Question 1: What is the purpose of a Risk Management File under ISO 14971?

• To document customer complaints related to the device
• To list all regulatory submissions made for the device
• To provide a comprehensive repository of all risk management activities and records for a device (Correct answer)
• To store employee training records for device development staff

Correct answer: To provide a comprehensive repository of all risk management activities and records for a device

The Risk Management File is a comprehensive repository containing all risk management plans, analyses, evaluations, and reports for a medical device.

Question 2: In the context of healthcare data warehousing, what is a 'slowly changing dimension' (SCD) Type 2?

• Overwriting the existing record with new values
• Ignoring historical changes and keeping only current values
• Storing both old and new values in the same row
• Maintaining full history by adding a new row for each change (Correct answer)

Correct answer: Maintaining full history by adding a new row for each change

SCD Type 2 preserves historical data by inserting a new row each time an attribute changes, with effective dates to track when each version was valid.

Question 3: Which of the following best describes the 'minimum necessary' standard under HIPAA's Privacy Rule?

• Covered entities must collect only the minimum amount of PHI during patient registration
• Business associates must obtain minimum security certifications before accessing PHI
• Covered entities must make reasonable efforts to limit PHI use and disclosure to the minimum needed for the intended purpose (Correct answer)
• Covered entities must encrypt the minimum required fields when transmitting PHI

Correct answer: Covered entities must make reasonable efforts to limit PHI use and disclosure to the minimum needed for the intended purpose

The minimum necessary standard requires covered entities to take reasonable steps to limit the use, disclosure of, and requests for PHI to the minimum amount necessary to accomplish the intended purpose.

Question 4: How do healthcare compliance audits ensure security in medical software?

• By reducing the software's ability to store data
• By ensuring that software does not collect any patient data
• By evaluating the software's compliance with security standards and identifying risks (Correct answer)
• By focusing solely on improving system performance

Correct answer: By evaluating the software's compliance with security standards and identifying risks

Healthcare compliance audits are critical for ensuring security in medical software by systematically evaluating its adherence to established security standards and regulations. These audits identify potential vulnerabilities, weaknesses, and non-compliance issues within the software and its operational environment. By pinpointing risks, audits enable organizations to implement corrective actions, thereby strengthening security posture and protecting patient data.

Question 5: Which regulatory requirement is UNIVERSAL across all Certified Professional for Medical Software practice settings?

• Limiting services to local jurisdictions only
• Using specific proprietary software systems
• Working exclusively during business hours
• Maintaining current certification and meeting continuing education requirements (Correct answer)

Correct answer: Maintaining current certification and meeting continuing education requirements

Maintaining current certification and meeting continuing education requirements is a universal regulatory requirement. Regardless of practice setting, professionals must keep their credentials current and demonstrate ongoing competency through continuing education.

Question 6: Under GDPR, when a medical software company based outside the EU processes health data of EU residents as part of its SaaS offering, it must:

• Apply GDPR only if it has a physical office in an EU member state
• Obtain a waiver from the European Data Protection Board before processing
• Only comply if annual data processing volume exceeds 10,000 EU data subjects
• Comply with GDPR regardless of its location due to the regulation's extraterritorial scope (Correct answer)

Correct answer: Comply with GDPR regardless of its location due to the regulation's extraterritorial scope

GDPR Article 3 establishes extraterritorial scope: it applies to any organization processing EU residents' personal data when offering goods or services to them, regardless of the organization's geographic location.

Question 7: A medical software support team wants to reduce repeat contacts from users asking the same questions. Which solution is MOST sustainable long-term?

• Add more support staff to handle call volume
• Limit the hours that support is available to discourage non-urgent contacts
• Build and maintain a searchable self-service knowledge base with FAQs and video tutorials (Correct answer)
• Route all questions through the department manager before escalation

Correct answer: Build and maintain a searchable self-service knowledge base with FAQs and video tutorials

A well-maintained self-service knowledge base empowers users to find answers independently, reducing repeat support contacts sustainably.

Question 8: How should Certified Professional for Medical Software professionals handle technical procedures that have been updated or revised?

• Review the updates, complete any required training, and implement the revised procedures (Correct answer)
• Continue using the original method if it still works
• Wait for mandatory enforcement before changing
• Only apply updates to new cases or projects

Correct answer: Review the updates, complete any required training, and implement the revised procedures

When procedures are updated, professionals must review the changes, complete any required training to understand the rationale and new requirements, and implement the revised procedures in their practice. Continuing outdated methods risks non-compliance and suboptimal outcomes.

Question 9: A medical software system must support HL7 FHIR Bulk Data Access. Which HTTP method and endpoint pattern is used for an asynchronous bulk export?

• PUT /Parameters with bulk=true
• GET /$export with Prefer: respond-async header (Correct answer)
• GET /Patient?_format=ndjson
• POST /Bundle with type=batch

Correct answer: GET /$export with Prefer: respond-async header

FHIR Bulk Data Access uses a GET request to the $export operation with the 'Prefer: respond-async' header to initiate asynchronous data export.

Question 10: A care coordination platform needs to alert a provider when a patient is admitted to any hospital in a network. Which FHIR mechanism is most appropriate?

• FHIR $everything operation
• FHIR Batch Bundle
• FHIR Patch
• FHIR Subscriptions (Correct answer)

Correct answer: FHIR Subscriptions

FHIR Subscriptions allow a server to push notifications to registered clients when specified resources are created or changed.

Question 11: Which international standard provides a framework for risk management of medical devices, including software?

• ISO 9001:2015
• IEC 60601-1
• IEC 62304:2006
• ISO 14971:2019 (Correct answer)

Correct answer: ISO 14971:2019

ISO 14971:2019 is the internationally recognized standard for applying risk management principles throughout the medical device lifecycle, including software.

Question 12: Under 21 CFR Part 820 (FDA Quality System Regulation), the Document Control procedure must ensure that obsolete documents are:

• Archived in the same location as current documents with a red stamp
• Promptly removed from points of use or otherwise prevented from unintended use (Correct answer)
• Retained for 5 years before any action is taken
• Immediately destroyed to prevent accidental use

Correct answer: Promptly removed from points of use or otherwise prevented from unintended use

21 CFR 820.40 requires that obsolete documents be promptly removed from all points of use or otherwise prevented from unintended use, though they may be retained for legal or knowledge-preservation purposes.

Question 13: Which standard defines quality management system requirements specifically for medical device organizations?

• ISO 14971:2019
• ISO 13485:2016 (Correct answer)
• ISO 9001:2015
• IEC 62304:2006

Correct answer: ISO 13485:2016

ISO 13485:2016 specifies QMS requirements specifically for organizations involved in the design, production, and servicing of medical devices.

Question 14: In FHIR, what HTTP method is used to update an existing resource by sending a complete replacement?

• PATCH
• GET
• POST
• PUT (Correct answer)

Correct answer: PUT

The HTTP PUT method in FHIR is used to update an existing resource by providing a complete replacement of the resource content.

Question 15: What is the primary purpose of a 'software hazard analysis' in medical device development?

• Audit source code for style issues
• Identify software-related causes of hazardous situations (Correct answer)
• Estimate project cost
• Track developer productivity

Correct answer: Identify software-related causes of hazardous situations

Software hazard analysis identifies how software failures or anomalies can contribute to hazardous situations that affect patient safety.

Question 16: What is the role of secure data transmission in healthcare software?

• To reduce the quality of data transmission
• To eliminate the need for data encryption
• To prevent unauthorized access to data during transmission
• To make the transmission process slower

Secure data transmission is crucial in healthcare software to protect sensitive patient information while it moves between different systems or locations. During transmission, data is highly vulnerable to interception by unauthorized parties. Implementing secure protocols like encryption ensures that even if data is intercepted, it remains unreadable and protected from unauthorized access, maintaining its confidentiality and integrity.

Question 17: In medical software risk management, what does the acronym FMEA stand for?

• Fault Management and Error Avoidance
• Failure Modes and Effects Analysis (Correct answer)
• Functional Medical Error Analysis
• Formal Medical Equipment Assessment

Correct answer: Failure Modes and Effects Analysis

FMEA stands for Failure Modes and Effects Analysis, a systematic method for identifying potential failure modes and their effects on system performance and safety.

Question 18: What distinguishes software verification from software validation in the medical software lifecycle?

• Verification occurs after validation in the development sequence
• Verification is performed by users in clinical settings; validation is performed by developers
• Verification checks outputs against specifications; validation checks against user needs (Correct answer)
• Verification applies only to hardware interfaces; validation applies only to software functions

Correct answer: Verification checks outputs against specifications; validation checks against user needs

Verification confirms software meets specified requirements ('Are we building it right?') while validation confirms the product meets user needs in the intended environment ('Are we building the right product?').

Question 19: What is the purpose of a Risk/Benefit analysis in ISO 14971?

• To evaluate whether the expected clinical benefits of a device outweigh its risks to justify its use (Correct answer)
• To determine the financial return on investment for medical device development
• To assess staff workload versus productivity in development teams
• To compare the device's cost against competitor products

Correct answer: To evaluate whether the expected clinical benefits of a device outweigh its risks to justify its use

Risk/benefit analysis determines whether the expected clinical benefits of the medical device outweigh the residual risks, justifying the device's availability to patients.

Question 20: When implementing access controls for medical software handling ePHI, which access control model grants permissions based on job functions rather than individual user identity?

• Discretionary Access Control (DAC)
• Role-Based Access Control (RBAC) (Correct answer)
• Mandatory Access Control (MAC)
• Attribute-Based Access Control (ABAC)

Correct answer: Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) assigns permissions to roles (e.g., nurse, physician, administrator) rather than individual users, making it the model most commonly recommended for healthcare settings.

Question 21: A medical software company is preparing for an FDA 510(k) submission. Which document formally declares that the device is substantially equivalent to a predicate device?

• Technical File
• 510(k) Summary or Statement (Correct answer)
• Declaration of Conformity
• Design History File (DHF)

Correct answer: 510(k) Summary or Statement

The 510(k) submission itself—specifically the summary or statement section—formally argues substantial equivalence to a legally marketed predicate device.

Question 22: What is the significance of a 'change control process' in post-market medical software maintenance per IEC 62304?

• It is only required for Class A devices
• It ensures that modifications are evaluated for impact on safety, risk, and regulatory status before implementation (Correct answer)
• It speeds up software releases by removing approval steps
• It controls marketing messaging about software updates

Correct answer: It ensures that modifications are evaluated for impact on safety, risk, and regulatory status before implementation

Change control requires that every modification be assessed for its effect on safety classification, risk profile, and regulatory documentation before the change is made.

Question 23: When a CPMS professional identifies a potential regulatory violation, the CORRECT first step is to:

• Address it only if directly affected
• Wait to see if it resolves on its own
• Document the violation and report it through proper channels (Correct answer)
• Discuss it casually with coworkers

Correct answer: Document the violation and report it through proper channels

Proper documentation and reporting through established channels is the correct first step when identifying a potential violation. This ensures accountability, creates a paper trail, and allows appropriate parties to investigate and resolve the issue.

Question 24: In medical software quality assurance, what is the purpose of a Corrective and Preventive Action (CAPA) system?

• To track employee attendance during software development
• To document user complaints without requiring investigation
• To schedule routine software updates and patches
• To investigate nonconformities, determine root causes, and implement actions to prevent recurrence (Correct answer)

Correct answer: To investigate nonconformities, determine root causes, and implement actions to prevent recurrence

CAPA systems investigate nonconformities and defects, identify root causes, and implement both corrective actions to fix current issues and preventive actions to stop recurrence.

Question 25: The FDA's 2023 final rule on cybersecurity for medical devices (Section 524B of FD&C Act) requires manufacturers to submit a Software Bill of Materials (SBOM). The primary purpose of the SBOM is to:

• Satisfy FDA's Unique Device Identifier (UDI) requirements
• Enable identification of software components and their known vulnerabilities (Correct answer)
• Document the software development lifecycle process
• Replace the need for penetration testing

Correct answer: Enable identification of software components and their known vulnerabilities

An SBOM provides a comprehensive inventory of software components, enabling manufacturers and users to rapidly identify which products are affected when new vulnerabilities in third-party components are disclosed.

Question 26: In Certified Professional for Medical Software practice, what is the FIRST step when a safety hazard is identified in the workplace?

• Document it for the next safety audit
• Wait for a supervisor to notice the issue
• Continue working and report at end of shift
• Immediately secure the area and report the hazard (Correct answer)

Correct answer: Immediately secure the area and report the hazard

When a safety hazard is identified, the immediate priority is to secure the area to prevent injury and report the hazard through proper channels. Delaying action increases the risk of incidents.

Question 27: Which risk management approach is MOST effective for CPMS professionals when evaluating potential workplace hazards?

• Proactive hazard identification and assessment (Correct answer)
• Delegating all safety decisions to management
• Relying solely on historical accident data
• Reactive analysis after incidents occur

Correct answer: Proactive hazard identification and assessment

Proactive hazard identification and assessment allows professionals to identify and mitigate risks before incidents occur, which is far more effective than reactive approaches that only address problems after they happen.

Question 28: What is the primary purpose of a formal software release process in medical device development?

• To train clinical staff on new software features before deployment
• To archive software source code in a secure long-term repository
• To market the approved software to healthcare providers and end users
• To ensure a controlled, documented transition of software from development to production (Correct answer)

Correct answer: To ensure a controlled, documented transition of software from development to production

The software release process ensures software transitions from development to production in a controlled and documented manner, verifying all lifecycle activities are complete before clinical deployment.

Question 29: What is the MOST important factor to consider when selecting assessment tools for CPMS certification work?

• Validity, reliability, and appropriateness for the specific context (Correct answer)
• How quickly the tool can be administered
• The cost of the assessment tool
• Personal familiarity with the tool

Correct answer: Validity, reliability, and appropriateness for the specific context

Assessment tools must be valid (measuring what they claim to measure), reliable (producing consistent results), and appropriate for the specific context and population. These psychometric properties ensure the quality of assessment outcomes.

Question 30: Which security threat model is most relevant when designing a medical device API that accepts data from external partners?

• Six Sigma
• COBIT
• ITIL
• STRIDE (Correct answer)

Correct answer: STRIDE

STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege) is the standard threat modeling framework used for identifying security risks in software systems.

Question 31: During a post-implementation review, users report that the new EHR's alert fatigue is causing them to override warnings without reading them. From a training perspective, the best response is:

• Increase the number of alerts to reinforce importance
• Eliminate all alerts to improve workflow speed
• Provide education on the clinical significance of each alert type and proper override documentation (Correct answer)
• Report the users for non-compliance and suspend their access

Correct answer: Provide education on the clinical significance of each alert type and proper override documentation

Educating users on alert significance and proper override documentation promotes safe, informed clinical decision-making rather than reflexive dismissal.

Question 32: What is the BEST way for a Certified Professional for Medical Software professional to stay current with regulatory changes?

• Depend on colleagues to share updates informally
• Actively monitor regulatory bodies, attend continuing education, and participate in professional associations (Correct answer)
• Rely solely on employer notifications
• Check regulations only during certification renewal

Correct answer: Actively monitor regulatory bodies, attend continuing education, and participate in professional associations

Staying current requires a multi-faceted approach: monitoring regulatory agencies directly, attending relevant continuing education programs, and participating in professional associations that disseminate regulatory updates.

Question 33: When a CPMS professional identifies a potential regulatory violation, the CORRECT first step is to:

• Discuss it casually with coworkers
• Wait to see if it resolves on its own
• Document the violation and report it through proper channels (Correct answer)
• Address it only if directly affected

Correct answer: Document the violation and report it through proper channels

Proper documentation and reporting through established channels is the correct first step when identifying a potential violation. This ensures accountability, creates a paper trail, and allows appropriate parties to investigate and resolve the issue.

Question 34: Which document in the EU MDR technical documentation describes how a manufacturer has demonstrated conformity with all applicable General Safety and Performance Requirements?

• Clinical Evaluation Report (CER)
• GSPR Checklist (formerly Essential Requirements Checklist) (Correct answer)
• Risk Management Report
• Post-Market Surveillance Plan

Correct answer: GSPR Checklist (formerly Essential Requirements Checklist)

The GSPR Checklist (General Safety and Performance Requirements Checklist) maps each requirement from Annex I of the MDR to the specific technical documentation, standards, or tests used to demonstrate conformity.

Question 35: Which documentation practice BEST demonstrates regulatory compliance for CPMS certified professionals?

• Keeping informal handwritten notes
• Maintaining organized, dated, and signed records of all activities, training, and incidents (Correct answer)
• Filing documents only when audited
• Relying on memory for routine procedures

Correct answer: Maintaining organized, dated, and signed records of all activities, training, and incidents

Organized, dated, and signed records demonstrate systematic compliance with regulatory requirements. Proper documentation serves as evidence during audits, protects against liability, and shows a pattern of consistent adherence to standards.

Question 36: The EU MDR requires manufacturers of Class IIb and Class III devices to perform clinical follow-up through a Post-Market Clinical Follow-Up (PMCF) plan. When must this plan be updated?

• Only when the device is modified or a new indication is added
• Continuously, as part of the ongoing post-market surveillance system (Correct answer)
• Only after a serious adverse event has been reported to the Notified Body
• Every 10 years as part of the periodic safety update report cycle

Correct answer: Continuously, as part of the ongoing post-market surveillance system

Under EU MDR Article 83 and Annex XIV, PMCF is an ongoing process integrated into the post-market surveillance system, not a one-time or event-triggered activity.

Question 37: Which risk management approach is MOST effective for CPMS professionals when evaluating potential workplace hazards?

• Proactive hazard identification and assessment (Correct answer)
• Reactive analysis after incidents occur
• Delegating all safety decisions to management
• Relying solely on historical accident data

Correct answer: Proactive hazard identification and assessment

Proactive hazard identification and assessment allows professionals to identify and mitigate risks before incidents occur, which is far more effective than reactive approaches that only address problems after they happen.

Question 38: In CPMS practice, what happens when regulations are updated or changed?

• Changes apply only to new professionals entering the field
• Professionals must update their knowledge and practices to meet new requirements (Correct answer)
• Existing professionals are permanently grandfathered in
• Previous certifications are automatically revoked

Correct answer: Professionals must update their knowledge and practices to meet new requirements

When regulations change, all professionals must update their knowledge and practices to comply with new requirements. While transition periods may exist, compliance with current regulations is mandatory for all practitioners regardless of when they were certified.

Question 39: What does 'traceability' mean in the context of medical software development?

• Tracking device location in a hospital
• Linking requirements to design, implementation, and test artifacts (Correct answer)
• Monitoring software performance in production
• The ability to log all user actions in an audit trail

Correct answer: Linking requirements to design, implementation, and test artifacts

Traceability in software development means each requirement can be traced forward to its design implementation and backward to its test evidence.

Question 40: In medical software risk management, what is a 'fault tree analysis' (FTA) used for?

• Mapping software user interface navigation flows
• Identifying combinations of events and failures that could lead to an undesired top-level event or hazard (Correct answer)
• Documenting network topology for health IT infrastructure
• Tracking the number of software defects per development sprint

Correct answer: Identifying combinations of events and failures that could lead to an undesired top-level event or hazard

FTA is a top-down, deductive analysis that identifies combinations of events and failures that could lead to a specific undesired hazardous event.

Question 41: Which HL7 V2 message type is used to send an unsolicited observation result from a lab system to an EHR?

• ORM^O01
• ORU^R01 (Correct answer)
• SIU^S12
• ADT^A01

Correct answer: ORU^R01

The ORU^R01 message (Unsolicited Observation Result) transmits observation and result data from a producing system to a consuming system.

Question 42: In ISO 14971 risk management, what is the correct sequence of the risk management process?

• Risk control → Residual risk evaluation → Risk analysis → Risk evaluation
• Risk analysis → Risk evaluation → Risk control → Residual risk evaluation (Correct answer)
• Risk control → Risk analysis → Risk evaluation → Residual risk evaluation
• Risk evaluation → Risk control → Risk analysis → Residual risk evaluation

Correct answer: Risk analysis → Risk evaluation → Risk control → Residual risk evaluation

ISO 14971 defines the sequence as: risk analysis, then risk evaluation, followed by risk control, and finally residual risk evaluation.

Question 43: What is the MOST important factor to consider when selecting assessment tools for CPMS certification work?

• Personal familiarity with the tool
• Validity, reliability, and appropriateness for the specific context (Correct answer)
• The cost of the assessment tool
• How quickly the tool can be administered

Correct answer: Validity, reliability, and appropriateness for the specific context

Assessment tools must be valid (measuring what they claim to measure), reliable (producing consistent results), and appropriate for the specific context and population. These psychometric properties ensure the quality of assessment outcomes.

Question 44: What is the benefit of providing user training for new software features?

• To make the software more difficult to navigate
• To confuse the users with new features
• To reduce the amount of information available to users
• To ensure users can fully utilize new features and improve software performance (Correct answer)

Correct answer: To ensure users can fully utilize new features and improve software performance

Providing user training for new software features is beneficial because it ensures healthcare professionals can effectively understand and utilize these enhancements. Without proper training, users might overlook new functionalities or use them incorrectly, diminishing the software's potential to improve efficiency and patient care. Training maximizes the return on investment in software development by enabling full feature adoption.

Question 45: What does a Quality Management System (QMS) in the context of medical software development primarily ensure?

• That software is developed using only FDA-approved programming languages
• That all employees receive annual performance reviews
• That medical software is priced competitively in the market
• Consistent processes and controls to meet regulatory and customer requirements for quality (Correct answer)

Correct answer: Consistent processes and controls to meet regulatory and customer requirements for quality

A QMS provides a structured framework of processes and controls to ensure medical software consistently meets regulatory requirements and customer quality expectations.

Question 46: When conducting a risk assessment for CPMS operations, which factor should receive the HIGHEST priority?

• Probability and severity of potential harm (Correct answer)
• Convenience for daily operations
• Time required for safety training
• Cost of implementing safety measures

Correct answer: Probability and severity of potential harm

The probability and severity of potential harm are the primary factors in risk assessment. While cost and convenience are considerations, they should never override the assessment of how likely an incident is and how severe its consequences could be.

Question 47: When documenting software architecture for a Class C medical device under IEC 62304, which artifact is explicitly required?

• Marketing brochure
• Software architecture specification identifying software items and their interfaces (Correct answer)
• Source code comments only
• User manual draft

Correct answer: Software architecture specification identifying software items and their interfaces

IEC 62304 requires a documented software architecture that identifies all software items and their interfaces for Class B and C devices.

Question 48: What documentation is MOST critical to maintain for safety compliance in the Certified Professional for Medical Software field?

• Annual revenue reports
• Employee vacation schedules
• Client marketing preferences
• Incident reports, training records, and inspection logs (Correct answer)

Correct answer: Incident reports, training records, and inspection logs

Incident reports, training records, and inspection logs are essential safety documentation. They demonstrate compliance with safety regulations, track training completion, and provide evidence of systematic hazard management.

Question 49: In medical software quality assurance, what does 'design review' accomplish?

• It provides systematic examination of design outputs to ensure requirements are met and defects are identified early (Correct answer)
• It documents the business case for software development
• It is a regulatory submission activity required by FDA
• It replaces the need for software testing

Correct answer: It provides systematic examination of design outputs to ensure requirements are met and defects are identified early

Design reviews are formal, systematic examinations of design outputs that identify deficiencies early and confirm that design requirements are being met.

Question 50: Which SNOMED CT concept hierarchy would be used to represent a diagnosis of Type 2 diabetes mellitus?

• Clinical finding (Correct answer)
• Pharmaceutical / biologic product
• Procedure
• Observable entity

Correct answer: Clinical finding

Diagnoses and conditions are represented under the 'Clinical finding' hierarchy in SNOMED CT.

Question 51: What is the impact of poor user training on healthcare software performance?

• It improves overall patient care
• It enhances the software’s efficiency
• It may lead to errors, inefficiencies, and reduced software usage (Correct answer)
• It reduces the need for training altogether

Correct answer: It may lead to errors, inefficiencies, and reduced software usage

Poor user training in healthcare software can have significant negative impacts, leading to increased errors, reduced operational efficiencies, and underutilization of the software's capabilities. Users who are not adequately trained may struggle with tasks, make mistakes that affect patient care, and become frustrated, ultimately decreasing their adoption and overall satisfaction with the system. This can hinder workflow and compromise patient safety.

Question 52: What is a 'hazardous situation' as defined in ISO 14971?

• A failed test case in the validation protocol
• A circumstance in which people, property, or the environment are exposed to one or more hazards (Correct answer)
• A regulatory violation identified during an audit
• A software defect that has already caused patient harm

Correct answer: A circumstance in which people, property, or the environment are exposed to one or more hazards

A hazardous situation is defined as a circumstance in which people, property, or the environment are exposed to one or more hazards.

Question 53: What is the PRIMARY reason for regulatory compliance in the Certified Professional for Medical Software profession?

• To create additional paperwork for documentation
• To protect public safety, ensure quality standards, and maintain professional integrity (Correct answer)
• To justify higher service fees
• To avoid penalties and fines only

Correct answer: To protect public safety, ensure quality standards, and maintain professional integrity

Regulatory compliance serves the broader purpose of protecting public safety, ensuring consistent quality standards, and maintaining the integrity of the profession. While avoiding penalties is a benefit, the primary motivation is safeguarding the public interest.

Question 54: Which testing approach executes software without knowledge of its internal code structure?

• Static analysis
• Black-box testing (Correct answer)
• Gray-box testing
• White-box testing

Correct answer: Black-box testing

Black-box testing evaluates software functionality based solely on inputs and outputs without knowledge of internal code structure.

Question 55: A medical device company experiences a reportable malfunction under FDA's MDR (Medical Device Reporting) regulation. Under 21 CFR Part 803, a malfunction report must generally be submitted within:

• 60 calendar days for non-life-threatening malfunctions
• 30 calendar days of becoming aware of the event (Correct answer)
• 5 calendar days (if likely to cause serious injury)
• 15 calendar days regardless of severity

Correct answer: 30 calendar days of becoming aware of the event

Under 21 CFR 803.50, manufacturers must submit a malfunction MDR within 30 calendar days of becoming aware of a malfunction that would likely cause or contribute to serious injury if it were to recur.

Question 56: What is the BEST way for a Certified Professional for Medical Software professional to stay current with regulatory changes?

• Rely solely on employer notifications
• Actively monitor regulatory bodies, attend continuing education, and participate in professional associations (Correct answer)
• Check regulations only during certification renewal
• Depend on colleagues to share updates informally

Correct answer: Actively monitor regulatory bodies, attend continuing education, and participate in professional associations

Staying current requires a multi-faceted approach: monitoring regulatory agencies directly, attending relevant continuing education programs, and participating in professional associations that disseminate regulatory updates.

Question 57: Which process ensures that a medical software supplier meets quality and regulatory requirements before their product is used?

• Supplier qualification and audit process (Correct answer)
• Adverse event reporting
• Software validation testing
• Change control review

Correct answer: Supplier qualification and audit process

Supplier qualification involves evaluating and auditing vendors to confirm they meet required quality and regulatory standards before their software or components are incorporated.

Question 58: Which risk control measure has the highest priority according to ISO 14971?

• Inherent safety by design (Correct answer)
• User training and instructions
• Information for safety (warnings and labels)
• Protective measures in the device or manufacturing process

Correct answer: Inherent safety by design

ISO 14971 establishes inherent safety by design as the highest-priority risk control measure, followed by protective measures, then information for safety.

Question 59: In a medical software QMS, what is the primary goal of an internal audit?

• To test software functionality in the production environment
• To review financial expenditures on software development
• To identify employees for performance improvement plans
• To verify that the QMS is effectively implemented and conforms to planned arrangements and standards (Correct answer)

Correct answer: To verify that the QMS is effectively implemented and conforms to planned arrangements and standards

Internal audits verify that QMS processes are effectively implemented, conform to planned arrangements, and meet the requirements of applicable standards.

Question 60: What is 'nonconformance' in medical software quality management?

• A failure to meet a specified requirement, standard, or regulatory obligation (Correct answer)
• A feature request submitted after initial development
• Software that has not yet been validated
• A user preference that differs from the software design

Correct answer: A failure to meet a specified requirement, standard, or regulatory obligation

Nonconformance is any failure to meet a specified requirement, standard, or regulatory obligation that must be documented and addressed through the QMS.