Free CMA sample questions

Correct answer: Two separate production instances: one for standard ITSM and one dedicated to the validated GxP application.

For highly regulated environments like GxP, physical instance separation is the gold standard. It provides a distinct validation boundary, simplifies audit processes, and ensures that changes to the non-GxP instance (e.g., ITSM upgrades) do not trigger a re-validation event for the sensitive Drug Trial Management application. While more costly, this approach provides the strongest compliance posture. Domain separation offers logical separation but shares the same physical database and application nodes, which is often insufficient for stringent GxP validation. A single instance with separate scopes is a weaker form of logical separation. Using non-production instances for production GxP data is a direct violation of compliance principles.

Correct answer: A federated model with a global CCoE for platform standards and regional governance boards for local policy implementation.

A federated governance model is the most appropriate for this complex scenario. It allows a global Center of Excellence (CCoE) to establish core platform standards, architectural principles, and data models, ensuring consistency and maintainability. Simultaneously, it empowers regional governance boards to define and implement policies specific to their local regulatory and business requirements (like GDPR). This strikes the necessary balance between central control and regional autonomy. A purely centralized model would fail to address regional needs, while a decentralized model would lead to fragmentation and loss of global standards.

Correct answers: Increase in employee productivity through self-service and automated workflows.; Acceleration of time-to-market for new digital products via automated development pipelines.

Executive audiences like a CIO are focused on strategic outcomes that impact the entire business. Increased employee productivity and accelerated speed-to-market for new products are high-level business value metrics. While MTTR and server uptime are important operational metrics for IT, they don't directly translate to top-line business growth or strategic advantage in the same way.

Executive audiences like a CIO are focused on strategic outcomes that impact the entire business. Increased employee productivity and accelerated speed-to-market for new products are high-level business value metrics. While MTTR and server uptime are important operational metrics for IT, they don't directly translate to top-line business growth or strategic advantage in the same way.

Correct answer: Engage ServiceNow to perform a comprehensive HealthScan and customization analysis.

Before any remediation plan can be created, a thorough and objective assessment of the instance's health is required. A ServiceNow-led HealthScan provides a structured analysis of customizations, performance, security, and deviations from best practice. This data-driven baseline is essential for prioritizing remediation efforts, quantifying the technical debt, and building a business case for the necessary changes. Freezing development or proposing a re-implementation are premature actions without this critical diagnostic data. Establishing a CCoE is a necessary future step, but the immediate need is to understand the scope of the problem.

Correct answer: False

In a federated model, the global CCoE's role is to set standards, define architecture patterns, and govern the platform's core. However, regional business units or development teams should own their respective backlogs to maintain agility and address local needs. The CCoE provides oversight and guidance, ensuring backlog items align with global standards, but does not manage the day-to-day backlog itself. This separation of concerns is a key principle of the federated approach.

Correct answer: Strict adherence to the Common Service Data Model (CSDM) from the initial deployment.

For a company with an aggressive M&A strategy, a standardized data model is paramount. Strict adherence to CSDM ensures that as new companies are acquired, their services, applications, and infrastructure can be mapped and onboarded into a consistent, well-understood framework. This dramatically simplifies data migration, service integration, and operational consolidation. Without a strong CSDM foundation, each acquisition would require a bespoke, complex, and costly integration project, hindering the company's growth strategy. The other options are tactical considerations, but CSDM is the foundational strategic enabler.

Correct answer: Adopt a phased 'System of Engagement' strategy. Use ServiceNow as an agile layer on top of existing systems, building the unified portal and IoT integrations first. For the mainframe, use an intermediary data store to stage batch data for near-real-time access, while creating a long-term plan for its eventual replacement.

This phased 'System of Engagement' approach is the most pragmatic and strategic. It acknowledges the mainframe constraint by creating a workable interim solution (intermediary data store) rather than letting it derail the project. It delivers value quickly through the unified portal, which helps win over skeptical business units. By acting as an agile layer, it avoids the high risk of a 'big bang' migration while still moving towards the goal of a unified platform. This strategy balances short-term wins with a long-term vision, addressing both the technical and organizational complexities of the transformation.

Correct answer: Configure the Now Mobile app with a Service Portal backend, utilizing applets for each service area.

The Now Mobile app is specifically designed for employee/end-user experiences, making it the ideal choice for students. By backing it with a well-designed Service Portal, the university can provide a unified front-end for requesting services from disparate departments (IT, facilities, etc.). Mobile applets can then be configured to expose these different services within the single Now Mobile application, creating the desired unified experience. The Agent app is for fulfillers, not end-users. A custom native app is overly complex and expensive when an out-of-the-box solution exists. The legacy mobile UI is deprecated.

Correct answers: Edge Encryption or Cloud Encryption to protect PHI data at rest.; Implementation of granular, context-aware Access Control Lists (ACLs).; Enabling comprehensive system logging and establishing a robust audit trail.

Protecting PHI requires a multi-layered security approach. Edge Encryption (or Cloud Encryption) is crucial for protecting the data itself, even from privileged users. Granular, context-aware Access Control Lists (ACLs) are essential to enforce the 'minimum necessary' principle of HIPAA, ensuring only authorized individuals can access specific PHI. Finally, comprehensive logging and auditing provide the necessary traceability to monitor who accessed what data and when, which is a core requirement for HIPAA compliance.

Protecting PHI requires a multi-layered security approach. Edge Encryption (or Cloud Encryption) is crucial for protecting the data itself, even from privileged users. Granular, context-aware Access Control Lists (ACLs) are essential to enforce the 'minimum necessary' principle of HIPAA, ensuring only authorized individuals can access specific PHI. Finally, comprehensive logging and auditing provide the necessary traceability to monitor who accessed what data and when, which is a core requirement for HIPAA compliance.

Protecting PHI requires a multi-layered security approach. Edge Encryption (or Cloud Encryption) is crucial for protecting the data itself, even from privileged users. Granular, context-aware Access Control Lists (ACLs) are essential to enforce the 'minimum necessary' principle of HIPAA, ensuring only authorized individuals can access specific PHI. Finally, comprehensive logging and auditing provide the necessary traceability to monitor who accessed what data and when, which is a core requirement for HIPAA compliance.

Correct answer: Propose a 'Configure, not Customize' approach, using workshops to map their processes to OOTB capabilities and identifying which 'unique' aspects provide true competitive advantage versus being legacy habits.

This response demonstrates strategic thinking. It acknowledges the stakeholder's needs while guiding them toward a sustainable solution. The architect's role is to challenge assumptions. By facilitating workshops, the architect can help the business distinguish between processes that are unique because they provide a competitive edge (and may warrant configuration/customization) and those that are simply 'the way it's always been done' (and should be adapted to best practice). This collaborative approach balances business needs with platform health and maintainability.