Question 1: What is the benefit of cloud backups for disaster recovery?

• They provide offsite storage for disaster recovery.
• They reduce network traffic.
• They ensure faster data recovery.
• They improve system performance.

Cloud backups offer a significant benefit for disaster recovery by inherently providing offsite storage for data. By storing backup copies in a geographically separate cloud infrastructure, organizations are protected from localized disasters that could affect their primary data center and any onsite backups. This ensures that critical data remains safe and accessible for restoration, enhancing resilience and business continuity.

Question 2: An employee approaches their manager to report feeling overwhelmed by their current workload. What is the manager's best immediate response?

• Escalate the issue directly to HR without speaking with the employee further
• Advise the employee to work overtime until the backlog clears
• Reassure the employee that all team members face the same pressure
• Acknowledge the concern and schedule a workload review meeting (Correct answer)

Correct answer: Acknowledge the concern and schedule a workload review meeting

Acknowledging the concern and scheduling a structured review demonstrates respect and allows for collaborative problem-solving.

Question 3: A ServiceNow administrator needs to schedule a recurring job to clean up old log entries every Sunday at 2 AM. Which feature should they use?

• Flow Designer
• Script Include
• Business Rule
• Scheduled Job (Correct answer)

Correct answer: Scheduled Job

Scheduled Jobs in ServiceNow allow administrators to run scripts or workflows at defined intervals, such as weekly at a specific time.

Question 4: What should be included in a disaster recovery plan?

• Only the steps to restore the network.
• Only data storage information.
• A comprehensive plan including data recovery, system restoration, and emergency protocols.
• A list of authorized users.

A comprehensive disaster recovery plan (DRP) should encompass much more than just data backups. It must include detailed procedures for data recovery, system restoration (including hardware, software, and applications), and emergency protocols for communication and incident response. The plan should also define roles and responsibilities, contact information, and testing schedules to ensure a swift and effective recovery of all critical business operations after a disaster.

Question 5: What is a 'bare-metal restore'?

• Restoring only user data files to an existing OS installation
• Restoring firmware to a network switch
• Migrating a virtual machine to a physical server
• Recovering a complete system including OS, applications, and data to new or wiped hardware (Correct answer)

Correct answer: Recovering a complete system including OS, applications, and data to new or wiped hardware

Bare-metal restore rebuilds an entire system from scratch onto hardware that has no existing OS or data.

Question 6: What is the role of an intrusion detection system (IDS)?

• To enhance system performance.
• To encrypt network traffic.
• To block incoming traffic.
• To detect unauthorized access and alert administrators.

An Intrusion Detection System (IDS) is designed to monitor network or system activities for malicious activity or policy violations. Its primary role is to identify potential security breaches, such as unauthorized access attempts or malware, and then alert administrators to these events. Unlike an Intrusion Prevention System (IPS), an IDS typically focuses on detection and alerting rather than actively blocking traffic.

Question 7: Which of the following best describes an IT 'cost center'?

• A department whose costs are tracked but which does not directly generate revenue (Correct answer)
• A cloud region designated for cost optimization
• A business unit that generates direct revenue from IT products
• A financial reserve for emergency IT spending

Correct answer: A department whose costs are tracked but which does not directly generate revenue

A cost center tracks expenses for a department (like IT) that supports the business but doesn't directly generate revenue, unlike a profit center.

Question 8: The purpose of a medication reconciliation process upon a resident's return from hospitalization is to:

• Bill insurance for any new medications added during hospitalization
• Compare pre-hospital and post-hospital medication orders to identify changes and prevent errors (Correct answer)
• Transfer all prior medication orders to the new admission record unchanged
• Ensure the pharmacy delivers new medications within 24 hours

Correct answer: Compare pre-hospital and post-hospital medication orders to identify changes and prevent errors

Medication reconciliation compares the current and prior medication orders to identify discrepancies, omissions, or additions that could lead to adverse events.

Question 9: During budget planning, the IT team is told to start each cost category from zero and justify every dollar. What budgeting method is being used?

• Activity-based budgeting
• Zero-based budgeting (Correct answer)
• Rolling forecast budgeting
• Incremental budgeting

Correct answer: Zero-based budgeting

Zero-based budgeting requires justifying all expenses from scratch each period rather than basing them on prior-year spending.

Question 10: A perpetual software license differs from a subscription license primarily in that a perpetual license:

• Requires annual renewal to maintain legal use
• Includes free upgrades to all future major versions indefinitely
• Grants the right to use a specific software version indefinitely after a one-time purchase (Correct answer)
• Allows unlimited installations across all company devices

Correct answer: Grants the right to use a specific software version indefinitely after a one-time purchase

A perpetual license grants indefinite rights to use a specific version of the software for a single upfront payment, though ongoing maintenance may require separate fees.

Question 11: Under the Computer Fraud and Abuse Act (CFAA), which activity would most likely constitute a federal violation?

• A developer testing their own code on a staging server
• An employee accessing authorized systems outside of business hours
• An administrator using remote desktop to manage a company server
• A contractor accessing a database beyond the scope of their authorization (Correct answer)

Correct answer: A contractor accessing a database beyond the scope of their authorization

The CFAA prohibits accessing a computer without authorization or exceeding authorized access, which includes a contractor accessing data outside the permitted scope.

Question 12: A sysadmin is evaluating whether to repair aging servers or replace them. The money already spent on those servers should be ignored in this decision. This concept is called:

• Fixed cost
• Opportunity cost
• Variable cost
• Sunk cost (Correct answer)

Correct answer: Sunk cost

Sunk costs are past expenditures that cannot be recovered and should not influence future investment decisions.

Question 13: A sysadmin discovers that a software license is being renewed automatically for 200 seats, but only 80 are actively used. What financial practice would have prevented this waste?

• Software Asset Management (SAM) (Correct answer)
• Asset depreciation review
• Zero-based budgeting
• License compliance audit

Correct answer: Software Asset Management (SAM)

Software Asset Management (SAM) tracks license usage and entitlements to prevent over-purchasing and reduce waste.

Question 14: An IT manager wants to spread the cost of a $120,000 server over 5 years on the financial statements. Which accounting method achieves this?

• Cash-basis accounting
• Depreciation (Correct answer)
• Amortization
• Accrual accounting

Correct answer: Depreciation

Depreciation allocates the cost of a tangible asset (like a server) over its useful life on the income statement.

Question 15: How often should system updates be performed?

• Every few months.
• Only when there is a system issue.
• Regularly, ideally weekly or monthly.
• Only when major software releases are available.

System updates should be performed regularly, ideally on a weekly or monthly basis, to ensure the system benefits from the latest security patches, bug fixes, and performance improvements. This proactive approach helps protect against emerging threats and maintains system stability and efficiency over time, reducing risks.

Question 16: A user's account is locked out after multiple failed login attempts. Which table should the administrator check to review the lockout details?

• sys_user_session
• sys_auth_policy_result
• sys_user
• syslog_auth (Correct answer)

Correct answer: syslog_auth

The syslog_auth table records authentication events including failed login attempts and account lockouts for security auditing.

Question 17: When a conflict arises between standard procedures and a unique situation in Resident Rights & Advocacy, what should a CSA professional prioritize?

• The preference of the client or stakeholder
• The most cost-effective solution available
• Safety and ethical obligations while seeking expert consultation (Correct answer)
• Strict adherence to written procedures without exception

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Resident Rights & Advocacy. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 18: Under OBRA regulations, how often must a nursing facility complete a comprehensive resident assessment (MDS)?

• Every 6 months
• Within 14 days of admission, then at least annually with quarterly reviews (Correct answer)
• Annually
• Only upon significant change in condition

Correct answer: Within 14 days of admission, then at least annually with quarterly reviews

OBRA requires an MDS within 14 days of admission, quarterly reviews, and annual comprehensive reassessments.

Question 19: The purpose of the Pharmacy and Therapeutics (P&T) Committee in a long-term care setting is to:

• Negotiate drug pricing directly with pharmaceutical manufacturers
• Approve individual resident prescriptions on a case-by-case basis
• Establish and review the facility formulary, medication use policies, and monitor medication-related quality indicators (Correct answer)
• Replace the role of the consulting pharmacist in conducting MRRs

Correct answer: Establish and review the facility formulary, medication use policies, and monitor medication-related quality indicators

The P&T Committee oversees formulary management, medication policies, and quality improvement initiatives related to pharmaceutical services across the facility.

Question 20: What is the PRIMARY purpose of continuing education requirements in Resident Rights & Advocacy for CSA professionals?

• Fulfilling mandatory regulatory requirements only
• Networking with other professionals in the field
• Earning additional credentials for career advancement
• Maintaining current knowledge and competency as the field evolves (Correct answer)

Correct answer: Maintaining current knowledge and competency as the field evolves

Continuing education in Resident Rights & Advocacy ensures professionals maintain current knowledge and skills as standards, technologies, and best practices evolve in the Certified System Administrator field.

Question 21: An organization uses a SAN-based snapshot for backup. After a storage array failure, they discover the snapshots were stored on the same array as the primary data. What backup principle was violated?

• The GFS rotation policy
• The encryption-at-rest requirement
• The incremental backup schedule
• The 3-2-1 rule requiring at least one copy on a separate medium (Correct answer)

Correct answer: The 3-2-1 rule requiring at least one copy on a separate medium

The 3-2-1 rule requires at least one copy on different media; storing snapshots on the same array violates this fundamental redundancy principle.

Question 22: Which document serves as the legal record of a resident's care planning decisions and must be kept current in the clinical record?

• Staffing schedule
• Dietary preference form
• Comprehensive care plan (Correct answer)
• Incident report

Correct answer: Comprehensive care plan

The comprehensive care plan is both the clinical roadmap and a legal document that must be regularly reviewed and updated to reflect the resident's current needs.

Question 23: A facility administrator discovers that a resident's medication label does not match the prescriber's current order. The FIRST action should be to:

• Document the discrepancy in the resident's chart without further action
• Dispose of the incorrectly labeled medication immediately
• Administer the medication as labeled and note the discrepancy
• Hold the medication and contact the pharmacy to clarify (Correct answer)

Correct answer: Hold the medication and contact the pharmacy to clarify

When a label discrepancy is identified, the medication should be held and the pharmacy contacted immediately to resolve the error before administration.

Question 24: Your company uses a 3-year rolling forecast for IT spending. What is the primary advantage of this approach over a traditional annual budget?

• It eliminates the need for monthly reporting
• It requires fewer approvals from finance leadership
• It locks in vendor pricing for three years
• It provides a continuously updated long-term financial view that adapts to change (Correct answer)

Correct answer: It provides a continuously updated long-term financial view that adapts to change

A rolling forecast continuously updates the planning horizon, giving leadership a current view of future spending rather than a static snapshot from last year.

Question 25: Which backup strategy copies only files that have changed since the last FULL backup, regardless of whether a previous incremental backup was taken?

• Incremental backup
• Differential backup (Correct answer)
• Mirror backup
• Synthetic full backup

Correct answer: Differential backup

A differential backup copies all data changed since the last full backup, making it independent of other differential backups.

Question 26: In long-term care, 'advance care planning' documentation such as a POLST form primarily communicates which information?

• The facility's emergency evacuation procedures
• The physician's billing codes for skilled services
• The resident's financial assets and insurance coverage
• The resident's medical treatment preferences for end-of-life or serious illness (Correct answer)

Correct answer: The resident's medical treatment preferences for end-of-life or serious illness

A POLST (Physician Orders for Life-Sustaining Treatment) form translates a resident's wishes about CPR, hospitalization, and other interventions into actionable medical orders.

Question 27: What documentation practice is considered essential in Staff Management & Training within the Certified System Administrator field?

• Using shorthand notes that can be expanded later if needed
• Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
• Only documenting unusual events or complications
• Completing all documentation at the end of the workday

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Staff Management & Training ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 28: Which ServiceNow tool is used to validate that a newly installed or upgraded instance meets baseline configuration standards?

• Instance Security Center
• Configuration Baseline Checker
• Health Scan (Correct answer)
• System Diagnostics > Stats

Correct answer: Health Scan

The Health Scan tool runs automated checks against best-practice baselines to identify configuration gaps after installation or upgrade.

Question 29: Which clone excluder type prevents sensitive data from being copied during an instance clone?

• Field Masks
• Property Filters
• Update Set Exclusions
• Data Preservers and Exclude Tables (Correct answer)

Correct answer: Data Preservers and Exclude Tables

Clone Data Preservers keep certain target records intact, while Exclude Tables prevent specific tables from being cloned from source.

Question 30: The interdisciplinary team (IDT) that develops a resident's care plan typically includes which of the following members?

• State surveyors, ombudsman, and insurance representatives
• HR director, payroll staff, and marketing coordinator
• Administrator, maintenance director, and accountant
• Nursing, social services, dietary, activities, and therapy staff (Correct answer)

Correct answer: Nursing, social services, dietary, activities, and therapy staff

The IDT for care planning includes clinical and supportive disciplines—nursing, social work, dietary, activities, and therapy—who each contribute to holistic resident care goals.

Question 31: A system administrator wants to verify that all software installed on company systems is licensed. Which process best describes this ongoing compliance activity?

• Software asset management (SAM) (Correct answer)
• Penetration testing
• Configuration baseline auditing
• Vulnerability scanning

Correct answer: Software asset management (SAM)

Software Asset Management (SAM) is the practice of managing and optimizing the purchase, deployment, and retirement of software licenses within an organization.

Question 32: Which ServiceNow table stores configuration parameters that control instance-wide system behavior?

• sys_metadata
• sys_properties (Correct answer)
• sys_config
• sys_params

Correct answer: sys_properties

The sys_properties table holds system properties (name-value pairs) that govern global instance configuration.

Question 33: The California Consumer Privacy Act (CCPA) applies to for-profit businesses that meet which threshold related to personal information?

• Employ more than 50 California residents
• Have annual gross revenues exceeding $5 million
• Process personal data of more than 500 California residents per year
• Buy, sell, or share personal information of 100,000 or more consumers or households annually (Correct answer)

Correct answer: Buy, sell, or share personal information of 100,000 or more consumers or households annually

Under CCPA (as amended by CPRA), one qualifying threshold is buying, selling, or sharing personal information of 100,000 or more consumers or households per year.

Question 34: At the end of Q2, IT spending is at 60% of the annual budget. What does this suggest, and what should be investigated?

• Spending is perfectly on track; no action needed
• The remaining 40% should be encumbered to prevent overspending
• The budget should immediately be cut by 10%
• Spending may be ahead of schedule; investigate whether projects are accelerating or costs are misclassified (Correct answer)

Correct answer: Spending may be ahead of schedule; investigate whether projects are accelerating or costs are misclassified

At midyear (50% of the year), spending 60% of the budget suggests the pace is faster than planned, warranting a review of acceleration causes or reclassification issues.

Question 35: Which standard of practice is MOST important for ensuring quality in Medication Management Oversight?

• Strictly adhering to the same procedure in every situation
• Following evidence-based protocols while adapting to specific circumstances (Correct answer)
• Minimizing documentation to focus on practical work
• Using the most advanced technology available regardless of need

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Evidence-based protocols provide a foundation of proven practices, but effective Certified System Administrator professionals must also adapt their approach based on specific circumstances and individual case needs within Medication Management Oversight.

Question 36: What is 'cohorting' in the context of infection control in a long-term care facility?

• Grouping infected residents together and assigning dedicated staff to care only for that group (Correct answer)
• Transferring all infected residents to a single isolation room regardless of diagnosis
• Requiring all staff to wear full PPE throughout the entire facility during an outbreak
• Canceling all group activities until the infection rate drops to zero

Correct answer: Grouping infected residents together and assigning dedicated staff to care only for that group

Cohorting groups residents with the same confirmed infection together and assigns dedicated staff to minimize the risk of cross-transmission to non-infected residents.

Question 37: An administrator discovers that a vendor's software EULA prohibits reverse engineering. Under which U.S. law does a narrow 'interoperability' exception allow limited reverse engineering despite such contractual prohibitions?

• Digital Millennium Copyright Act (Correct answer)
• Computer Fraud and Abuse Act
• Electronic Communications Privacy Act
• Sarbanes-Oxley Act

Correct answer: Digital Millennium Copyright Act

The DMCA Section 1201(f) provides an interoperability exception permitting reverse engineering of software solely to achieve compatibility.

Question 38: During a building evacuation drill, a system administrator discovers that a critical server room door is locked and staff cannot exit quickly. What is the FIRST priority action?

• Post a note on the door reminding staff to keep it unlocked
• Add the door override to the next change management ticket
• Immediately report the blocked exit to the safety officer and facilities team (Correct answer)
• Document the issue for the next safety meeting

Correct answer: Immediately report the blocked exit to the safety officer and facilities team

A blocked emergency exit is a life-safety hazard that must be reported immediately to safety officers and facilities so it can be corrected before a real emergency occurs.

Question 39: What is the purpose of a Requirements Traceability Matrix (RTM) in QA?

• To track defect resolution timelines
• To document system architecture dependencies
• To map requirements to corresponding test cases ensuring full coverage (Correct answer)
• To schedule test execution cycles

Correct answer: To map requirements to corresponding test cases ensuring full coverage

An RTM maps each business or system requirement to one or more test cases, ensuring every requirement is tested and no coverage gaps exist.

Question 40: Which log file on a Linux system records successful and failed authentication attempts?

• /var/log/kern.log
• /var/log/dmesg
• /var/log/syslog
• /var/log/auth.log (Correct answer)

Correct answer: /var/log/auth.log

/var/log/auth.log (or /var/log/secure on RHEL-based systems) captures PAM, sudo, and SSH authentication events.

Question 41: A resident's care plan indicates a low-sodium diet, but the resident asks for salty snacks. After education on risks, the resident still insists. The appropriate response is:

• Add a salt substitute without telling the resident
• Honor the informed request, update the care plan, and document the discussion (Correct answer)
• Refuse to provide any salty foods to protect the resident's health
• Contact family to override the resident's decision

Correct answer: Honor the informed request, update the care plan, and document the discussion

An informed resident with decision-making capacity may choose to deviate from recommended diet; staff must document and update the care plan accordingly.

Question 42: In long-term care, a 'liberalized diet' philosophy encourages which practice?

• Eliminating all physician-ordered diets to reduce paperwork
• Allowing residents to eat unlimited quantities of any food regardless of medical risk
• Relaxing overly restrictive therapeutic diets to improve residents' quality of life and food enjoyment (Correct answer)
• Replacing regular meals with nutritional supplements

Correct answer: Relaxing overly restrictive therapeutic diets to improve residents' quality of life and food enjoyment

A liberalized diet approach, supported by dietetic and geriatric organizations, balances medical needs with quality of life by easing unnecessarily strict dietary restrictions in older adults.

Question 43: How does risk management apply to daily practice in Regulatory Compliance & Licensing for Certified System Administrator professionals?

• Only through responding to incidents after they occur
• By avoiding high-risk situations entirely
• Through proactive identification of potential hazards and implementation of preventive measures (Correct answer)
• Through annual safety audits exclusively

Correct answer: Through proactive identification of potential hazards and implementation of preventive measures

Effective risk management in Regulatory Compliance & Licensing requires proactive hazard identification and preventive measures, not just reactive responses. This approach reduces incidents, improves outcomes, and protects both professionals and clients.

Question 44: In a long-term care facility, therapeutic diets (such as low-sodium or diabetic diets) must be ordered by whom?

• The director of nursing
• A licensed physician or other authorized prescriber (Correct answer)
• The certified dietary manager
• The facility administrator

Correct answer: A licensed physician or other authorized prescriber

Therapeutic diets are medical orders and must be prescribed by a licensed physician or other authorized prescriber (e.g., NP or PA) and documented in the clinical record.

Question 45: In a QA program, what is the primary purpose of a test plan document?

• To document user acceptance criteria only
• To list all known bugs in the system
• To define the scope, approach, resources, and schedule for testing activities (Correct answer)
• To record test execution results

Correct answer: To define the scope, approach, resources, and schedule for testing activities

A test plan defines the scope, objectives, approach, resources, environment, and schedule needed to guide all testing activities within a project.

Question 46: What is the primary purpose of Network Address Translation (NAT)?

• Resolve hostnames to IP addresses
• Map private IP addresses to a public IP address (Correct answer)
• Encrypt packets in transit
• Assign IP addresses via DHCP

Correct answer: Map private IP addresses to a public IP address

NAT translates private internal IP addresses to a public IP address, conserving IPv4 address space and masking internal topology.

Question 47: Under the Americans with Disabilities Act (ADA), a nursing facility must provide:

• Daily physician visits for all residents
• Interpreters for every language spoken by residents
• Free private rooms for all residents
• Reasonable accommodations to ensure equal access for residents with disabilities (Correct answer)

Correct answer: Reasonable accommodations to ensure equal access for residents with disabilities

The ADA requires facilities to make reasonable accommodations so residents with disabilities can access services and activities equally.

Question 48: What documentation practice is considered essential in Regulatory Compliance & Licensing within the Certified System Administrator field?

• Only documenting unusual events or complications
• Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
• Using shorthand notes that can be expanded later if needed
• Completing all documentation at the end of the workday

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Regulatory Compliance & Licensing ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 49: A facility administrator needs to track all maintenance activities and asset repair history. Which system is best suited for this?

• CRM (Customer Relationship Management)
• ERP (Enterprise Resource Planning)
• DMS (Document Management System)
• CMMS (Computerized Maintenance Management System) (Correct answer)

Correct answer: CMMS (Computerized Maintenance Management System)

A CMMS is specifically designed to manage maintenance work orders, schedules, and asset histories.

Question 50: When a resident's legal guardian makes decisions the resident clearly opposes, staff should:

• Contact law enforcement immediately
• Always defer to the guardian without question
• Assess whether the resident has capacity and consult the care team and ethics committee if needed (Correct answer)
• Ignore the resident's objections since guardianship overrides all wishes

Correct answer: Assess whether the resident has capacity and consult the care team and ethics committee if needed

Staff should assess the resident's decision-making capacity and may involve an ethics committee when guardian decisions appear to conflict with the resident's known wishes.

Question 51: According to CMS regulations, how frequently must a long-term care facility review and evaluate the effectiveness of its infection control program?

• Monthly
• Every two years
• Quarterly
• Annually (Correct answer)

Correct answer: Annually

CMS requires long-term care facilities to conduct an annual review and evaluation of their infection control program to assess effectiveness and update policies as needed.

Question 52: A senior IT administrator is leaving the organization. Which knowledge transfer activity is most critical before their departure?

• Archiving their email correspondence
• Conducting structured knowledge transfer sessions and updating documentation (Correct answer)
• Reassigning their active directory account to a colleague
• Collecting all company hardware they were issued

Correct answer: Conducting structured knowledge transfer sessions and updating documentation

Structured knowledge transfer and documentation updates preserve institutional knowledge that would otherwise leave with the employee.

Question 53: An IT administrator is managing a remote team across multiple time zones. Which staff management practice is most important for maintaining productivity?

• Establishing clear asynchronous communication protocols and response-time expectations (Correct answer)
• Holding daily video calls at a time convenient for the manager
• Monitoring employee screen activity continuously
• Requiring all team members to be online during a single shared time window

Correct answer: Establishing clear asynchronous communication protocols and response-time expectations

Clear async communication protocols allow distributed teams to collaborate effectively without requiring simultaneous availability.

Question 54: Staff discover that a resident's nephew has been withdrawing money from the resident's bank account without consent. This is:

• Only reportable if the amount exceeds a legal threshold
• A private family matter outside staff scope of practice
• Financial abuse requiring mandatory reporting to Adult Protective Services (Correct answer)
• Acceptable if the nephew claims the resident gave verbal permission

Correct answer: Financial abuse requiring mandatory reporting to Adult Protective Services

Unauthorized use of a resident's financial resources is financial abuse and must be reported to APS and facility management.

Question 55: Your organization uses a chargeback model for IT services. What is the primary purpose of this approach?

• To transfer ownership of IT assets to individual departments
• To eliminate the need for an IT budget
• To allocate IT costs to the business units that consume them (Correct answer)
• To punish departments that overspend

Correct answer: To allocate IT costs to the business units that consume them

Chargeback models assign IT costs directly to the consuming business units, promoting accountability and accurate cost attribution.

Question 56: When a long-term care facility uses an automated medication dispensing cabinet (ADC), the administrator must ensure that:

• Access is restricted by role, all transactions are logged, and override use is monitored and audited (Correct answer)
• Any staff member with a PIN can access all medications to improve speed
• Pharmacy oversight is no longer needed because the ADC tracks all transactions automatically
• Controlled substances are excluded from the ADC system entirely

Correct answer: Access is restricted by role, all transactions are logged, and override use is monitored and audited

ADCs must have role-based access controls, complete transaction audit trails, and administrative oversight of override usage to prevent diversion and errors.

Question 57: A resident with dementia becomes agitated when bathing. Which approach best respects their rights while ensuring safety?

• Skip all bathing to avoid distress
• Physically restrain the resident to complete the bath quickly
• Administer a PRN sedative before every bath
• Use a person-centered approach: offer choices, use preferred music, and try a different time (Correct answer)

Correct answer: Use a person-centered approach: offer choices, use preferred music, and try a different time

Person-centered care techniques that offer choice and comfort respect dignity and autonomy even when cognitive capacity is reduced.

Question 58: What does encryption do for data security?

• It prevents data from being backed up.
• It increases the speed of data transfer.
• It prevents unauthorized access to sensitive data.
• It reduces data storage requirements.

Encryption transforms data into a coded format, making it unreadable to anyone without the correct decryption key. This process is crucial for data security because it protects sensitive information from unauthorized access, even if the data is intercepted or stolen. By rendering the data unintelligible, encryption ensures confidentiality and integrity, safeguarding it both in transit and at rest.

Question 59: A systems administrator is creating an employee development plan. Which element is essential to include?

• The employee's compensation history
• A comparison of the employee to peer performance benchmarks
• Specific skill goals, development activities, and a timeline for achievement (Correct answer)
• A list of all HR policies the employee must read

Correct answer: Specific skill goals, development activities, and a timeline for achievement

An effective development plan sets concrete, time-bound goals and identifies the specific activities needed to achieve them.

Question 60: Which right specifically protects a resident from being transferred or discharged from a nursing facility without proper notice and cause?

• Right to protection from involuntary discharge (Correct answer)
• Right to self-determination
• Right to privacy
• Right to grievance

Correct answer: Right to protection from involuntary discharge

Federal law strictly limits the reasons for involuntary discharge and requires advance written notice to protect resident stability.

Question 61: In IT financial management, what does the term 'run the business' (RTB) spending refer to?

• R&D expenses for innovation projects
• Capital investments in new IT projects
• Vendor contract negotiations
• Costs to maintain and operate existing IT systems and services (Correct answer)

Correct answer: Costs to maintain and operate existing IT systems and services

Run-the-business (RTB) costs cover keeping existing systems operational—maintenance, support, licensing—as opposed to grow/transform-the-business projects.

Question 62: A resident experiences a suspected adverse drug reaction (ADR) following a new medication. The administrator's responsibility includes ensuring that:

• The family is notified only if the reaction is life-threatening
• The event is documented, the prescriber is notified, and an incident report is filed (Correct answer)
• The pharmacy is solely responsible for investigating the reaction
• The medication is quietly discontinued without documentation

Correct answer: The event is documented, the prescriber is notified, and an incident report is filed

Suspected ADRs require thorough documentation, immediate prescriber notification, and completion of an incident report as part of the facility's quality assurance process.

Question 63: When preparing an IT budget for the next fiscal year, which expenditure type would a sysadmin classify as OpEx?

• Acquiring perpetual software licenses
• Buying server hardware for a new data center
• Purchasing a new SAN storage array
• Monthly cloud subscription fees for IaaS (Correct answer)

Correct answer: Monthly cloud subscription fees for IaaS

Monthly subscription fees are ongoing operational expenses (OpEx), not capital investments in long-lived assets.

Question 64: PRN (as-needed) medication orders in a nursing facility must include:

• Physician re-authorization every 72 hours
• Only the medication name and dose, with nurses determining frequency
• The specific indication, maximum dose, frequency, and route (Correct answer)
• Open-ended duration with no expiration date

Correct answer: The specific indication, maximum dose, frequency, and route

PRN orders must specify the clinical indication, maximum dose, frequency limits, and route to ensure safe and appropriate use.

Question 65: Which testing level focuses on verifying individual components or modules in isolation?

• Acceptance testing
• Integration testing
• System testing
• Unit testing (Correct answer)

Correct answer: Unit testing

Unit testing verifies the smallest testable parts of an application (functions, methods, classes) in isolation from other components.

Question 66: Which IDDSI (International Dysphagia Diet Standardisation Initiative) level describes food that is 'soft and bite-sized,' requiring some chewing ability?

• Level 5 – Minced & Moist
• Level 7 – Regular
• Level 3 – Liquidised
• Level 6 – Soft & Bite-Sized (Correct answer)

Correct answer: Level 6 – Soft & Bite-Sized

IDDSI Level 6 (Soft & Bite-Sized) describes foods that are tender, moist, and cut into small pieces, suitable for residents with mild chewing or swallowing difficulties.

Question 67: A systems administrator wants to cross-train staff to eliminate single points of failure. Which approach is most effective?

• Hire contractors to cover critical systems
• Reduce the number of systems each person manages
• Require all staff to complete the same vendor certification
• Rotate staff assignments across different systems and responsibilities (Correct answer)

Correct answer: Rotate staff assignments across different systems and responsibilities

Job rotation builds broad competency across the team so that multiple staff members can cover any critical function.

Question 68: The administrator's role in the facility's pharmacy services agreement is to ensure the contract includes provisions for:

• Exclusive use of the contracted pharmacy's brand-name drugs only
• Pharmacy staff to perform all medication administration tasks
• Emergency medication access, MRR services, and timely delivery standards (Correct answer)
• Eliminating the need for internal medication storage by delivering per dose

Correct answer: Emergency medication access, MRR services, and timely delivery standards

The pharmacy services agreement must address emergency medication availability, consultant pharmacist MRR services, and timely delivery to meet CMS requirements.

Question 69: What documentation practice is considered essential in Emergency Preparedness & Safety within the Certified System Administrator field?

• Only documenting unusual events or complications
• Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
• Using shorthand notes that can be expanded later if needed
• Completing all documentation at the end of the workday

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Emergency Preparedness & Safety ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 70: In Medication Management Oversight, what is the FIRST step a CSA professional should take when encountering a new case or situation?

• Conduct a comprehensive assessment and gather all relevant information (Correct answer)
• Consult with a supervisor before taking any action
• Implement an immediate solution based on past experience
• Document the situation and wait for further instructions

Correct answer: Conduct a comprehensive assessment and gather all relevant information

In Medication Management Oversight, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified System Administrator practice.

Question 71: A resident's family removes personal belongings from the room without the resident's permission. The aide should:

• Report the situation to the charge nurse as potential financial exploitation (Correct answer)
• Remind the resident they should not have so many belongings
• Help the family pack since they are the listed next of kin
• Allow it since family have authority over possessions

Correct answer: Report the situation to the charge nurse as potential financial exploitation

Removing a resident's property without consent may constitute financial exploitation and must be reported to a supervisor.

Question 72: What does a stateful firewall track that a stateless packet filter does not?

• Destination port numbers
• Active connection state (Correct answer)
• MAC addresses
• Source IP addresses

Correct answer: Active connection state

Stateful firewalls maintain a connection table to track the state of active sessions, allowing them to make smarter allow/deny decisions.

Question 73: An administrator notices multiple residents on the same hall developing similar gastrointestinal symptoms within 48 hours. What is the FIRST action the administrator should take?

• Notify the infection preventionist and begin outbreak investigation and symptom surveillance (Correct answer)
• Transfer symptomatic residents to the hospital to prevent further spread
• Administer prophylactic antibiotics to all residents on the affected hall
• Immediately close the facility to new admissions and notify the media

Correct answer: Notify the infection preventionist and begin outbreak investigation and symptom surveillance

Initiating an outbreak investigation through the infection preventionist and implementing symptom surveillance is the first step to identify the scope, cause, and contain the outbreak.

Question 74: When a conflict arises between standard procedures and a unique situation in Medication Management Oversight, what should a CSA professional prioritize?

• Strict adherence to written procedures without exception
• The preference of the client or stakeholder
• Safety and ethical obligations while seeking expert consultation (Correct answer)
• The most cost-effective solution available

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Medication Management Oversight. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 75: What is the purpose of a 'runbook' in disaster recovery?

• A script that automatically executes failover without human intervention
• A log file generated by backup software during each backup job
• A documented step-by-step procedure guide that staff follow during a disaster recovery event (Correct answer)
• A dashboard that displays real-time replication lag metrics

Correct answer: A documented step-by-step procedure guide that staff follow during a disaster recovery event

A runbook provides detailed, sequential instructions so that any qualified administrator can execute recovery procedures accurately under stressful conditions.

Question 76: A facility administrator receives a report that a Schedule II controlled substance count is off by two doses at the end of a shift. The FIRST administrative action should be to:

• Terminate the nurse on duty without further investigation
• Initiate an investigation, secure the remaining controlled substances, and notify appropriate authorities if diversion is suspected (Correct answer)
• Assume a counting error occurred and correct the log
• Wait 48 hours to see if the count resolves before reporting

Correct answer: Initiate an investigation, secure the remaining controlled substances, and notify appropriate authorities if diversion is suspected

A controlled substance discrepancy requires an immediate investigation, securing remaining drugs, and reporting to law enforcement or the DEA if diversion is confirmed or reasonably suspected.

Question 77: Which NIST framework function focuses on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

• Identify
• Respond
• Detect
• Protect (Correct answer)

Correct answer: Protect

The 'Protect' function in the NIST Cybersecurity Framework covers access control, awareness training, data security, and protective technologies.

Question 78: Which property must be set to enable HTTPS-only access on a ServiceNow instance?

• glide.security.use_ssl (Correct answer)
• glide.secure.mode
• glide.ssl.required
• glide.https.enforce

Correct answer: glide.security.use_ssl

Setting glide.security.use_ssl to true forces all traffic through HTTPS, disabling plain HTTP connections.

Question 79: When a conflict arises between standard procedures and a unique situation in Quality Assurance Programs, what should a CSA professional prioritize?

• Safety and ethical obligations while seeking expert consultation (Correct answer)
• Strict adherence to written procedures without exception
• The preference of the client or stakeholder
• The most cost-effective solution available

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Quality Assurance Programs. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 80: Why is system performance monitoring important after updates and repairs?

• To prevent unauthorized access.
• To track the system's performance and identify potential issues.
• To verify the completion of the updates.
• To clean the system hardware.

After updates or repairs, system performance monitoring is vital to ensure that the changes have not negatively impacted the system's operation. It helps track key metrics, identify any new bottlenecks, or uncover unexpected issues that might arise from the modifications, ensuring the system continues to run optimally and efficiently.

Question 81: Which federally mandated assessment tool must be completed for every resident admitted to a Medicare- or Medicaid-certified nursing facility in the US?

• HCAHPS Survey
• OASIS-E
• Resident Assessment Instrument (RAI) / MDS (Correct answer)
• UB-04 Claim Form

Correct answer: Resident Assessment Instrument (RAI) / MDS

The Resident Assessment Instrument (RAI), which includes the Minimum Data Set (MDS), is federally required for all residents in certified long-term care facilities.

Question 82: An 'NDD' notation on a nursing facility resident's dietary record most commonly refers to which type of diet?

• No Documented Diagnosis
• National Dysphagia Diet (Correct answer)
• Nutritionally Dense Diet
• No Dairy Diet

Correct answer: National Dysphagia Diet

NDD stands for National Dysphagia Diet, a standardized texture and liquid modification framework used to reduce aspiration risk in residents with swallowing difficulties.

Question 83: What is the primary purpose of a Resident Assessment Protocol (RAP) triggered during the MDS process?

• To bill Medicare for services
• To identify risk areas and guide individualized care planning (Correct answer)
• To report quality measures to CMS
• To document physician orders

Correct answer: To identify risk areas and guide individualized care planning

RAPs (now called Care Area Assessments) flag potential clinical problems and guide the interdisciplinary team in developing targeted, individualized care plans.

Question 84: A system administrator reviews logs and sees thousands of failed SSH login attempts from multiple IP addresses. What type of attack is most likely occurring?

• Distributed brute-force / credential stuffing attack (Correct answer)
• Man-in-the-middle attack
• SQL injection attack
• DNS amplification attack

Correct answer: Distributed brute-force / credential stuffing attack

Mass failed SSH login attempts from multiple sources indicate a distributed brute-force or credential stuffing attack targeting authentication.

Question 85: A system administrator at a federally funded university must ensure research systems comply with NIST SP 800-171. Which type of data does this standard specifically protect?

• Classified National Security Information
• Controlled Unclassified Information (CUI) (Correct answer)
• Protected Health Information (PHI)
• Personally Identifiable Information (PII)

Correct answer: Controlled Unclassified Information (CUI)

NIST SP 800-171 establishes requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems and organizations.

Question 86: Which of the following best describes a 'person-centered' approach to care planning in a long-term care facility?

• Physicians set all care goals based solely on medical diagnoses
• Care plans are written by nurses without resident input to save time
• The administrator approves all care goals before implementation
• Goals and interventions reflect the resident's own preferences, values, and choices (Correct answer)

Correct answer: Goals and interventions reflect the resident's own preferences, values, and choices

Person-centered care planning ensures that the resident's own preferences, values, and choices drive the goals and interventions documented in the care plan.

Question 87: A nursing facility administrator is developing a policy to reduce polypharmacy. Which strategy is MOST effective as an administrative oversight measure?

• Limiting residents to a maximum of five medications regardless of clinical need
• Assigning a pharmacist to approve all new prescriptions before dispensing
• Requiring physician justification for each medication at the monthly care conference
• Mandating monthly medication regimen reviews by a consultant pharmacist (Correct answer)

Correct answer: Mandating monthly medication regimen reviews by a consultant pharmacist

Monthly medication regimen reviews by a consultant pharmacist are a regulatory requirement and a proven strategy for identifying and reducing unnecessary medications.

Question 88: Which standard of practice is MOST important for ensuring quality in Resident Rights & Advocacy?

• Following evidence-based protocols while adapting to specific circumstances (Correct answer)
• Using the most advanced technology available regardless of need
• Minimizing documentation to focus on practical work
• Strictly adhering to the same procedure in every situation

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Evidence-based protocols provide a foundation of proven practices, but effective Certified System Administrator professionals must also adapt their approach based on specific circumstances and individual case needs within Resident Rights & Advocacy.

Question 89: What is 'grandfather-father-son' (GFS) backup rotation?

• A media rotation strategy using daily, weekly, and monthly backup sets (Correct answer)
• A replication topology with three geographically distributed sites
• A three-tier encryption scheme for backup tapes
• A method for backing up three generations of application versions

Correct answer: A media rotation strategy using daily, weekly, and monthly backup sets

GFS rotation uses daily (son), weekly (father), and monthly (grandfather) tape sets to balance retention depth with media costs.

Question 90: Which of the following BEST describes a healthcare-associated infection that would be classified as a 'sentinel event' requiring immediate reporting?

• A single resident developing a urinary tract infection after catheter insertion
• A resident death attributable to a healthcare-associated infection that was preventable (Correct answer)
• An increase in hand hygiene compliance observations falling below 75%
• Two residents with similar symptoms from the same unit within one week

Correct answer: A resident death attributable to a healthcare-associated infection that was preventable

A sentinel event is an unexpected occurrence involving death or serious physical harm; a resident death from a preventable HAI meets this definition and requires immediate review and reporting.

Question 91: Which federal regulation governs food and nutrition services requirements for long-term care facilities certified by Medicare and Medicaid?

• 42 CFR §483.95
• 42 CFR §483.10
• 42 CFR §483.60 (Correct answer)
• 42 CFR §483.80

Correct answer: 42 CFR §483.60

42 CFR §483.60 contains all federal requirements for food and nutrition services in Medicare/Medicaid-certified nursing facilities.

Question 92: Which grounding system is commonly required in data centers to minimize electromagnetic interference and ensure equipment safety?

• Mesh bonding network (MBN) / signal reference grid (Correct answer)
• Floating ground system
• Single-point grounding (SPG)
• Ungrounded delta system

Correct answer: Mesh bonding network (MBN) / signal reference grid

A mesh bonding network or signal reference grid equalizes potential across all equipment frames, reducing EMI and protecting sensitive electronics.

Question 93: When a conflict arises between standard procedures and a unique situation in Regulatory Compliance & Licensing, what should a CSA professional prioritize?

• The preference of the client or stakeholder
• Safety and ethical obligations while seeking expert consultation (Correct answer)
• Strict adherence to written procedures without exception
• The most cost-effective solution available

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Regulatory Compliance & Licensing. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 94: A system administrator is asked to justify a hardware refresh by showing the cost over the asset's lifetime. Which financial concept best applies?

• Total Cost of Ownership (TCO) (Correct answer)
• Capital Expenditure (CapEx)
• Return on Investment (ROI)
• Net Present Value (NPV)

Correct answer: Total Cost of Ownership (TCO)

Total Cost of Ownership (TCO) accounts for all costs—purchase, maintenance, support, and disposal—over an asset's entire lifecycle.

Question 95: What is the benefit of updating the system after installation?

• To improve the visual interface.
• To increase system speed.
• To apply the latest security patches and fixes.
• To ensure the system is compatible with the network.

System updates, especially immediately after installation, are vital for applying the latest security patches, bug fixes, and performance enhancements. This protects the server from newly discovered vulnerabilities and ensures optimal operation. Regularly updating significantly reduces the risk of security breaches and system instability.

Question 96: Under GDPR, which legal basis allows an organization to process personal data without explicit user consent when it is necessary to fulfill a contract with that individual?

• Legitimate interest
• Contractual necessity (Correct answer)
• Vital interests
• Legal obligation

Correct answer: Contractual necessity

Article 6(1)(b) of GDPR permits processing when it is necessary for the performance of a contract to which the data subject is party.

Question 97: A CSA discovers that two IT team members are in an ongoing interpersonal conflict that is affecting team productivity. What is the correct first step?

• Formally document both employees for disciplinary action
• Ignore the situation unless it escalates further
• Meet with each employee individually to understand their perspective (Correct answer)
• Separate the employees into different shifts immediately

Correct answer: Meet with each employee individually to understand their perspective

Individual meetings allow the manager to gather unbiased perspectives before attempting mediation or resolution.

Question 98: Which software licensing model grants the user rights to use, study, modify, and distribute the software and its source code freely?

• Open-source license (Correct answer)
• Proprietary license
• Freeware license
• Shareware license

Correct answer: Open-source license

Open-source licenses (e.g., GPL, MIT, Apache) explicitly grant users the four fundamental freedoms including use, study, modification, and redistribution.

Question 99: Under OBRA 1987, the use of antipsychotic medications in nursing facility residents requires:

• A documented clinical indication, gradual dose reduction attempts, and monitoring for side effects (Correct answer)
• Only a verbal order from the attending physician
• Automatic discontinuation after 30 days regardless of clinical response
• Family consent as the sole prerequisite for administration

Correct answer: A documented clinical indication, gradual dose reduction attempts, and monitoring for side effects

OBRA mandates that antipsychotics have a documented clinical indication, that gradual dose reductions be attempted unless clinically contraindicated, and that residents be monitored for adverse effects.

Question 100: After applying an Update Set, an administrator notices that a changed UI Policy is not behaving correctly in production. What should be verified first?

• Whether the UI Policy table has been purged
• Whether the Update Set was committed successfully without errors (Correct answer)
• Whether the production instance has been restarted
• Whether all users have cleared their browser cache

Correct answer: Whether the Update Set was committed successfully without errors

If an Update Set commit encounters errors or skips records, changes may be incomplete, making it the first thing to verify after unexpected behavior.

Question 101: Which metric measures how quickly an IT investment recovers its initial cost from net benefits?

• Net Present Value (NPV)
• Internal Rate of Return (IRR)
• Earnings Before Interest and Taxes (EBIT)
• Payback Period (Correct answer)

Correct answer: Payback Period

The payback period calculates how long it takes for cumulative net benefits to equal the initial investment cost.

Question 102: What is the primary purpose of a hot site in disaster recovery planning?

• To serve as a data staging area during normal operations
• To reduce the cost of primary datacenter hardware
• To provide a fully operational duplicate environment with minimal failover time (Correct answer)
• To store archived tape backups offsite

Correct answer: To provide a fully operational duplicate environment with minimal failover time

A hot site is a fully equipped, always-on duplicate facility that allows near-immediate failover during a disaster.

Question 103: Which ServiceNow feature automatically redirects users to a maintenance page when a scheduled downtime window is active?

• Outage Window
• Safe Mode
• Read-Only Mode
• Maintenance Mode (Correct answer)

Correct answer: Maintenance Mode

Maintenance Mode halts normal operation and displays a configurable maintenance message to all non-admin users.

Question 104: When must a facility notify a resident or their legal representative of a room or roommate change?

• Only if the change is permanent
• Immediately after the change occurs
• At least 30 days before, except in emergencies (Correct answer)
• Within 24 hours after the decision is made

Correct answer: At least 30 days before, except in emergencies

Federal regulations require at least 30-day advance notice of room or roommate changes unless an emergency exception applies.

Question 105: An administrator is required to report a medication error that caused serious harm to a resident. Under OBRA regulations, this report must be made to:

• Only the attending physician and the family
• The state survey agency and, if applicable, the ombudsman program (Correct answer)
• The pharmacy that dispensed the medication
• The CDC national medication error database

Correct answer: The state survey agency and, if applicable, the ombudsman program

Serious adverse events, including harmful medication errors, must be reported to the state survey agency and potentially the long-term care ombudsman per OBRA requirements.

Question 106: IT leadership presents three cloud pricing options: reserved instances, on-demand, and spot instances. Which is typically most cost-effective for predictable, steady-state workloads?

• Reserved instances (Correct answer)
• On-demand instances
• Spot instances
• Burstable instances

Correct answer: Reserved instances

Reserved instances offer significant discounts (up to 72%) over on-demand pricing in exchange for a 1- or 3-year commitment, ideal for steady workloads.

Question 107: In Financial Management & Budgeting, what is the FIRST step a CSA professional should take when encountering a new case or situation?

• Consult with a supervisor before taking any action
• Implement an immediate solution based on past experience
• Conduct a comprehensive assessment and gather all relevant information (Correct answer)
• Document the situation and wait for further instructions

Correct answer: Conduct a comprehensive assessment and gather all relevant information

In Financial Management & Budgeting, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified System Administrator practice.

Question 108: A resident who speaks limited English needs to discuss their care plan. The facility's best practice is to:

• Simplify the conversation and use gestures instead
• Ask a bilingual family member to interpret all medical information
• Use a qualified medical interpreter or translation service (Correct answer)
• Postpone the care plan meeting indefinitely

Correct answer: Use a qualified medical interpreter or translation service

Using a qualified medical interpreter ensures accurate communication and protects the resident's right to understand their care.

Question 109: How does risk management apply to daily practice in Resident Rights & Advocacy for Certified System Administrator professionals?

• By avoiding high-risk situations entirely
• Through annual safety audits exclusively
• Through proactive identification of potential hazards and implementation of preventive measures (Correct answer)
• Only through responding to incidents after they occur

Correct answer: Through proactive identification of potential hazards and implementation of preventive measures

Effective risk management in Resident Rights & Advocacy requires proactive hazard identification and preventive measures, not just reactive responses. This approach reduces incidents, improves outcomes, and protects both professionals and clients.

Question 110: Which hand hygiene method is recommended by the CDC to eliminate Clostridioides difficile (C. diff) spores?

• Soap and water handwashing for at least 20 seconds (Correct answer)
• Alcohol-based hand rub applied for at least 20 seconds
• Antiseptic wipes followed by an alcohol-based hand rub
• Alcohol-based hand rub with chlorhexidine additive

Correct answer: Soap and water handwashing for at least 20 seconds

Alcohol-based hand rubs do not effectively kill C. diff spores; soap and water physically removes them from the hands.

Question 111: A healthcare organization using a cloud EHR system must ensure their cloud provider signs which specific HIPAA document before sharing protected health information?

• Non-Disclosure Agreement (NDA)
• Service Level Agreement (SLA)
• Business Associate Agreement (BAA) (Correct answer)
• Data Processing Agreement (DPA)

Correct answer: Business Associate Agreement (BAA)

HIPAA requires covered entities to execute a Business Associate Agreement (BAA) with any vendor that creates, receives, maintains, or transmits PHI on their behalf.

Question 112: What is the '3-2-1 backup rule'?

• Three full backups, two differentials, one incremental per week
• Three encryption layers, two authentication factors, one offsite key
• Keep 3 copies of data, on 2 different media types, with 1 copy offsite (Correct answer)
• Three backups taken daily, two weekly, one monthly

Correct answer: Keep 3 copies of data, on 2 different media types, with 1 copy offsite

The 3-2-1 rule is an industry best practice: 3 total copies, stored on 2 different media, with at least 1 copy kept offsite.

Question 113: What minimum contact time with soap and water is recommended by the CDC for effective hand hygiene?

• 10 seconds
• 30 seconds
• 20 seconds (Correct answer)
• 60 seconds

Correct answer: 20 seconds

The CDC recommends scrubbing hands with soap and water for at least 20 seconds to effectively reduce microbial contamination.

Question 114: Which document formally requests approval to spend money on a specific IT project or purchase?

• Business Case / Capital Expenditure Request (Correct answer)
• Purchase Order (PO)
• Service Level Agreement (SLA)
• Statement of Work (SOW)

Correct answer: Business Case / Capital Expenditure Request

A business case or CapEx request presents the justification, costs, and expected benefits to gain financial approval for a project.

Question 115: A resident's roommate consistently plays the television loudly at night, disturbing sleep. What is the best advocacy action?

• Ignore the complaint since both residents have equal rights
• Facilitate a care conference to balance both residents' rights (Correct answer)
• Move the complaining resident without their input
• Tell the complaining resident to wear earplugs

Correct answer: Facilitate a care conference to balance both residents' rights

Staff must balance competing resident rights through communication, compromise, and care planning.