ITIL ITIL 4 Specialist Plan Implement and Control Exam Prep
ITIL 4 Specialist Plan, Implement, and Control (Page 4 )

• Why B (Keep the workflows simple and practical) is not sufficient: Simplicity helps, but it doesn’t provide a mechanism to judge how well the change enablement practice is performing or where to improve. Decision-making and continual improvement require data and visibility, not just streamlined processes.

• Why C (Pay attention to measurement and reporting) is correct: Measurement and reporting give you evidence of effectiveness and areas for improvement. They support informed decisions, track progress, and drive continual improvement across the practice (Plan–Do–Check–Act cycle).

• Brief note on the other options: A would add complexity by differentiating workflows, which can hinder data collection and decision-making. D (integrations) is valuable for tooling but doesn’t by itself ensure decision-making or continual improvement without measurement data.

• The correct output is Changed resources (A).

• In ITIL 4’s Change Enablement, the change lifecycle produces several outputs. Among them, Changed resources specifically documents the configuration items (CIs) and other resources that were modified as a result of the change, detailing what was done and the results.
• Other outputs have different purposes:

• Honeypots: Decoy systems or services made to attract attackers. Legitimate users should not interact with them, so activity there is a strong indicator of malicious behavior.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal system. This can reveal infected hosts attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens.
• CI/CD: Automates software development, testing, and deployment.
• Threat modeling: Identifies and analyzes potential threats before or during system design.
• Data obfuscation: Makes data harder to understand or interpret.

• Identified risks
• Risk owners or responsible parties
• Likelihood and impact
• Risk response plans
• Current status
• Risk thresholds or trigger conditions

• Risk tolerance: The amount and type of risk an organization is willing to accept; it is not primarily a tracking document.
• Risk transfer: Moving the financial or operational impact of a risk to another party, such as through insurance or outsourcing.
• Risk analysis: The process of evaluating a risk’s likelihood and impact.

• The application failing to start or becoming unhealthy
• An incorrect probe path, port, or protocol
• The application needing more startup time
• Dependency or configuration failures
• A liveness probe being too aggressive

bash 
kubectl describe pod <pod-name> 
kubectl logs <pod-name> --previous

• Scale to more replicas: may hide the issue but does not diagnose it.
• Decrease initialDelaySeconds: makes probes run earlier and could worsen startup failures.
• Drain and reboot the node: node metrics are normal, so rebooting is not justified as the first step.

• Field name and label
• Data type
• Reference table
• Default value
• Whether the field is mandatory or read-only
• Field attributes and configuration

• A: Labels and translations are handled through documentation and translation-related records.
• C: Table relationships may be represented through reference fields, but this is not the primary description of the Dictionary.
• D: Spell-checking language data is unrelated to the System Dictionary.

• Vulnerability scanner: Finds technical weaknesses in systems, applications, or devices. It does not usually analyze the entire supply chain.
• Penetration test: Simulates attacks against a defined target to identify exploitable weaknesses. Its scope is narrower.
• SCAP (Security Content Automation Protocol): Provides standardized formats and methods for automating security configuration and vulnerability checks, rather than mapping the full supply chain.

• Economy: Obtaining inputs at the lowest appropriate cost.
• Efficiency: Making the best use of resources, such as staff, money, and equipment.
• Effectiveness: Achieving the intended objectives or outcomes.

• Endpoint Manager: manages hosts and sensor-related settings.
• Falcon Investigator: supports investigation and analysis, but does not necessarily grant RTR access.
• Remediation Manager: handles remediation-related actions rather than interactive host access.

• SQL injection
• Cross-site scripting (XSS)
• Malicious or malformed web requests
• Some application-layer abuse

• Layer 4 firewall: Filters based mainly on IP addresses, ports, and connections; it lacks detailed web-request inspection.
• NGFW: Provides broader network security, but a WAF is more specialized for protecting web applications.
• UTM: Combines multiple security functions, but it is not necessarily optimized for web-application protection.

• Azure Resource Manager (ARM) templates
• Or, in newer Azure terminology, Bicep files

• SAML: Enables federated authentication and single sign-on between the IdP and SaaS providers.
• OAuth tokens: Allow delegated application access; OAuth is not primarily the first step for employee SSO.
• Password vaulting: Stores or autofills multiple passwords but does not eliminate the separate credentials or provide true federation.

• Code suggestions: Inline completions as you write code, such as lines, functions, or blocks.
• Chat: An interactive interface for asking questions, explaining code, generating code, and helping with debugging.

• Knowledge Base: Not listed as a standard Copilot Individual IDE feature in this context.
• Pull Request Diff Analysis: More closely associated with GitHub-based code review or pull-request features, not the core Individual IDE extension capabilities.

CIMA P3 topics

• IT governance and systems strategy
• Systems development and implementation
• Change and project governance
• Strategic and business risk

• A — Plan for new systems: The committee should help identify and prioritise systems requirements and ensure planned systems support organisational needs.
• D — Consider competitive issues: New information systems may affect Y’s competitive position, service quality and efficiency. These strategic implications should be considered.
• E — Ensure the system meets company goals: This is a key governance responsibility. The committee should ensure the project remains aligned with Y’s objectives and delivers business value.

• B — Develop new systems: Detailed system development should be performed by IT specialists and project teams, not the steering committee.
• C — Manage the project: The project manager should handle day-to-day project management. The steering committee should provide oversight, challenge and key decisions, rather than manage daily activities.

• CSIRT: A Computer Security Incident Response Team that handles and coordinates incident response.
• CVSS: A scoring system used to rate the severity of vulnerabilities.
• SOAR: Security Orchestration, Automation, and Response technology used to automate security workflows.

• You can configure different pre-shared keys for different device groups.
• All cameras could use one key.
• All scanners could use another key.
• Each key can be associated with an appropriate role or access policy.

• Each Azure VM must have at least one network interface (NIC).
• A single NIC can have:

• Therefore, each of the five VMs needs only one NIC:

• s3:GetObject for the relevant objects
• s3:ListBucket if listing is required
• Appropriate bucket and object resource permissions

• B: Making the bucket public is insecure and unnecessary.
• C: Prompt engineering cannot override AWS IAM or encryption permissions.
• D: Data sensitivity does not determine whether the role can access it.

• Inherent risk: Risk that exists before controls are implemented.
• Avoided risk: Risk eliminated by choosing not to perform the risky activity.
• Operational risk: Risk arising from failures in processes, people, systems, or daily operations.

• Create a CodeCommit repository in the secondary Region.
• Use CodeBuild to run a Git mirror operation from the primary repository to the secondary repository.
• Use EventBridge to detect relevant repository events, such as a pull request being merged.
• Invoke a Lambda function, which starts the CodeBuild project.

• B: Amazon S3 is object storage, not a Git repository that developers can use as a CodeCommit remote.
• C: CodeArtifact is intended for packages and artifacts, not source-code repository mirroring.
• D: An AWS Cloud9 environment is not an appropriate automated replication mechanism and would require manual or persistent infrastructure management.

• Domain controllers, because the requirement specifically excludes them. However, note that both member servers and domain controllers run Windows Server, so OS targeting alone cannot distinguish them unless the targeting option allows selecting the relevant server role/version. In the usual exam interpretation, target the applicable server OS category.
• Client computers, because they run a client Windows operating system.

• Domain: Targets membership in a domain, not the computer’s operating-system type.
• Security Group: Would require creating and maintaining a group containing all member servers, increasing administrative effort.
• Environment Variable: Not designed to reliably identify member servers.

• Employees can use approved devices from remote locations or worldwide offices.
• Users do not need to carry or insert extra hardware.
• It helps prevent account takeovers from unknown devices.

• Geotagging: Restricts access based on location, which could interfere with remote work and travel.
• Smart cards: Require additional physical equipment and card readers.
• Time-based logins: Limit access according to time but do not strongly bind access to an authorized user device.

• The CSV contains the external users’ email addresses.
• The bulk invitation feature supports inviting many guest users in one operation.
• Each invited user becomes a guest account in contoso.com.

• Response and resolution time frames
• Availability or uptime requirements
• Performance targets
• Support obligations
• Penalties for failing to meet requirements

• SOW (Statement of Work): Defines the project’s scope, tasks, and deliverables.
• MOA (Memorandum of Agreement): Describes cooperation and responsibilities between parties.
• MOU (Memorandum of Understanding): Records a general mutual understanding, usually without detailed enforceable service targets.

• Microservices: An application-design approach that divides an application into smaller services. It does not inherently reduce the number of operating systems.
• Virtualization: Creates virtual machines, but each VM generally requires its own complete operating system. This improves isolation but does not minimize OS instances as effectively.
• Infrastructure as code: Uses code to automate infrastructure deployment and configuration. It improves consistency but does not determine how many operating systems are used.

• Storage usage of files stored in Microsoft Teams: SharePoint site usage report

• Number of active users per team: Microsoft Teams usage report

1. SharePoint site usage report
2. Microsoft Teams usage report

• BCP (Business Continuity Plan): Ensures the organization can continue its broader business operations during and after a disruption. It is broader than the IT-focused recovery required here.
• Communication plan: Defines how information is shared with employees, the public, and other stakeholders; it does not restore systems.
• IRP (Incident Response Plan): Handles and contains security incidents, such as malware or unauthorized access. A tornado is a disaster, not primarily a cybersecurity incident.

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Technology or access methods used outside approved IT processes.

• B. Deploy to a SageMaker endpoint: This is needed for SageMaker-hosted models, not for a model intended to be used directly in Amazon Bedrock.
• C. Register with SageMaker Model Registry: SageMaker Model Registry is unrelated to invoking custom models in Bedrock.
• D. Grant access in Bedrock: Access permissions may be necessary, but they do not replace the required provisioned capacity.

• Database data: Aggregates are used to retrieve structured data, commonly from entities and database sources.
• Screen scope: A Screen Aggregate belongs to the screen where it is defined and is not directly reusable as a screen-level aggregate elsewhere.
• Asynchronous and parallel execution: Multiple Screen Aggregates can run asynchronously and in parallel, helping the screen load data efficiently.

• Default network device credentials: More associated with external attackers or poor device configuration.
• Spear phishing emails: Commonly used to compromise users, but less characteristic of an insider who already has access.
• Typosquatting and impersonation: Primarily social-engineering techniques aimed at deceiving users.
• Unidentified removable devices: Provide a direct way to transfer data outside the organization and may bypass network monitoring.

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect some attack traffic, but it is not the primary control for switch-port MAC learning.
• NGFW: Protects at network boundaries but does not directly limit MAC addresses learned on access ports.

• Financial performance
• Customer perspective
• Internal business processes
• Learning and growth

• Increasing the number of indicators can make the scorecard cluttered and less useful. Measures should be limited to those that are strategically important.
• The scorecard is mainly a tool for implementing and monitoring strategy, not for formulating strategy.
• It should contain both leading indicators and lagging indicators. Leading indicators predict future performance, while lagging indicators measure results already achieved.

• Compare each server’s drive specifications and performance data.
• Identify the drive that is faulty, slow, or mismatched.
• Replace it with a drive that matches the required interface, capacity, and performance characteristics.
• Avoid selecting a slower drive, because storage performance can bottleneck the entire server.
• In a redundant array, use a compatible replacement so rebuilding does not create unnecessary performance degradation.

• Security controls
• Processes and procedures
• Compliance evidence
• Performance against contractual requirements

• Service-level agreement (SLA): Defines expected service performance, such as uptime and response times.
• Memorandum of agreement (MOA): Documents a general agreement between parties, but does not necessarily provide audit rights.
• Supply chain analysis: Identifies risks across suppliers and dependencies, but is not a contractual mechanism for reviewing vendor controls.

• Virtual machine disks
• Databases
• Storage accounts
• File systems

• Site-to-site VPN: protects data moving between networks
• HTTPS: protects data moving between a client and website
• Encrypted email: generally protects the message while being transmitted

• At rest = stored data
• In transit = moving data
• In use = data currently being processed by a system

• Encryption to preserve confidentiality
• Integrity protection to detect alteration
• Authentication of the server through certificates

• SHA-256: A hashing algorithm; it does not encrypt data for transmission.
• SSL 3.0: Obsolete and insecure. It should not be used.
• AES-256: A strong encryption algorithm, but by itself it does not provide the complete secure communication protocol needed for data in transit.

• Owner, Contributor, and Network Contributor provide sufficient management permissions.
• Reader can view Traffic Analytics data but cannot enable or configure it.

• Configure row-level security (RLS) using the sales region and the HR manager’s identity.
• Publish the reports and datasets through a Power BI app.
• Grant the HR managers permission to use the app, but do not add them as workspace members.
• App users can view and interact with reports while RLS limits them to their region.
• They cannot modify the report layout because they do not have workspace editing permissions.

• Adding them to the workspace gives them workspace permissions that may allow report or dataset changes, depending on the assigned role.
• Creating copies is unnecessary and creates maintenance and security problems.
• Hosting datasets and reports in different workspaces does not, by itself, provide the required controlled access.

• Base table — the table containing common inherited fields
• Parent table — the table directly extended by the child
• Other tables in the hierarchy

• Third-party enterprise application with embedded AI: The provider manages most security controls. The customer mainly manages users, data, and configuration.
• Application using an existing third-party FM: The customer controls the application and its inputs/outputs, but the provider controls the underlying model and infrastructure.
• Fine-tuning a third-party FM: The customer has additional responsibility for training data, data protection, and model behavior, but still depends on the provider’s base model and platform.
• Building and training a model from scratch: The customer controls the model, training data, application, deployment, and many security safeguards. This creates the greatest security ownership.

• Disable default accounts: Default or unused accounts may have known usernames or predictable settings, making them targets. They should be disabled, removed, or securely configured.
• Remove unnecessary services: Every running service creates potential vulnerabilities. Removing services the server does not need reduces exploitable entry points.

• Add the server to the asset inventory: Important for asset management, but not a hardening step.
• Document default passwords: Default passwords should be changed or eliminated—not documented for continued use.
• Send server logs to the SIEM: Valuable for monitoring and detection, but generally performed as part of logging/monitoring configuration.
• Join the server to the corporate domain: May be necessary operationally, but does not itself harden the server.

• A: Describes a broad purpose and direction, but is not the specific CIMA definition.
• C: “Scoping out” activities is too vague and incomplete.
• D: Combines long-term goals, strategies and policies, but describes a wider strategic-planning statement rather than the definition of strategy itself.

• The servers are powered on.
• The network is functioning.
• Devices can still reach the server network.

• ARP poisoning: Redirects or intercepts local network traffic; it usually affects communication paths rather than overwhelming a service.
• Jamming: Disrupts wireless or radio signals. It would not fit a system that remains accessible from devices on the server network.
• Kerberoasting: Attempts to crack service-account credentials from Kerberos tickets; it does not normally cause an immediate outage.

• A script of cloud CLI commands: IaC because the commands can be saved, reviewed, versioned, and rerun consistently.
• Manually run curl commands: Not necessarily IaC; they are manual actions unless organized into an automated script.
• A sequence of REST requests passed to an API: Could represent automation, but the wording does not explicitly say they are stored and executed as reusable code.
• Commands entered into a cloud console: Manual operation, not IaC.

• IaaS: você gerencia a VM e o sistema operacional.
• PaaS: o Azure gerencia a infraestrutura; você se concentra no aplicativo.

• 255.255.255.128 = /25: 128 total, 126 usable
• 255.255.255.192 = /26: 64 total, 62 usable
• 255.255.255.224 = /27: 32 total, 30 usable
• 255.255.255.240 = /28: 16 total, 14 usable

• One for the network address
• One for the broadcast address

• 8 total addresses
• 6 usable addresses
• Mask: 255.255.255.248

• CHAP: Uses a challenge-response exchange, so the password is not directly transmitted.
• IPsec: Provides authentication, integrity, and encryption for IP communications.
• EAP: An authentication framework that supports stronger methods, such as certificates or token-based authentication.

Statement 1 — Correct

Statement 2 — Correct