Question 1: When must a facility notify a resident or their legal representative of a room or roommate change?

• At least 30 days before, except in emergencies (Correct answer)
• Immediately after the change occurs
• Only if the change is permanent
• Within 24 hours after the decision is made

Correct answer: At least 30 days before, except in emergencies

Federal regulations require at least 30-day advance notice of room or roommate changes unless an emergency exception applies.

Question 2: A resident with dementia is prescribed a medication 'crushed and mixed with applesauce.' The administrator's oversight role includes verifying that:

• The family's preference to crush is sufficient authorization without clinical review
• The pharmacist has confirmed the medication is safe to crush and the consent is documented in the care plan (Correct answer)
• Crushing is only permitted for liquid-form medications
• Any medication can be crushed without checking with the pharmacist

Correct answer: The pharmacist has confirmed the medication is safe to crush and the consent is documented in the care plan

Not all medications are safe to crush (e.g., extended-release or enteric-coated formulations); pharmacist confirmation and care plan documentation are required before altering medication form.

Question 3: What is the purpose of disk cleanup in system maintenance?

• To optimize the network configuration.
• To delete all user files.
• To reset the system settings.
• To remove temporary files and free up space.

Disk cleanup is a maintenance task designed to identify and remove unnecessary files, such as temporary internet files, system error memory dumps, and recycle bin contents. This process frees up valuable disk space, which can improve system performance and prevent storage-related issues that might slow down the server.

Question 4: In agile QA, a 'Definition of Done' (DoD) primarily serves to:

• Define the sprint backlog prioritization order
• Limit the number of defects allowed per sprint
• Establish agreed-upon criteria that a user story must meet before it is considered complete (Correct answer)
• Replace all traditional test documentation

Correct answer: Establish agreed-upon criteria that a user story must meet before it is considered complete

The Definition of Done is a shared checklist of quality criteria—such as code review, testing, and documentation—that must be satisfied before a story is accepted.

Question 5: What is the PRIMARY purpose of continuing education requirements in Financial Management & Budgeting for CSA professionals?

• Maintaining current knowledge and competency as the field evolves (Correct answer)
• Earning additional credentials for career advancement
• Fulfilling mandatory regulatory requirements only
• Networking with other professionals in the field

Correct answer: Maintaining current knowledge and competency as the field evolves

Continuing education in Financial Management & Budgeting ensures professionals maintain current knowledge and skills as standards, technologies, and best practices evolve in the Certified System Administrator field.

Question 6: Which standard of practice is MOST important for ensuring quality in Quality Assurance Programs?

• Following evidence-based protocols while adapting to specific circumstances (Correct answer)
• Strictly adhering to the same procedure in every situation
• Minimizing documentation to focus on practical work
• Using the most advanced technology available regardless of need

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Evidence-based protocols provide a foundation of proven practices, but effective Certified System Administrator professionals must also adapt their approach based on specific circumstances and individual case needs within Quality Assurance Programs.

Question 7: What is the main purpose of conducting a tabletop exercise in disaster recovery planning?

• To test backup restoration speed across all production systems
• To benchmark RTO performance under real failure conditions
• To physically failover production workloads to the DR site
• To walk key personnel through simulated disaster scenarios and validate the DR plan without system disruption (Correct answer)

Correct answer: To walk key personnel through simulated disaster scenarios and validate the DR plan without system disruption

A tabletop exercise is a discussion-based simulation that identifies gaps in DR procedures without impacting live systems.

Question 8: An organization must comply with HIPAA and experiences a breach of ePHI due to a ransomware attack. What is the required breach notification timeline to HHS under the HIPAA Breach Notification Rule?

• Within 60 days of discovery of the breach (Correct answer)
• Within 24 hours of discovery
• Within 30 days of the calendar year end
• Within 72 hours of discovery

Correct answer: Within 60 days of discovery of the breach

The HIPAA Breach Notification Rule requires covered entities to notify HHS (and affected individuals) within 60 days of discovering a breach of unsecured ePHI.

Question 9: What is a disaster recovery plan?

• A security strategy to prevent data breaches.
• A method to enhance network performance.
• A backup strategy for data protection.
• A plan for recovering data and restoring operations after a disaster.

A disaster recovery plan (DRP) is a comprehensive, documented strategy for an organization to recover from a catastrophic event and resume normal operations. It outlines the procedures, resources, and responsibilities required to restore critical IT infrastructure, applications, and data. The primary goal of a DRP is to minimize downtime and data loss, ensuring business continuity in the face of unforeseen disasters.

Question 10: What does 'deduplication' accomplish in a backup system?

• Eliminates redundant data blocks so identical data is stored only once (Correct answer)
• Splits large backup files into smaller chunks for easier transport
• Compresses backup files using ZIP algorithms
• Mirrors backup data to two separate locations simultaneously

Correct answer: Eliminates redundant data blocks so identical data is stored only once

Deduplication identifies and stores only unique data blocks, significantly reducing backup storage requirements.

Question 11: Which file is used to configure JVM heap memory settings in a ServiceNow on-premise deployment?

• nodes.properties
• glide.properties
• system.properties
• wrapper.conf (Correct answer)

Correct answer: wrapper.conf

The wrapper.conf file contains JVM startup parameters including heap memory size settings for ServiceNow nodes.

Question 12: A resident who is cognitively capable must be offered the opportunity to participate in their own care plan conference. Under OBRA 87, what happens if the resident declines participation?

• The conference is cancelled until the resident agrees
• The ombudsman must attend in the resident's place
• The facility may proceed without the resident and document the declination (Correct answer)
• The physician must make all care decisions unilaterally

Correct answer: The facility may proceed without the resident and document the declination

If a capable resident declines to attend their care conference, the facility proceeds with the meeting and documents that the resident was offered the opportunity but chose not to participate.

Question 13: Which federal regulation governs the pharmaceutical services requirements in Medicare/Medicaid certified nursing facilities?

• 42 CFR Part 483 Subpart B (Correct answer)
• 29 CFR Part 1910
• 21 CFR Part 211
• 45 CFR Part 164

Correct answer: 42 CFR Part 483 Subpart B

42 CFR Part 483 Subpart B establishes the requirements for long-term care facilities, including pharmaceutical services standards.

Question 14: What documentation practice is considered essential in Financial Management & Budgeting within the Certified System Administrator field?

• Completing all documentation at the end of the workday
• Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
• Only documenting unusual events or complications
• Using shorthand notes that can be expanded later if needed

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Financial Management & Budgeting ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 15: When a conflict arises between standard procedures and a unique situation in Financial Management & Budgeting, what should a CSA professional prioritize?

• The preference of the client or stakeholder
• Strict adherence to written procedures without exception
• The most cost-effective solution available
• Safety and ethical obligations while seeking expert consultation (Correct answer)

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Financial Management & Budgeting. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 16: A tornado warning is issued while 50 employees are working in an open-plan office adjacent to the data center. What is the CORRECT immediate action?

• Evacuate the building and go to the parking lot
• Power down all servers before seeking shelter
• Direct employees to the designated interior shelter area away from windows immediately (Correct answer)
• Continue working until the warning becomes a watch

Correct answer: Direct employees to the designated interior shelter area away from windows immediately

Tornado protocol requires immediate movement of people to interior shelter away from windows; employee safety takes absolute priority over equipment.

Question 17: A facility manager is reviewing a cooling system and notes the 'approach temperature' of the cooling tower is increasing. What does this indicate?

• Cooling tower performance is degrading, likely due to fouling or scaling (Correct answer)
• Refrigerant leak in the chiller circuit
• Chilled water supply temperature is dropping below setpoint
• Condenser water flow rate has increased beyond design

Correct answer: Cooling tower performance is degrading, likely due to fouling or scaling

Approach temperature is the difference between leaving water temperature and ambient wet-bulb; an increase signals reduced heat transfer efficiency due to fouling.

Question 18: What is 'cohorting' in the context of infection control in a long-term care facility?

• Grouping infected residents together and assigning dedicated staff to care only for that group (Correct answer)
• Requiring all staff to wear full PPE throughout the entire facility during an outbreak
• Transferring all infected residents to a single isolation room regardless of diagnosis
• Canceling all group activities until the infection rate drops to zero

Correct answer: Grouping infected residents together and assigning dedicated staff to care only for that group

Cohorting groups residents with the same confirmed infection together and assigns dedicated staff to minimize the risk of cross-transmission to non-infected residents.

Question 19: In a risk-based testing strategy, test prioritization is determined by:

• The alphabetical order of test case IDs
• Randomly selecting modules to test first
• The personal preference of the lead tester
• The likelihood and impact of potential failures in each area (Correct answer)

Correct answer: The likelihood and impact of potential failures in each area

Risk-based testing prioritizes test effort toward areas with the highest probability of failure and the greatest business impact if a failure occurs.

Question 20: What is two-factor authentication (2FA)?

• Combining two forms of authentication for security.
• Requiring only a password.
• Using a fingerprint scanner alone.
• Using a username and password.

Two-factor authentication (2FA) enhances security by requiring users to provide two different types of credentials from distinct categories. These categories typically include something the user *knows* (like a password), something the user *has* (like a phone or token), and something the user *is* (like a fingerprint). By combining two of these factors, 2FA significantly reduces the risk of unauthorized access even if one factor is compromised.

Question 21: At the end of Q2, IT spending is at 60% of the annual budget. What does this suggest, and what should be investigated?

• The remaining 40% should be encumbered to prevent overspending
• Spending may be ahead of schedule; investigate whether projects are accelerating or costs are misclassified (Correct answer)
• The budget should immediately be cut by 10%
• Spending is perfectly on track; no action needed

Correct answer: Spending may be ahead of schedule; investigate whether projects are accelerating or costs are misclassified

At midyear (50% of the year), spending 60% of the budget suggests the pace is faster than planned, warranting a review of acceleration causes or reclassification issues.

Question 22: Which clone excluder type prevents sensitive data from being copied during an instance clone?

• Update Set Exclusions
• Property Filters
• Field Masks
• Data Preservers and Exclude Tables (Correct answer)

Correct answer: Data Preservers and Exclude Tables

Clone Data Preservers keep certain target records intact, while Exclude Tables prevent specific tables from being cloned from source.

Question 23: An organization's BCP requires that the IT team maintain contact with vendors during a disaster. Which document BEST formalizes vendor obligations during such events?

• Service Level Agreement (SLA) with disaster response provisions (Correct answer)
• Non-Disclosure Agreement (NDA)
• Master Service Agreement (MSA) only
• Memorandum of Understanding (MOU) with no binding terms

Correct answer: Service Level Agreement (SLA) with disaster response provisions

An SLA with explicit disaster response provisions legally binds the vendor to defined response times and support levels during declared emergencies.

Question 24: An IT team is adopting a new ticketing system. Which staff preparation strategy minimizes disruption during rollout?

• Provide hands-on training before go-live and designate super-users for peer support (Correct answer)
• Allow staff to self-learn the system during business hours
• Share a user manual via email the week before launch
• Roll out the system on a Friday afternoon to minimize weekday impact

Correct answer: Provide hands-on training before go-live and designate super-users for peer support

Pre-launch training combined with designated super-users ensures staff confidence and provides immediate peer support during transition.

Question 25: A resident's family requests that a specific herbal supplement be given to the resident. The administrator should ensure that:

• The supplement is refused automatically as it is not a prescription medication
• The family is allowed to administer the supplement independently without documentation
• The attending physician is notified and approves the supplement before it is administered (Correct answer)
• The supplement is added to the medication administration record without physician review

Correct answer: The attending physician is notified and approves the supplement before it is administered

All supplements, including herbal products, must be reviewed and approved by the attending physician before administration to assess for drug interactions and contraindications.

Question 26: What is the purpose of network segmentation in an enterprise environment?

• Reduce the number of IP addresses required
• Eliminate the need for firewalls
• Contain breaches by limiting lateral movement between network zones (Correct answer)
• Increase total network bandwidth

Correct answer: Contain breaches by limiting lateral movement between network zones

Segmentation divides the network into zones so that a compromised system cannot freely reach other segments, limiting the blast radius of a breach.

Question 27: What is the role of an intrusion detection system (IDS)?

• To block incoming traffic.
• To enhance system performance.
• To encrypt network traffic.
• To detect unauthorized access and alert administrators.

An Intrusion Detection System (IDS) is designed to monitor network or system activities for malicious activity or policy violations. Its primary role is to identify potential security breaches, such as unauthorized access attempts or malware, and then alert administrators to these events. Unlike an Intrusion Prevention System (IPS), an IDS typically focuses on detection and alerting rather than actively blocking traffic.

Question 28: Which ServiceNow feature automatically redirects users to a maintenance page when a scheduled downtime window is active?

• Maintenance Mode (Correct answer)
• Read-Only Mode
• Safe Mode
• Outage Window

Correct answer: Maintenance Mode

Maintenance Mode halts normal operation and displays a configurable maintenance message to all non-admin users.

Question 29: A ServiceNow administrator needs to schedule a recurring job to clean up old log entries every Sunday at 2 AM. Which feature should they use?

• Scheduled Job (Correct answer)
• Business Rule
• Flow Designer
• Script Include

Correct answer: Scheduled Job

Scheduled Jobs in ServiceNow allow administrators to run scripts or workflows at defined intervals, such as weekly at a specific time.

Question 30: A technician notices vibration in a pump during operation. Which diagnostic tool is best suited to analyze this issue?

• Multimeter
• Vibration analyzer (Correct answer)
• Thermal imaging camera
• Ultrasonic thickness gauge

Correct answer: Vibration analyzer

A vibration analyzer measures frequency and amplitude of vibrations to diagnose mechanical issues in rotating equipment.

Question 31: After applying an Update Set, an administrator notices that a changed UI Policy is not behaving correctly in production. What should be verified first?

• Whether the UI Policy table has been purged
• Whether all users have cleared their browser cache
• Whether the production instance has been restarted
• Whether the Update Set was committed successfully without errors (Correct answer)

Correct answer: Whether the Update Set was committed successfully without errors

If an Update Set commit encounters errors or skips records, changes may be incomplete, making it the first thing to verify after unexpected behavior.

Question 32: What is the PRIMARY purpose of continuing education requirements in Resident Rights & Advocacy for CSA professionals?

• Networking with other professionals in the field
• Maintaining current knowledge and competency as the field evolves (Correct answer)
• Earning additional credentials for career advancement
• Fulfilling mandatory regulatory requirements only

Correct answer: Maintaining current knowledge and competency as the field evolves

Continuing education in Resident Rights & Advocacy ensures professionals maintain current knowledge and skills as standards, technologies, and best practices evolve in the Certified System Administrator field.

Question 33: A sysadmin is evaluating whether to repair aging servers or replace them. The money already spent on those servers should be ignored in this decision. This concept is called:

• Opportunity cost
• Fixed cost
• Sunk cost (Correct answer)
• Variable cost

Correct answer: Sunk cost

Sunk costs are past expenditures that cannot be recovered and should not influence future investment decisions.

Question 34: Which compliance standard specifically addresses security controls for organizations processing, storing, or transmitting cardholder data?

• SOC 2
• PCI DSS (Correct answer)
• ISO 27001
• NIST CSF

Correct answer: PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) was established by major card brands specifically to protect cardholder data environments.

Question 35: A resident with capacity wants to leave the facility against medical advice (AMA). Staff should:

• Call the family to physically restrain the resident
• Lock the exit doors temporarily
• Provide required information, have them sign AMA documentation, and allow them to leave (Correct answer)
• Physically prevent the resident from leaving

Correct answer: Provide required information, have them sign AMA documentation, and allow them to leave

A cognitively capable resident has the right to leave AMA; staff must inform them of risks and document but cannot forcibly detain them.

Question 36: Under federal regulations, within how many days of a resident's admission must the initial comprehensive care plan be completed?

• 30 days
• 7 days
• 21 days (Correct answer)
• 14 days

Correct answer: 21 days

Federal regulations at 42 CFR §483.21 require the comprehensive care plan to be completed within 21 days of admission.

Question 37: The administrator's role in the facility's pharmacy services agreement is to ensure the contract includes provisions for:

• Exclusive use of the contracted pharmacy's brand-name drugs only
• Eliminating the need for internal medication storage by delivering per dose
• Pharmacy staff to perform all medication administration tasks
• Emergency medication access, MRR services, and timely delivery standards (Correct answer)

Correct answer: Emergency medication access, MRR services, and timely delivery standards

The pharmacy services agreement must address emergency medication availability, consultant pharmacist MRR services, and timely delivery to meet CMS requirements.

Question 38: An organization running Red Hat Enterprise Linux wants to remain compliant. After adding 10 new servers, the administrator should primarily:

• Download additional ISO files from Red Hat's website
• Purchase additional subscription entitlements and attach them via Red Hat Subscription Manager (Correct answer)
• Apply for an open-source waiver from Red Hat
• Migrate workloads to CentOS Stream instead

Correct answer: Purchase additional subscription entitlements and attach them via Red Hat Subscription Manager

RHEL uses a subscription model; each system must be registered and attached to a valid subscription entitlement through Red Hat Subscription Manager (RHSM).

Question 39: The CDC's National Healthcare Safety Network (NHSN) is used primarily for which purpose in long-term care facilities?

• Documenting resident medication administration records
• Scheduling staff infection control training and competency testing
• Tracking and reporting healthcare-associated infections to meet federal surveillance requirements (Correct answer)
• Submitting payroll data for CMS quality bonus programs

Correct answer: Tracking and reporting healthcare-associated infections to meet federal surveillance requirements

NHSN is the CDC's surveillance system used by healthcare facilities, including long-term care, to track and report HAIs and antimicrobial use data to meet federal reporting requirements.

Question 40: A defect severity rating of 'Critical' typically means:

• The defect affects minor features with a workaround available
• The defect has been deferred to the next release cycle
• The defect causes a system crash or complete loss of a core function with no workaround (Correct answer)
• The defect is cosmetic and does not affect functionality

Correct answer: The defect causes a system crash or complete loss of a core function with no workaround

A Critical severity defect renders the system or a major feature completely non-functional with no acceptable workaround, requiring immediate resolution.

Question 41: Which technology allows backup software to create a consistent backup of open files and databases on Windows systems without interrupting access?

• File locking
• NTFS journaling
• Volume Shadow Copy Service (VSS) (Correct answer)
• BitLocker encryption

Correct answer: Volume Shadow Copy Service (VSS)

VSS coordinates with applications to create point-in-time shadow copies of volumes, enabling consistent backups of open and in-use files.

Question 42: What is the purpose of the 'Node list' in a ServiceNow clustered deployment?

• It enumerates database replica servers
• It shows all users logged into the instance
• It displays all active application nodes and their current status (Correct answer)
• It lists all installed plugins

Correct answer: It displays all active application nodes and their current status

The Node list (System Diagnostics > Node list) shows all cluster nodes, their health, and load distribution metrics.

Question 43: In long-term care, 'advance care planning' documentation such as a POLST form primarily communicates which information?

• The facility's emergency evacuation procedures
• The physician's billing codes for skilled services
• The resident's medical treatment preferences for end-of-life or serious illness (Correct answer)
• The resident's financial assets and insurance coverage

Correct answer: The resident's medical treatment preferences for end-of-life or serious illness

A POLST (Physician Orders for Life-Sustaining Treatment) form translates a resident's wishes about CPR, hospitalization, and other interventions into actionable medical orders.

Question 44: A facility receives a surveyor citation related to medication labeling. The MOST likely root cause an administrator should investigate is:

• Resident refusal to accept labeled medications
• Medications dispensed without resident name, drug name, strength, dose, and directions (Correct answer)
• The pharmacy's failure to supply medications on time
• Inadequate nursing documentation of medication effectiveness

Correct answer: Medications dispensed without resident name, drug name, strength, dose, and directions

Proper medication labeling must include the resident's name, drug name, strength, dose, frequency, and route; omissions in these elements are the most common labeling citation.

Question 45: When conducting an annual performance review for an IT staff member, which approach aligns with best practices?

• Base the review primarily on supervisor impressions
• Focus exclusively on recent incidents or accomplishments
• Evaluate performance against pre-established, measurable objectives (Correct answer)
• Compare the employee's performance to team averages

Correct answer: Evaluate performance against pre-established, measurable objectives

Reviews grounded in pre-set measurable objectives are objective, fair, and legally defensible.

Question 46: Which license type is most appropriate for an organization that wants to use open-source software in a proprietary product without being required to release their modifications?

• GNU AGPL v3
• GNU LGPL v3
• GNU GPL v2
• MIT License (Correct answer)

Correct answer: MIT License

The MIT License is a permissive open-source license that allows incorporation into proprietary software without requiring disclosure of modifications.

Question 47: What is the primary purpose of Standard Precautions in a healthcare or long-term care setting?

• To apply protective measures exclusively to immunocompromised residents
• To isolate only patients confirmed to have infectious diseases
• To replace the need for hand hygiene when gloves are worn
• To reduce the risk of transmission of infectious agents by treating all blood and body fluids as potentially infectious (Correct answer)

Correct answer: To reduce the risk of transmission of infectious agents by treating all blood and body fluids as potentially infectious

Standard Precautions treat all blood and body fluids as potentially infectious, protecting both residents and staff regardless of known infection status.

Question 48: When a nursing facility resident with diabetes has a blood glucose reading of 55 mg/dL, what is the IMMEDIATE appropriate dietary response by staff?

• Provide a full meal immediately regardless of mealtime schedule
• Document the reading and wait for the next scheduled meal
• Withhold all food and call the physician first
• Administer 15 grams of fast-acting carbohydrate (e.g., juice) per hypoglycemia protocol (Correct answer)

Correct answer: Administer 15 grams of fast-acting carbohydrate (e.g., juice) per hypoglycemia protocol

A blood glucose of 55 mg/dL indicates hypoglycemia; the standard '15-15 rule' calls for immediate administration of 15 grams of fast-acting carbohydrate and recheck in 15 minutes.

Question 49: Your organization's fiscal year ends December 31. You need a new storage array but budget is nearly exhausted. The vendor offers delivery in January. What budget concept is most relevant?

• Budget carryover
• Budget surplus
• Accrual cutoff (Correct answer)
• Encumbrance accounting

Correct answer: Accrual cutoff

The accrual cutoff determines which fiscal period an expense belongs to; delivery in January means the expense hits next year's budget.

Question 50: A company moves its on-premises servers to a cloud provider and shifts the related costs from CapEx to OpEx. What is the primary financial benefit of this shift?

• Costs become tax-exempt
• Large upfront capital is replaced with predictable monthly operating expenses (Correct answer)
• Depreciation periods are eliminated permanently
• Hardware assets appear on the balance sheet

Correct answer: Large upfront capital is replaced with predictable monthly operating expenses

Moving to OpEx replaces large capital outlays with recurring, predictable expenses that are fully deductible in the period incurred.

Question 51: IT leadership presents three cloud pricing options: reserved instances, on-demand, and spot instances. Which is typically most cost-effective for predictable, steady-state workloads?

• Burstable instances
• Reserved instances (Correct answer)
• On-demand instances
• Spot instances

Correct answer: Reserved instances

Reserved instances offer significant discounts (up to 72%) over on-demand pricing in exchange for a 1- or 3-year commitment, ideal for steady workloads.

Question 52: A system administrator wants to verify that all software installed on company systems is licensed. Which process best describes this ongoing compliance activity?

• Software asset management (SAM) (Correct answer)
• Vulnerability scanning
• Penetration testing
• Configuration baseline auditing

Correct answer: Software asset management (SAM)

Software Asset Management (SAM) is the practice of managing and optimizing the purchase, deployment, and retirement of software licenses within an organization.

Question 53: When a resident's legal guardian makes decisions the resident clearly opposes, staff should:

• Assess whether the resident has capacity and consult the care team and ethics committee if needed (Correct answer)
• Contact law enforcement immediately
• Always defer to the guardian without question
• Ignore the resident's objections since guardianship overrides all wishes

Correct answer: Assess whether the resident has capacity and consult the care team and ethics committee if needed

Staff should assess the resident's decision-making capacity and may involve an ethics committee when guardian decisions appear to conflict with the resident's known wishes.

Question 54: Which NIST framework function focuses on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

• Identify
• Respond
• Protect (Correct answer)
• Detect

Correct answer: Protect

The 'Protect' function in the NIST Cybersecurity Framework covers access control, awareness training, data security, and protective technologies.

Question 55: A facility administrator discovers that a resident's medication label does not match the prescriber's current order. The FIRST action should be to:

• Administer the medication as labeled and note the discrepancy
• Document the discrepancy in the resident's chart without further action
• Hold the medication and contact the pharmacy to clarify (Correct answer)
• Dispose of the incorrectly labeled medication immediately

Correct answer: Hold the medication and contact the pharmacy to clarify

When a label discrepancy is identified, the medication should be held and the pharmacy contacted immediately to resolve the error before administration.

Question 56: An administrator is required to report a medication error that caused serious harm to a resident. Under OBRA regulations, this report must be made to:

• The pharmacy that dispensed the medication
• Only the attending physician and the family
• The CDC national medication error database
• The state survey agency and, if applicable, the ombudsman program (Correct answer)

Correct answer: The state survey agency and, if applicable, the ombudsman program

Serious adverse events, including harmful medication errors, must be reported to the state survey agency and potentially the long-term care ombudsman per OBRA requirements.

Question 57: When cloning a ServiceNow instance, which data is typically EXCLUDED from the clone by default to protect sensitive information?

• Knowledge base articles
• Incident records
• User credentials and MID Server configurations (Correct answer)
• Change request records

Correct answer: User credentials and MID Server configurations

Instance clones typically exclude user passwords and MID Server credentials by default to prevent security breaches in non-production environments.

Question 58: During maintenance, an administrator needs to put the instance in maintenance mode to prevent user logins. Which property controls this?

• glide.login.disable
• glide.instance.maintenance (Correct answer)
• glide.access.blocked
• glide.user.lockout

Correct answer: glide.instance.maintenance

Setting glide.instance.maintenance to true redirects users to a maintenance page and restricts access to admin accounts only.

Question 59: A company using Microsoft 365 E3 licenses discovers employees are also using Power BI Premium features. What compliance action is required?

• Submit a retroactive licensing waiver to Microsoft
• Upgrade affected users to E5 or purchase standalone Power BI Premium licenses (Correct answer)
• Disable Power BI access company-wide immediately
• No action needed—Power BI Premium is included in E3

Correct answer: Upgrade affected users to E5 or purchase standalone Power BI Premium licenses

Power BI Premium features are not included in Microsoft 365 E3; organizations must license users with E5 or dedicated Power BI Premium per-user licenses.

Question 60: Which of the following is considered a restraint under federal nursing home regulations?

• A lap tray used specifically for eating meals
• Call light placed within easy reach
• Side rails raised on both sides of the bed without therapeutic justification (Correct answer)
• A wheelchair with a standard footrest

Correct answer: Side rails raised on both sides of the bed without therapeutic justification

Bilateral full side rails can prevent a resident from voluntarily leaving bed and are classified as a physical restraint.

Question 61: A sysadmin compares the cost of hosting on-premises versus using a managed cloud service. The on-premises option requires paying staff salaries, power, and cooling. These are examples of:

• Sunk costs that should be excluded from the analysis
• Both direct and indirect costs that must be captured in a full cost comparison (Correct answer)
• Direct costs only
• Indirect costs only

Correct answer: Both direct and indirect costs that must be captured in a full cost comparison

A complete TCO comparison must include both direct costs (hardware, licenses) and indirect costs (staff time, power, cooling) for an accurate picture.

Question 62: Which federally mandated assessment tool must be completed for every resident admitted to a Medicare- or Medicaid-certified nursing facility in the US?

• UB-04 Claim Form
• HCAHPS Survey
• Resident Assessment Instrument (RAI) / MDS (Correct answer)
• OASIS-E

Correct answer: Resident Assessment Instrument (RAI) / MDS

The Resident Assessment Instrument (RAI), which includes the Minimum Data Set (MDS), is federally required for all residents in certified long-term care facilities.

Question 63: How does risk management apply to daily practice in Regulatory Compliance & Licensing for Certified System Administrator professionals?

• Through annual safety audits exclusively
• By avoiding high-risk situations entirely
• Only through responding to incidents after they occur
• Through proactive identification of potential hazards and implementation of preventive measures (Correct answer)

Correct answer: Through proactive identification of potential hazards and implementation of preventive measures

Effective risk management in Regulatory Compliance & Licensing requires proactive hazard identification and preventive measures, not just reactive responses. This approach reduces incidents, improves outcomes, and protects both professionals and clients.

Question 64: Which ServiceNow installation method allows multiple application nodes to share a single database instance?

• Standalone deployment
• Clustered deployment (Correct answer)
• High-availability deployment
• MID Server deployment

Correct answer: Clustered deployment

Clustered deployment connects multiple application nodes to one database, enabling load balancing and redundancy.

Question 65: A department head asks why their business unit is being billed for IT services they didn't explicitly request. The IT director explains this is a 'showback' model. What distinguishes showback from chargeback?

• Showback requires managerial approval; chargeback does not
• Showback transfers funds between departments; chargeback only reports costs
• Showback only reports allocated costs for visibility without actual fund transfers (Correct answer)
• Showback applies only to cloud costs; chargeback applies to on-premises

Correct answer: Showback only reports allocated costs for visibility without actual fund transfers

Showback reports cost allocations to business units for awareness, while chargeback actually transfers the funds from their budgets.

Question 66: MRSA stands for which of the following?

• Methicillin-Resistant Staphylococcus aureus (Correct answer)
• Multi-Resistant Staphylococcal Antibiotic
• Multi-Resistant Streptococcal Agent
• Methicillin-Resistant Salmonella aureus

Correct answer: Methicillin-Resistant Staphylococcus aureus

MRSA stands for Methicillin-Resistant Staphylococcus aureus, a strain of staph bacteria resistant to many common antibiotics including methicillin.

Question 67: A resident refuses to participate in a scheduled group activity. What is the correct staff response?

• Ask a family member to convince the resident to attend
• Report the refusal to the charge nurse immediately
• Require participation since it is on the care plan
• Honor the refusal and document it without pressure (Correct answer)

Correct answer: Honor the refusal and document it without pressure

Residents have the right to refuse any activity, and staff must respect that choice and document it.

Question 68: A resident with a do-not-resuscitate (DNR) order stops breathing. The correct staff action is:

• Begin CPR while waiting for a physician to confirm the DNR
• Call 911 immediately regardless of the DNR
• Ask family members present whether to perform CPR
• Follow the DNR order, provide comfort measures, and notify the charge nurse (Correct answer)

Correct answer: Follow the DNR order, provide comfort measures, and notify the charge nurse

A valid DNR order must be honored; staff provide comfort care and notify the nurse rather than initiating resuscitation.

Question 69: In ServiceNow, what does the MID Server facilitate?

• Direct database access for reporting
• User authentication via LDAP only
• Communication between the ServiceNow instance and resources on a local network (Correct answer)
• Load balancing between application nodes

Correct answer: Communication between the ServiceNow instance and resources on a local network

A MID Server acts as a proxy to enable the ServiceNow cloud instance to communicate securely with on-premise network resources.

Question 70: A resident asks to see their medical record. Under HIPAA, the facility must provide access:

• Only to the resident's legal guardian
• Within 30 days of the request, with a possible 30-day extension (Correct answer)
• Within 72 hours only in emergency situations
• Only with physician approval

Correct answer: Within 30 days of the request, with a possible 30-day extension

HIPAA grants residents the right to access their medical records within 30 days, extendable once by another 30 days.

Question 71: Under the Americans with Disabilities Act (ADA), a nursing facility must provide:

• Free private rooms for all residents
• Daily physician visits for all residents
• Reasonable accommodations to ensure equal access for residents with disabilities (Correct answer)
• Interpreters for every language spoken by residents

Correct answer: Reasonable accommodations to ensure equal access for residents with disabilities

The ADA requires facilities to make reasonable accommodations so residents with disabilities can access services and activities equally.

Question 72: When a conflict arises between standard procedures and a unique situation in Medication Management Oversight, what should a CSA professional prioritize?

• Strict adherence to written procedures without exception
• Safety and ethical obligations while seeking expert consultation (Correct answer)
• The preference of the client or stakeholder
• The most cost-effective solution available

Correct answer: Safety and ethical obligations while seeking expert consultation

Safety and ethics always take priority in Medication Management Oversight. When standard procedures don't adequately address a unique situation, consulting with experienced colleagues or supervisors ensures both safety and professional standards are maintained.

Question 73: In IT financial management, what does the term 'run the business' (RTB) spending refer to?

• Capital investments in new IT projects
• Vendor contract negotiations
• Costs to maintain and operate existing IT systems and services (Correct answer)
• R&D expenses for innovation projects

Correct answer: Costs to maintain and operate existing IT systems and services

Run-the-business (RTB) costs cover keeping existing systems operational—maintenance, support, licensing—as opposed to grow/transform-the-business projects.

Question 74: Under PCI DSS Requirement 10, what is the minimum log retention period organizations must maintain for audit logs?

• 3 years
• 30 days
• 12 months (Correct answer)
• 6 months

Correct answer: 12 months

PCI DSS Requirement 10.7 mandates that audit log history be retained for at least 12 months, with at least 3 months immediately available for analysis.

Question 75: Which of the following is a common CMS survey deficiency related to food and nutrition services in nursing facilities?

• Serving meals that are too hot
• Using too many registered dietitians
• Offering too many menu choices
• Failure to provide food that meets residents' needs or preferences (Correct answer)

Correct answer: Failure to provide food that meets residents' needs or preferences

One of the most frequently cited F-tags in nutrition surveys (F692–F694) involves failure to ensure residents receive food that meets their nutritional needs, preferences, and therapeutic diet orders.

Question 76: An organization wants to prevent users from accessing known malicious websites by blocking their domain names. Which service is best suited for this?

• DNS filtering / DNS sinkhole (Correct answer)
• Network IDS
• Proxy auto-configuration
• Web application firewall

Correct answer: DNS filtering / DNS sinkhole

DNS filtering intercepts DNS queries for malicious domains and returns a blocked or redirected response, preventing access before a connection is established.

Question 77: Which standard of practice is MOST important for ensuring quality in Regulatory Compliance & Licensing?

• Minimizing documentation to focus on practical work
• Using the most advanced technology available regardless of need
• Strictly adhering to the same procedure in every situation
• Following evidence-based protocols while adapting to specific circumstances (Correct answer)

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Evidence-based protocols provide a foundation of proven practices, but effective Certified System Administrator professionals must also adapt their approach based on specific circumstances and individual case needs within Regulatory Compliance & Licensing.

Question 78: A resident's roommate consistently plays the television loudly at night, disturbing sleep. What is the best advocacy action?

• Ignore the complaint since both residents have equal rights
• Move the complaining resident without their input
• Tell the complaining resident to wear earplugs
• Facilitate a care conference to balance both residents' rights (Correct answer)

Correct answer: Facilitate a care conference to balance both residents' rights

Staff must balance competing resident rights through communication, compromise, and care planning.

Question 79: In Medication Management Oversight, what is the FIRST step a CSA professional should take when encountering a new case or situation?

• Conduct a comprehensive assessment and gather all relevant information (Correct answer)
• Consult with a supervisor before taking any action
• Document the situation and wait for further instructions
• Implement an immediate solution based on past experience

Correct answer: Conduct a comprehensive assessment and gather all relevant information

In Medication Management Oversight, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified System Administrator practice.

Question 80: When preparing an IT budget for the next fiscal year, which expenditure type would a sysadmin classify as OpEx?

• Buying server hardware for a new data center
• Purchasing a new SAN storage array
• Acquiring perpetual software licenses
• Monthly cloud subscription fees for IaaS (Correct answer)

Correct answer: Monthly cloud subscription fees for IaaS

Monthly subscription fees are ongoing operational expenses (OpEx), not capital investments in long-lived assets.

Question 81: What is the recommended approach for promoting a configuration from a development instance to production in ServiceNow?

• Export the database and restore it in production
• Use Update Sets to capture and move changes between instances (Correct answer)
• Manually recreate configurations in production
• Use File-Based Import/Export

Correct answer: Use Update Sets to capture and move changes between instances

Update Sets record configuration changes and can be exported and imported across instances to promote changes safely.

Question 82: An employee approaches their manager to report feeling overwhelmed by their current workload. What is the manager's best immediate response?

• Acknowledge the concern and schedule a workload review meeting (Correct answer)
• Reassure the employee that all team members face the same pressure
• Escalate the issue directly to HR without speaking with the employee further
• Advise the employee to work overtime until the backlog clears

Correct answer: Acknowledge the concern and schedule a workload review meeting

Acknowledging the concern and scheduling a structured review demonstrates respect and allows for collaborative problem-solving.

Question 83: What is a 'bare-metal restore'?

• Migrating a virtual machine to a physical server
• Recovering a complete system including OS, applications, and data to new or wiped hardware (Correct answer)
• Restoring firmware to a network switch
• Restoring only user data files to an existing OS installation

Correct answer: Recovering a complete system including OS, applications, and data to new or wiped hardware

Bare-metal restore rebuilds an entire system from scratch onto hardware that has no existing OS or data.

Question 84: What must a facility do before implementing a chemical restraint (psychotropic medication) for a non-emergency behavioral symptom?

• Apply the medication and monitor for 48 hours before documenting
• Try non-pharmacological interventions first and obtain informed consent from the resident or representative (Correct answer)
• Notify the state survey agency in advance
• Obtain verbal permission from any staff member present

Correct answer: Try non-pharmacological interventions first and obtain informed consent from the resident or representative

CMS requires that non-pharmacological interventions be attempted first and that informed consent be obtained before using medications as chemical restraints.

Question 85: Which standard of practice is MOST important for ensuring quality in Resident Rights & Advocacy?

• Following evidence-based protocols while adapting to specific circumstances (Correct answer)
• Strictly adhering to the same procedure in every situation
• Using the most advanced technology available regardless of need
• Minimizing documentation to focus on practical work

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Evidence-based protocols provide a foundation of proven practices, but effective Certified System Administrator professionals must also adapt their approach based on specific circumstances and individual case needs within Resident Rights & Advocacy.

Question 86: What documentation practice is considered essential in Staff Management & Training within the Certified System Administrator field?

• Completing all documentation at the end of the workday
• Only documenting unusual events or complications
• Using shorthand notes that can be expanded later if needed
• Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Staff Management & Training ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 87: Staff discover that a resident's nephew has been withdrawing money from the resident's bank account without consent. This is:

• Only reportable if the amount exceeds a legal threshold
• Financial abuse requiring mandatory reporting to Adult Protective Services (Correct answer)
• Acceptable if the nephew claims the resident gave verbal permission
• A private family matter outside staff scope of practice

Correct answer: Financial abuse requiring mandatory reporting to Adult Protective Services

Unauthorized use of a resident's financial resources is financial abuse and must be reported to APS and facility management.

Question 88: When disposing of unused controlled substances in a long-term care facility, the regulatory requirement is to:

• Flush medications down the toilet after nursing home hours
• Allow the attending physician to take unused medications for reuse
• Witness the disposal with a second authorized staff member and document in the controlled substance log (Correct answer)
• Return all unused medications to the pharmacy without documentation

Correct answer: Witness the disposal with a second authorized staff member and document in the controlled substance log

Controlled substance disposal requires witnessed destruction by two authorized staff members with complete documentation in the controlled substance log to prevent diversion.

Question 89: Under OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030), the hepatitis B vaccination series must be offered free of charge to which employees?

• All employees with occupational exposure to blood or other potentially infectious materials (Correct answer)
• All employees, including administrative and dietary staff
• Only employees who have had a known exposure incident in the past 12 months
• Only licensed nursing staff who perform invasive procedures

Correct answer: All employees with occupational exposure to blood or other potentially infectious materials

OSHA requires employers to offer free hepatitis B vaccination to all employees with occupational exposure to blood or other potentially infectious materials, not just clinical staff.

Question 90: The interdisciplinary team (IDT) that develops a resident's care plan typically includes which of the following members?

• Administrator, maintenance director, and accountant
• State surveyors, ombudsman, and insurance representatives
• HR director, payroll staff, and marketing coordinator
• Nursing, social services, dietary, activities, and therapy staff (Correct answer)

Correct answer: Nursing, social services, dietary, activities, and therapy staff

The IDT for care planning includes clinical and supportive disciplines—nursing, social work, dietary, activities, and therapy—who each contribute to holistic resident care goals.

Question 91: What is the primary purpose of a Building Management System (BMS) in a facility?

• Monitor and control mechanical and electrical systems (Correct answer)
• Track inventory of supplies
• Process work order invoices
• Manage employee schedules

Correct answer: Monitor and control mechanical and electrical systems

A BMS centralizes monitoring and control of HVAC, lighting, fire safety, and other building systems.

Question 92: An IT manager wants to spread the cost of a $120,000 server over 5 years on the financial statements. Which accounting method achieves this?

• Accrual accounting
• Depreciation (Correct answer)
• Cash-basis accounting
• Amortization

Correct answer: Depreciation

Depreciation allocates the cost of a tangible asset (like a server) over its useful life on the income statement.

Question 93: A company's DR plan states that systems must be fully operational within 4 hours of a declared disaster. Which metric does this define?

• Service Level Agreement (SLA)
• Mean Time Between Failures (MTBF)
• Recovery Time Objective (RTO) (Correct answer)
• Recovery Point Objective (RPO)

Correct answer: Recovery Time Objective (RTO)

RTO defines the maximum acceptable time to restore systems and resume normal operations after a disaster.

Question 94: The California Consumer Privacy Act (CCPA) applies to for-profit businesses that meet which threshold related to personal information?

• Buy, sell, or share personal information of 100,000 or more consumers or households annually (Correct answer)
• Process personal data of more than 500 California residents per year
• Employ more than 50 California residents
• Have annual gross revenues exceeding $5 million

Correct answer: Buy, sell, or share personal information of 100,000 or more consumers or households annually

Under CCPA (as amended by CPRA), one qualifying threshold is buying, selling, or sharing personal information of 100,000 or more consumers or households per year.

Question 95: A ransomware attack encrypts all files on a file server including mapped network drives. Which backup configuration would best protect against this threat?

• Backups stored on immutable (WORM) or air-gapped media inaccessible to the compromised system (Correct answer)
• Daily incremental backups to a mapped network share
• Continuous data protection to a second on-premises server
• Weekly full backups to the same SAN volume

Correct answer: Backups stored on immutable (WORM) or air-gapped media inaccessible to the compromised system

Immutable or air-gapped backups cannot be altered or deleted by ransomware since the infected system has no write access to them.

Question 96: During budget planning, the IT team is told to start each cost category from zero and justify every dollar. What budgeting method is being used?

• Activity-based budgeting
• Incremental budgeting
• Rolling forecast budgeting
• Zero-based budgeting (Correct answer)

Correct answer: Zero-based budgeting

Zero-based budgeting requires justifying all expenses from scratch each period rather than basing them on prior-year spending.

Question 97: What is the purpose of the 'glide.db.pool.connections' system property in ServiceNow?

• It defines the memory allocated to the JVM
• It sets the number of active users allowed
• It configures the cache expiration interval
• It controls the number of database connections available to the application (Correct answer)

Correct answer: It controls the number of database connections available to the application

The glide.db.pool.connections property determines how many simultaneous database connections the instance can maintain.

Question 98: What documentation practice is considered essential in Resident Rights & Advocacy within the Certified System Administrator field?

• Completing all documentation at the end of the workday
• Only documenting unusual events or complications
• Using shorthand notes that can be expanded later if needed
• Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Resident Rights & Advocacy ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 99: A 'significant change in status assessment' (SCSA) must be completed when a resident experiences which of the following?

• A scheduled quarterly review date
• A minor cold lasting two days
• A major decline or improvement that is not expected to resolve (Correct answer)
• A routine medication change ordered by the physician

Correct answer: A major decline or improvement that is not expected to resolve

An SCSA is required when a resident shows a major, non-temporary decline or improvement in status that affects multiple areas of functioning.

Question 100: Which hand hygiene method is recommended by the CDC to eliminate Clostridioides difficile (C. diff) spores?

• Antiseptic wipes followed by an alcohol-based hand rub
• Alcohol-based hand rub applied for at least 20 seconds
• Alcohol-based hand rub with chlorhexidine additive
• Soap and water handwashing for at least 20 seconds (Correct answer)

Correct answer: Soap and water handwashing for at least 20 seconds

Alcohol-based hand rubs do not effectively kill C. diff spores; soap and water physically removes them from the hands.

Question 101: FISMA requires federal agencies to categorize their information systems using which framework to determine appropriate security controls?

• ISO 27001
• NIST FIPS 199 and SP 800-53 (Correct answer)
• CIS Controls
• COBIT 5

Correct answer: NIST FIPS 199 and SP 800-53

FISMA mandates use of FIPS 199 for categorizing systems as Low, Moderate, or High impact, then applying corresponding NIST SP 800-53 controls.

Question 102: The Children's Online Privacy Protection Act (COPPA) requires operators of websites directed at children under 13 to obtain verifiable parental consent before:

• Allowing any child to create an account
• Collecting, using, or disclosing personal information from children (Correct answer)
• Storing session cookies on children's devices
• Displaying any advertising to child users

Correct answer: Collecting, using, or disclosing personal information from children

COPPA mandates verifiable parental consent before collecting, using, or disclosing personal information from children under 13.

Question 103: Which document legally designates another person to make healthcare decisions when a resident loses capacity?

• Do-not-resuscitate order
• POLST form
• Living will
• Durable power of attorney for healthcare (Correct answer)

Correct answer: Durable power of attorney for healthcare

A durable power of attorney for healthcare (healthcare proxy) designates a specific person to make medical decisions on behalf of an incapacitated individual.

Question 104: An administrator wants to ensure a specific Script Include can only be called from server-side scripts, not client-side calls. Which property should be set?

• Active = false
• Client callable = false (Correct answer)
• Protection policy = Protected
• Accessible from = 'This application scope only'

Correct answer: Client callable = false

Setting 'Client callable' to false on a Script Include prevents it from being invoked via GlideAjax from client-side scripts.

Question 105: In Resident Rights & Advocacy, what is the FIRST step a CSA professional should take when encountering a new case or situation?

• Conduct a comprehensive assessment and gather all relevant information (Correct answer)
• Consult with a supervisor before taking any action
• Document the situation and wait for further instructions
• Implement an immediate solution based on past experience

Correct answer: Conduct a comprehensive assessment and gather all relevant information

In Resident Rights & Advocacy, a thorough initial assessment ensures all relevant factors are identified before deciding on an appropriate course of action. This systematic approach is fundamental to Certified System Administrator practice.

Question 106: Which standard of practice is MOST important for ensuring quality in Medication Management Oversight?

• Using the most advanced technology available regardless of need
• Strictly adhering to the same procedure in every situation
• Following evidence-based protocols while adapting to specific circumstances (Correct answer)
• Minimizing documentation to focus on practical work

Correct answer: Following evidence-based protocols while adapting to specific circumstances

Evidence-based protocols provide a foundation of proven practices, but effective Certified System Administrator professionals must also adapt their approach based on specific circumstances and individual case needs within Medication Management Oversight.

Question 107: Which quality principle states that defects are not distributed uniformly and tend to cluster in a small number of modules?

• Early testing principle
• Pesticide paradox
• Absence-of-errors fallacy
• Defect clustering (Pareto principle applied to defects) (Correct answer)

Correct answer: Defect clustering (Pareto principle applied to defects)

Defect clustering, often observed as the Pareto principle in testing, shows that roughly 80% of defects are found in about 20% of the modules.

Question 108: Which of the following best describes an administrator's responsibility during a CMS survey focused on medication management?

• Temporarily stopping medication administration during the survey period
• Ensuring all medication storage, documentation, and administration practices align with current regulations (Correct answer)
• Directing nursing staff to withhold medication records from surveyors
• Delegating all surveyor interactions to the Director of Nursing

Correct answer: Ensuring all medication storage, documentation, and administration practices align with current regulations

The administrator is responsible for facility-wide regulatory compliance, including ensuring medication practices meet CMS standards and that surveyors have appropriate access to records.

Question 109: When a long-term care facility uses an automated medication dispensing cabinet (ADC), the administrator must ensure that:

• Access is restricted by role, all transactions are logged, and override use is monitored and audited (Correct answer)
• Controlled substances are excluded from the ADC system entirely
• Pharmacy oversight is no longer needed because the ADC tracks all transactions automatically
• Any staff member with a PIN can access all medications to improve speed

Correct answer: Access is restricted by role, all transactions are logged, and override use is monitored and audited

ADCs must have role-based access controls, complete transaction audit trails, and administrative oversight of override usage to prevent diversion and errors.

Question 110: Under OBRA 1987, the use of antipsychotic medications in nursing facility residents requires:

• Automatic discontinuation after 30 days regardless of clinical response
• A documented clinical indication, gradual dose reduction attempts, and monitoring for side effects (Correct answer)
• Only a verbal order from the attending physician
• Family consent as the sole prerequisite for administration

Correct answer: A documented clinical indication, gradual dose reduction attempts, and monitoring for side effects

OBRA mandates that antipsychotics have a documented clinical indication, that gradual dose reductions be attempted unless clinically contraindicated, and that residents be monitored for adverse effects.

Question 111: What documentation practice is considered essential in Regulatory Compliance & Licensing within the Certified System Administrator field?

• Only documenting unusual events or complications
• Completing all documentation at the end of the workday
• Recording actions, observations, and outcomes in real-time or as close to the event as possible (Correct answer)
• Using shorthand notes that can be expanded later if needed

Correct answer: Recording actions, observations, and outcomes in real-time or as close to the event as possible

Real-time or near-real-time documentation in Regulatory Compliance & Licensing ensures accuracy, provides a contemporaneous record, and is considered the gold standard for professional accountability and legal defensibility.

Question 112: An IT project is estimated to cost $500,000 but is now forecasted to cost $650,000. The $150,000 difference is known as:

• Contingency reserve
• Scope creep cost
• Budget overrun / cost variance (Correct answer)
• Sunk cost

Correct answer: Budget overrun / cost variance

A cost variance (or budget overrun) is the difference between the planned budget and the revised forecast or actual cost.

Question 113: What minimum contact time with soap and water is recommended by the CDC for effective hand hygiene?

• 20 seconds (Correct answer)
• 10 seconds
• 30 seconds
• 60 seconds

Correct answer: 20 seconds

The CDC recommends scrubbing hands with soap and water for at least 20 seconds to effectively reduce microbial contamination.

Question 114: What is the purpose of network segmentation?

• To improve data encryption.
• To increase network bandwidth.
• To reduce the amount of data stored on a server.
• To enhance network security by limiting access to sensitive areas.

Network segmentation involves dividing a computer network into multiple smaller, isolated segments or subnets. The primary purpose of this strategy is to enhance network security by limiting the scope of potential breaches. By restricting communication between segments, an attacker who compromises one part of the network cannot easily move laterally to access sensitive areas, thus containing threats and reducing the attack surface.

Question 115: A CSA is evaluating whether to build internal training content or purchase an off-the-shelf course. Which factor most strongly favors building internally?

• The budget for training development is limited
• The required training has a one-time delivery need
• The training must reflect proprietary systems, processes, or organizational context (Correct answer)
• The topic is a widely-adopted industry standard skill

Correct answer: The training must reflect proprietary systems, processes, or organizational context

Custom internal content is justified when the subject matter is specific to the organization's own tools or processes that no vendor product covers.