CITM Exam Dumps : EXIN EPI Certified Information Technology Manager

To ensurecontinuityin vendor selection, the key criteria includehead count(vendor’s staffing capacity to deliver services),support(availability of ongoing technical and operational support), andfinancial stability(ensuring the vendor remains viable to provide services long-term). These factors directly impact the vendor’s ability to maintain service delivery without interruptions, which is critical for business continuity.

Scope, maintenance, and price (A):Scope and price are important but don’t directly ensure continuity; maintenance is a subset of support.

Terms and conditions, maintenance, and terms of engagement (B):These are contractual elements, but they don’t fully address operational continuity like staffing or financial stability.

Price, training, and support (C):Training is less critical for continuity compared to staffing capacity or financial health.

According tovendor management frameworks, continuity is ensured by evaluating the vendor’s operational capacity and long-term reliability, making head count, support, and financial stability the minimum criteria.

Requests for password resets from unknown individuals suggestsocial engineeringattacks, such as phishing or impersonation, where attackers manipulate users to gain unauthorized access. An information security awareness program should focus on educating staff about social engineering tactics to recognize and prevent such incidents.

E-mail usage (A), instant messaging (B), and internet usage (C) may be vectors for attacks, but the core issue is social engineering, which encompasses tactics used across these channels.

Afirewallis categorized as atechnical preventive control(A) ininformation security management. According toISO/IEC 27001, preventive controls aim to stop security incidents before they occur, and technical controls involve technology-based solutions. A firewall prevents unauthorized access to the network perimeter by filtering traffic, making it a technical preventive control.

Physical detective control (B):Involves physical measures (e.g., cameras) to detect incidents, not applicable to firewalls.

Administrative deterrent control (C):Involves policies or procedures to discourage violations, not technology-based.

Physical corrective control (D):Addresses physical issues post-incident, not relevant to firewalls.