CITM Exam Dumps : EXIN EPI Certified Information Technology Manager

In corporate hiring protocols,additional screeningtypically refers to background checks beyond basic qualifications, such as verifying a candidate’scriminal record. This is critical for IT roles, where employees may have access to sensitive systems and data, ensuring trustworthiness and compliance with security policies.

Salary demands (A) are negotiated during the hiring process, not screened. Number of years of experience (B) and educational level (D) are verified through resumes and standard checks, not typically classified as “additional screening,” which focuses on security-related checks like criminal records.

Afirewallis categorized as atechnical preventive control(A) ininformation security management. According toISO/IEC 27001, preventive controls aim to stop security incidents before they occur, and technical controls involve technology-based solutions. A firewall prevents unauthorized access to the network perimeter by filtering traffic, making it a technical preventive control.

Physical detective control (B):Involves physical measures (e.g., cameras) to detect incidents, not applicable to firewalls.

Administrative deterrent control (C):Involves policies or procedures to discourage violations, not technology-based.

Physical corrective control (D):Addresses physical issues post-incident, not relevant to firewalls.

The correct sequence for arisk assessment, as perISO 31000andISO/IEC 27001, is:Establish context — identify — analyse — evaluate — treatment(C).

Establish context:Define the scope, objectives, and criteria for the risk assessment (e.g., organizational goals, assets, and risk appetite).

Identify:Identify potential risks (e.g., threats and vulnerabilities) that could impact objectives.

Analyse:Assess the likelihood and impact of identified risks to determine their severity.

Evaluate:Compare risks against risk criteria to prioritize them for treatment.

Treatment:Implement controls or strategies to mitigate, avoid, transfer, or accept risks.

Option A:Incorrect, as “monitor and review” is a post-treatment step, not the starting point.

Option B:Incorrect, as “communication” is not a distinct step in risk assessment; it’s embedded throughout.

Option D:Incorrect, as it skips “establish context,” which is essential for defining the assessment’s scope.

This sequence ensures a structured, systematic approach to risk assessment, aligning with organizational objectives.