CITM Exam Dumps - Exin EPI IT Management Questions and Answers

To deliverknowledgesupportingcross-functional business units, bothinformation management(A) anddata management(B) are required (C).Data managementensures raw data is collected, stored, and organized (e.g., databases, data quality), whileinformation managementtransforms data into meaningful knowledge (e.g., through analytics, reporting, or knowledge bases) accessible to business units. According toCOBITorIT strategy frameworks, integrating data and information management enables cross-functional collaboration by providing actionable insights and knowledge sharing.

Information management alone (A):Focuses on knowledge delivery but relies on well-managed data.

Data management alone (B):Provides raw data but lacks the processes to turn it into usable knowledge.

To reduce the risk of fraud in large financial transactions, the security principle ofintegrity(C) requires the highest attention.Integrity, as perISO/IEC 27001’s CIA triad (Confidentiality, Integrity, Availability), ensures that data is accurate, complete, and unaltered. Fraud often involves manipulating transaction data, so controls like data validation, checksums, or audit trails are critical to maintain integrity and prevent unauthorized changes.

Confidentiality (A):Protects data from unauthorized access, less directly related to fraud prevention.

Availability (B):Ensures system access, not the primary concern for fraud.

Reliability (D):Not a standard CIA triad principle; may relate to system performance but not fraud.

Inrisk management, after controls are implemented to mitigate risks, the remaining risk that the organization is willing to accept is calledresidual risk(C). According to frameworks likeISO/IEC 27001andCOBIT, residual risk represents the level of risk that persists after applying controls, deemed acceptable based on the organization’s risk appetite. For example, if a control reduces the likelihood or impact of a threat (e.g., data breach), the remaining exposure is the residual risk, which the organization monitors but does not further mitigate unless necessary.

Reduced risk (A):Not a standard term; implies a general decrease but lacks specificity.

Lowered risk (B):Similar to reduced risk, not a recognized term in risk management frameworks.

Modified risk (D):Implies risk alteration but is not a standard term for post-control risk levels.

Residual risk is a critical concept in risk management, ensuring organizations understand and accept the remaining exposure after mitigation efforts.

InITIL, theservice operationphase focuses on delivering and managing services, including activities like communicating scheduled outages (A), reporting service performance (B), and handling escalations (C).Defining service strategy(D) is part of theservice strategyphase, not service operation, as it involves planning and aligning services with business goals.

Inrisk management, theAnnual Loss Expectancy (ALE)is calculated as:

ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO), whereSLE = Asset Value × Exposure Factor (EF).

Given:

Asset Value = $200,000

Exposure Factor (EF) = 25% = 0.25

ALE = $100,000

Calculate SLE:

SLE = Asset Value × EF = $200,000 × 0.25 = $50,000

Calculate ARO:

ALE = SLE × ARO

$100,000 = $50,000 × ARO

ARO = $100,000 ÷ $50,000 = 2

Thus, theAnnualized Rate of Occurrence (ARO)is2(C), meaning the incident is expected to occur twice per year.

0.4 (A):Incorrect; implies a lower frequency (0.4 times per year).

1 (B):Incorrect; would yield an ALE of $50,000, not $100,000.