Question 1
A security manager is planning a penetration test of an internet-facing payment portal. What should be established FIRST before active testing begins?
Correct Answer:
Rules of engagement that define scope, authorization, timing, and prohibited actions
Explanation:
Rules of engagement provide formal authorization and define the boundaries, timing, contacts, and prohibited techniques for the test. They reduce legal and operational risk before intrusive activity starts.
Question 2
An organization wants the greatest auditor independence when evaluating controls operated by its own security department. Which approach is BEST?
Correct Answer:
Use an independent third-party assessor with no operational responsibility for the controls
Explanation:
An independent third-party assessor has the least operational conflict of interest and generally provides the strongest independence when evaluating controls run by the organization.
Question 3
A company has limited budget but needs frequent reviews of routine security controls. Which assessment strategy is MOST practical?
Correct Answer:
Use internal assessments for routine reviews and reserve external specialists for higher-risk or specialized work
Explanation:
Internal assessments are cost-effective for frequent routine reviews. External or third-party expertise can then be targeted where independence or specialized skills provide the most value.
Question 4
Before assessing a SaaS application, what is the MOST important planning step related to the cloud service provider?
Correct Answer:
Map control responsibilities using the contract and shared-responsibility model
Explanation:
Cloud assessments must identify which controls are operated by the customer and which by the provider. Contracts and the shared-responsibility model define the assessment boundary and evidence sources.
Question 5
A penetration test could disrupt a fragile production system. What is the BEST risk treatment during test planning?
Correct Answer:
Define safe test methods, maintenance windows, backups, and stop conditions in the rules of engagement
Explanation:
Fragile systems require explicit safeguards such as approved techniques, timing, recovery readiness, and stop conditions. This preserves useful testing while controlling operational risk.
Question 1
Exam overview

About this Exam

The CITI Program Biomedical Research course is the premier foundational training standard for individuals involved in human subject research within medical and clinical settings. Accredited by the Collaborative Institutional Training Initiative, this program provides a thorough understanding of the ethical principles, regulatory requirements, and operational best practices necessary to conduct biomedical clinical investigations safely and legally.

This certification is designed for a broad audience, including principal investigators, research coordinators, students, regulatory staff, and members of Institutional Review Boards (IRBs). Completing this training signifies that a researcher possesses the required knowledge to protect the rights, welfare, and safety of the human subjects participating in their studies.

More details

Additional Information

What the Course Entails and Exam Details

The CITI Biomedical Research course is comprised of a series of dedicated modules that cover the landscape of research ethics and federal regulations. While institutions can customize their required curriculum, the core syllabus universally includes critical foundational topics.

Students must engage with text-based content, case studies, and multimedia presentations within these modules. Each module is followed by a short assessment. The combined content prepares learners for the operational challenges of conducting compliant clinical trials.

Core Topics Covered:

  • The Belmont Report: Foundations of ethical principles (Respect for Persons, Beneficence, Justice).
  • Federal Regulations (The Common Rule): Comprehensive review of 45 CFR 46 and its subparts.
  • Informed Consent: The process, documentation requirements, and waivers.
  • Institutional Review Boards (IRBs): The role, structure, and review processes.
  • FDA-Regulated Research: Specific requirements for investigational drugs, devices, and biologics (21 CFR 50, 56).
  • Populations Requiring Additional Protections: Research involving prisoners, children, pregnant women, and the decisionally impaired.
  • Good Clinical Practice (GCP): Operational standards for designing, conducting, and reporting trials.
  • Privacy and Confidentiality: Distinguishing between privacy and confidentiality and understanding HIPAA implications.

 

What to Expect in the Final Exam

It is important to understand that the CITI Program operates differently from traditional proctored exams. There is rarely a singular, comprehensive "final exam" at the end of the entire course. Instead, your final score is derived from the accumulated results of individual module quizzes.

You must complete all required modules assigned by your affiliation to be eligible for certification.

Exam Format:

  • Quiz Type: All assessments are multiple-choice, focusing on applying regulatory concepts to practical scenarios.
  • Timing: The quizzes are not timed. You are encouraged to take your time and refer back to the module material if needed.
  • Passing Score: A minimum overall aggregate score of 80% is typically required by CITI to receive certification. However, be aware that your specific institution or university may set a higher passing standard.
  • Retake Policy: If you do not achieve a passing score on a specific quiz or the overall course, you are permitted to retake the quizzes until you reach the desired benchmark.

 

 How to Study and Exam Centers

Preparation for the CITI quizzes should focus on active engagement with the course material rather than intense memorization. The program is self-paced, allowing you to tailor your study schedule to your availability.

Actionable Study Strategies:

  • Engage Active Reading: Do not just skim the text. Take notes on key definitions, regulatory numbers (e.g., 45 CFR 46), and the specific responsibilities of researchers versus IRBs.
  • Utilize the Review Function: CITI quizzes often allow you to see which questions you answered incorrectly. Use this feedback immediately to go back to the module material and understand why the correct answer is correct before attempting a retake.
  • Focus on Scenarios: Many questions are scenario-based. Try to anticipate how the ethical principles (e.g., justice) apply to recruitment strategies mentioned in the text.
  • Pace Your Progress: Do not try to complete the entire course in one sitting. Tackling two or three modules per day allows for better retention and reduces cognitive fatigue.

Exam Centers:

You will not take the CITI quizzes at a physical testing center like Pearson VUE. The CITI Program is strictly an online portal.

You must create a CITI Program account and affiliate yourself with your specific institution (university, hospital, or research center). This affiliation ensures you are enrolled in the exact curriculum required by your employer or academic program. The final certificate is issued digitally and is readily verifiable by your institutional administrator.


 

 Job Opportunities from the Course

A CITI Biomedical Research certification is rarely a primary job qualification but is universally required before you can actively participate in human subject research. Possessing this certification confirms your regulatory compliance and significantly enhances your employability within the clinical research industry.

Specific Job Titles Enabled by CITI Certification:

  • Clinical Research Coordinator (CRC)
  • Principal Investigator (PI) / Co-Investigator (after advanced training)
  • Clinical Research Associate (CRA) / Monitor
  • Research Assistant / Research Associate
  • IRB Administrator / IRB Member
  • Clinical Trial Project Manager
  • Regulatory Affairs Specialist
  • Research Compliance Officer
  • Research Data Manager
  • Biostatistician (involved in trial design)
Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions