring services align with business needs and compliance requirements. Key criteria include:

Retiring services (A): Assessing whether services are outdated or no longer needed is critical.

New laws, codes, or regulations (B): Compliance with legal or regulatory changes is essential to avoid penalties.

Service relevance and appropriateness (D): Ensures services meet current business objectives and user needs.

Changes in the IT service provider organization (C), such as internal restructuring or staffing changes, are not typically a direct criterion for service catalog review, as the catalog focuses on services offered, not the provider's internal operations.

Answer : D

Requests for password resets from unknown individuals suggest social engineering attacks, such as phishing or impersonation, where attackers manipulate users to gain unauthorized access. An information security awareness program should focus on educating staff about social engineering tactics to recognize and prevent such incidents.

E-mail usage (A), instant messaging (B), and internet usage (C) may be vectors for attacks, but the core issue is social engineering, which encompasses tactics used across these channels.

Answer : A

The most important reason for a reference check in vendor selection is to independently verify and validate a vendor's claim (A). Reference checks involve contacting the vendor's previous or current clients to confirm claims about performance, reliability, and service quality, ensuring the vendor can meet contractual obligations. This aligns with vendor management best practices to mitigate risks by validating vendor credibility.

Verify products by other customers (B): Too narrow; reference checks focus on overall performance, not just products.

Obtain financial information (C): Financial data is obtained through financial due diligence, not reference checks.

Identify customers not mentioned (D): Not a primary goal; the focus is on validating provided references.

Answer : B

The scenario describes a virtual assistant designed to provide simple instructions for product returns based on pre-defined questions commonly asked by customers. This indicates the use of supervised machine learning (B), where the system is trained on a labeled dataset (e.g., questions paired with correct responses) to predict appropriate answers. Supervised learning is ideal for applications like chatbots or virtual assistants that rely on predefined input-output pairs to handle customer queries efficiently.

Unsupervised (A): Involves finding patterns in unlabeled data (e.g., clustering), not suitable for predefined question-response tasks.

Reinforcement learning (C): Focuses on learning through trial and error with rewards, used in dynamic environments (e.g., robotics), not for static question answering.

Deep learning (D): A subset of supervised or unsupervised learning using neural networks, but the question doesn't specify complex architectures, making supervised learning the broader, correct choice.

Supervised learning aligns with IT strategy for deploying AI-driven customer support tools, as it ensures accurate, predictable responses based on trained data, enhancing user experience in a global retail system.

Answer : C

Security awareness programs require ongoing engagement to remain effective. If security incidents decrease initially but increase after eight months, the most likely cause is that message materials are few and static, and renewal is not taking place (C). Static content becomes outdated or ignored over time, reducing its impact. Regular updates, new campaigns, and varied delivery methods (e.g., videos, quizzes) are essential to maintain employee awareness and adapt to evolving threats, as per ISO/IEC 27001 or NIST security awareness guidelines.

Insufficient budget (A): While budget constraints could limit program scope, there's no evidence in the scenario to suggest this is the primary issue.

Scope too narrow (B): A narrow scope might limit effectiveness initially, but the initial success suggests the scope was adequate; the issue is sustaining engagement.

Lack of resources for instructor-led sessions (D): Instructor-led sessions are one delivery method, but the core issue is likely outdated content rather than delivery format.