300-910 exam Questions - Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS) Updated: 2023

The following questions are representative of the types of questions you will find on the CRCM (Certified Regulatory Compliance Manager) exam.

1.  A borrower has a right to rescind a loan agreement in all of the following situations except:

a. A line of credit used for the borrower's business, secured by the borrower's primary  dwelling
b. A revolving line of credit secured by the borrower's primary dwelling used to Boost the borrower's home
c. An increase of a line of credit from $5,000 to $10,000 secured by the borrower's primary dwelling
d. A loan to pay off a contract for a deed secured by the borrower's primary dwelling

2.  When opening a deposit account online, Regulation E disclosures MUST be provided at the time of account opening or: 

a. Before the first EFT occurs 
b. Along with the first periodic statement 
c. Within three business days of account opening 
d. Within three business days of a customer's request for the EFT service

3.  The primary responsibility for overseeing a bank’s inherent compliance risk should lie with which of the following?

a. Internal audit
b. Consumers
c. Board of Directors
d. Compliance officer

4.   A branch manager finds an unexplained $7,000 cash shortage in Teller #1's cash drawer. Which of the following actions must the bank take?

a. File a Currency Transaction Report (CTR) with the IRS
b. Discharge Teller #1 immediately
c. Send a notice of adverse action to the bank's federal regulator
d. File a Suspicious Activity Report (SAR)

5.  A compliance professional recently discovered the bank did not file and disclose an accurate covered agreement, as required by the CRA Sunshine Act. In order to ensure correct reporting in the future, what must be provided? 

a. All individual mortgage loans 
b. Grants or loans to fulfill CRA activity 
c. Non-public or confidential information that will be provided in the public file 
d. A copy of the agreement to the regulatory agency 24 months after the end of the term

Answer Key

1. a
2. a
3. c
4. d
5. b

October 20, 2023, 10:47 AM EDT

It’s among the most widespread cyberattack campaigns of the year, but much remains unknown about the vulnerability, the scope of the impacts and how many attackers are actually involved.

As security teams and IT admins close out a week of grappling with widespread attacks targeting Cisco Systems IOS XE customers, many key details about the situation remain elusive.

And until more information surfaces, experts say it’ll be tough to fully get a handle on the threat, which compromised tens of thousands of  devices through exploitation of a critical vulnerability in the popular IOS XE networking software platform.

“In some ways, Cisco has been really amazing about sharing information,” said Caitlin Condon, head of vulnerability research at cybersecurity vendor Rapid7, in an interview.

[Related: Hackers Hit The IT Industry: 12 Companies Targeted In 2023]

For instance: Cisco provided a clear way to check for the presence of the attacker’s malicious implant, also known as a backdoor. And that is “one of the reasons why we understand prevalence as well as we do industry-wide right now,” Condon told CRN.

At the same time, there’s still a lot that’s unknown about the vulnerability, the scope of impacted devices, the motives behind the attacks and much more. “There’s quite a bit that is still either not known or not clear,” Condon said.

Cisco may hold the answers to some of the questions, while for other details it may take some time.

What we do know is that the Cisco IOS XE attacks are on track to be one of the most impactful attacks against IT hardware of the year, perhaps rivaling only the Barracuda Email Security Gateway attacks from mid-2023, Condon said.

With about two more months to go in 2023, “so far, I would say it’s those two,” she said of the Cisco and Barracuda attacks. And notably, both attacks targeted network hardware devices located on the edge of an organization’s IT setup.

CRN has reached out to Cisco for comment.

While examining what is and isn’t known about the IOS XE hacks, it’s worth underscoring an obvious point: Cisco is a huge company with a lot of technology under its roof.

“I think they’re probably running into what any large company runs into, where you don’t want to panic people,” Condon said. “But also, you do want to be transparent about, ‘Hey, there’s a problem here.’”

What follows are the seven biggest unanswered questions about the Cisco IOS XE attacks.

How soon could there be a patch?

First disclosed Oct. 16 by Cisco as a zero-day vulnerability, the privilege escalation flaw can enable a malicious actor to acquire complete control over a compromised device, the company has said. The vulnerability (tracked as CVE-2023-20198) has been awarded the maximum severity rating, 10.0 out of 10.0.

However, a patch to fix the vulnerability has yet to be made available. In a statement provided to CRN on Oct. 16, the tech giant said it is addressing the critical security issue “as a matter of top priority” and has been “working non-stop to provide a software fix.” An ETA on the patch has not been offered, though.

In one promising sign, researchers at cybersecurity firm Censys said Thursday that it appears the number of infected devices has peaked — at roughly 42,000— and the number of compromised devices is now declining as administrators take recommended measures.

“More than 5,400 Cisco XE devices have either removed their web interface from the internet, been taken offline, or had their configurations reset,” the researchers wrote. “However, Censys has identified 36,541 devices that remain online and compromised.”

How certain are we that the mitigations do the trick?

Cisco has said that an access restriction measure it has shared is effective at stopping exploits of the vulnerability in IOS XE.

The company has “high confidence” that “access lists applied to the HTTP Server feature to restrict access from untrusted hosts and networks are an effective mitigation,” Cisco said in an update to its advisory Oct. 17.

“I think a lot of people in these types of situations typically do want to be able to test for themselves: ‘Are the mitigation steps truly, completely effective?’” Condon said.

Security researchers would like to be able to check for additional attack vectors or potentially a modified attack chain that could still be effective, she said.

In other words, “are there other ways in?” Condon said. “I’m sure Cisco is doing their best. It seems like they’re trying to be transparent about this as quickly as they can. But if there were more information, we would be able to assess that.” And that would help with providing more information to defenders who are looking for guidance, she said.

Cyber defense teams are ultimately seeking “100 percent confirmation that we know what this is, we know how you mitigate it — and yes, we can confirm that [the mitigation] works,” Condon said. “That’s what they want to hear.”

What’s the full list of impacted devices?

Cisco has not provided the list of devices affected, meaning that any switch, router or WLC (Wireless LAN Controller) that’s running IOS XE and has the web user interface (UI) exposed to the internet is vulnerable, according to Mayuresh Dani, manager of threat research at cybersecurity firm Qualys.

That is a lengthy list, however. And so far, it’s not a list that actually has been released by Cisco.

Along with widely used enterprise switches in the Cisco Catalyst 9000 line, IOS XE also is used to run numerous other types of devices, many of which often run in edge environments that tend to get less attention than data center equipment. Those include branch routers, industrial routers and aggregation routers, as well as Catalyst 9100 access points and “IoT-ready” Catalyst 9800 wireless controllers.

But since there’s no comprehensive list of everything that runs IOS XE, many organizations are unclear on how, or even whether, they are impacted.

All in all, “it would be really helpful to have a list,” Condon said. “We can look at the datasheet and see these 20 things [that run IOS XE], but is that it? We don’t know.”

What is the full attack chain?

From what Cisco has disclosed so far, there’s not much that is known about the vulnerability itself, according to Condon.

For instance, “what exactly is the root cause? What does the attack chain look like?” she said. “The way they’ve described it is a little bit vague, which isn’t throwing shade at them. It just seems like maybe there’s still quite a bit about the exact attack chain that is not known. And that’s concerning.”

As one example, Cisco was upfront about the fact that there’s an additional mechanism involved in the attacks that they don’t fully understand yet. Cisco’s Talos threat intelligence team wrote in a post that a threat actor has been observed exploiting a previously patched vulnerability from 2021 (tracked at CVE-2021-1435) as part of installing a backdoor.

“We have also seen devices fully patched against CVE-2021-1435 getting the implant successfully installed through an as of yet undetermined mechanism,” the Talos blog said.

In other words, there’s some ambiguity in the attack chain that still needs to be cleared up.

For Condon, that raises questions such as, do you need both vulnerabilities? Or is one sufficient? “It sounds to me like they’re trying to be upfront about the fact that this is still an active investigation, and there’s stuff they don’t know.”

Can devices easily be re-compromised? 

As part of the IOS XE attacks, the implants installed by threat actors do not have what’s known as “persistence” on a device, meaning that it’s eliminated when a device is rebooted.

However, the accounts created by attackers are not removed, raising the question of whether they may continue to have administrator access even after a reboot.

And because the full attack chain is still unknown, a big question is whether a device can easily be re-compromised, Condon said. “Can it be re-implanted?”

Is it just a single threat actor behind the attacks?

In the intrusion investigated by Rapid7 researchers, the team has identified some variation in the techniques used, Condon noted. Additionally, the researchers also determined that in a few cases, a customer environment was exploited multiple times in the same day. The findings were disclosed in a post from Condon on the Rapid7 blog earlier this week.

“We can’t say for sure that this might be more than one threat actor, but that’s something that’s on our mind,” she told CRN. “It’s possible.”

Who is behind the attacks and what’s their motive?

There’s been no attribution for the attacks so far and little evidence about what the threat actor, or threat actors, are trying to accomplish.

“I’m sure that eventually, whether it takes weeks or longer, we’re going to have a better understanding of, here’s what the full attack chain was and here’s the threat actor or actors this was attributed to. And here’s what we think they were after,” Condon said. “I’m sure we’re going to see country names in some of these articles.”

In all likelihood, “we’re going to learn that this is a skilled attacker who had orchestrated this action, whether it’s one attacker or multiple who were using similar techniques,” she said.

However, Condon noted, “at this point we don’t even know what what the full attack chain looks like. And there’s no patch. The message, I think, to administrators of these devices is, get them off the internet, reboot and then look for indicators of compromise.”

ISA offers a variety of resources to help you prepare for the Certified Automation Professional (CAP^®) exam.

Primary Textbook

A Guide to the Automation Body of Knowledge is the primary text resource for the CAP exam and provides a complete overview of all technical topics. Order the Guide to the Automation Body of Knowledge.

Study Guide

The CAP Study Guide is a comprehensive self-study resource that contains a list of the CAP domains and tasks, 75 review Questions Answers complete with justifications. References that were used for each study guide question are also provided with the question. The Study Guide also includes a recommended list of publications that you can use to do further study on specific domains. Order the CAP Study Guide.

Review Courses

A CAP review course is available in several formats as preparation for taking the certification exam. This course is offered by ISA and can also be offered at your location.

ISA also has a variety of training courses that would be helpful in preparing for CAP. Visit the Automation Professional Training page for a complete list.

Additional Resources

Exam Topics

1. Basic Continuous Control: Process Instrumentation, Analytical Instrumentation, Continuous Control, Control Valves, Analog Communications, Control System Documentation, Control Equipment
2. Basic Discrete, Sequencing, and Manufacturing Control: Discrete Input & Output Devices and General Manufacturing Measurements, Discrete and Sequencing Control, Motor and Drive Control, Motion Control
3. Advanced Control Topics: Process Modeling, Advanced Process Control, Control of Batch Processes, Environmental, Environmental Monitoring, Building Automation
4. Reliability, Safety, and Electrical: Alarm Management, Reliability, Process Safety and Safety Instrumented Systems, Electrical Installations, Safe Use and Application of Electrical Apparatus
5. Integration and Software: Digital Communications, Industrial Networks, Manufacturing Execution Systems and Business Integration, System and Network Security, Operator Interface, Data Management, Software, Custom Software
6. Deployment and Maintenance: Operator Training, Checkout, System Testing, and Startup, Troubleshooting, Maintenance, Long-Term Support and System Management
7. Work Structure: Automation Benefits and Project Justifications, Project Management and Execution, Interpersonal Skills

CAP demo Questions

Questions on the exam were derived from the genuine practice of automation professionals as outlined in the CAP Role Delineation Study and job task analysis. Using interviews, surveys, observation, and group discussions, ISA worked with automation professionals to delineate critical job components to develop exam specifications to determine the number of questions related to each domain and task tested. This rigorous program development and ongoing maintenance process ensures that CAP certification accurately reflects the skills and knowledge needed to excel as an automation professional.

The following six questions were taken from the CAP exam question item bank and serve as examples of the question type and question content found on the CAP exam.

1. The method by which the tasks and hazards associated with a machine or process are analyzed is known as:
   • A. Risk assessment.
   • B. Machine assessment.
   • C. Risk reduction.
   • D. Risk abatement.
2. To test controller tuning or prototype new control strategies offline, the model should be a(an):
   • A. Tie-back (loopback) simulation.
   • B. Artificial neural network.
   • C. Dynamic process simulation.
   • D. Steady state process simulation.
3. The temperature measurement with the BEST repeatability and resolution is the:
   • A. Thermocouple.
   • B. Resistance temperature detector (RTD).
   • C. Dial thermometer.
   • D. Capillary system.
4. Which of the following is NOT a variable speed drive setup parameter?
   • A. Acceleration rate.
   • B. Motor winding type.
   • C. Output frequency.
   • D. Maximum speed.
5. A complete test plan for system integration testing MUST include:
   • A. Comments for the application programmer.
   • B. Multiple test cases for each mode of operation.
   • C. At least five test cases for each test.
   • D. Expected results for each test case.
6. Frequency of maintenance should be determined by:
   • A. Failure rates of components.
   • B. Availability of personnel and parts.
   • C. Management targets for efficiency and productivity.
   • D. Effectiveness of maintenance personnel.

Sample Questions Answer Key

Earning specialized certifications is a surefire way to advance your career in the IT field, regardless of industry or current career level. The right certification validates your skills and knowledge, which makes you more desirable to future employers who want to attract and retain the best employees. Below, we’ll explore the top IT certifications and share how to examine your goals to choose the right path forward. 

Updated By - Tanzim Hazarika

We independently evaluate all recommended products and services. If you click on links we provide, we may receive compensation. Learn more.

An exam proctor will begin memorizing exam instructions approximately 15 minutes before the exam start time. Students must be in the exam room with their exam at this time. If taking the exam on a laptop, it must be booted up and have passed the security check. Hand writers must not have a laptop with them in an exam room, unless otherwise allowed according to the professor’s instructions. A student entering the exam room after the proctor begins memorizing instructions will not receive additional time for booting up their laptop, passing the security check, and/or memorizing exam instructions.

When instructed by the proctor, write your exam number on the cover page of your exam, bluebooks, and any scratch paper you turn in as part of your exam. Handwritten exam answers must be written in blue books in blue or black ink. Number the bluebooks you use (1 of 1, 1 of 2, 2 of 2, etc.). Proctors will allow time to read the professor’s instructions. Other than counting the number of pages of the exam, students are not permitted to turn the page of an exam past the instructions page until the proctor instructs them to do so.

When taking a closed-book exam, no books, outlines, book bags, purses, or scratch paper (other than the scratch paper provided) may be at your seat during the exam. These items must be left outside of the exam room or in the front or sides of the exam room. Students may not begin to write anything, including on scratch paper, before the proctor begins a closed-book exam.

Students taking in-class exams are prohibited from having any electronic communication device, other than a laptop as allowed per the professor's instructions, during the exam. Cell phones and smart watches must be turned off during the exam and placed in a bag or backpack. Violations of this rule may be considered an Honor Code violation. A clock in each exam room will be the official timekeeper for the exam.

Non-alcoholic beverages are permitted in exam rooms; however, the container must have a lid.

After the exam instructions have been read and the exam begins, the proctor will remain in the room. Any student who has a question or problem during an exam should see the proctor.

Students may use the restroom or take a break during an exam. However, all exam materials must be left in the exam room and no additional time will be given. Students must sign in and out at the front of the room with the proctor.

Calculate How Much Life Insurance You Need

A no-exam life insurance policy may not be able to provide the full coverage amount you need, especially if you’re looking to cover many working years or the years of raising a family.

Before you start getting life insurance quotes, calculate how much life insurance you need. A no-exam policy alone may not be able to provide sufficient coverage.

Assess Your Chances Before You Apply

Getting life insurance without a long application process is appealing, but don’t jump into a no-exam life insurance application without understanding your chances of getting approved. Many no-exam policies require very good or excellent health for approval. A denial goes on your insurance record and could hinder future applications.

Don’t be surprised if you end up doing a more traditional application process, including a life insurance medical exam if you’ve had some health issues.

Look Beyond the Cost

Of course you don’t want to overpay for life insurance, but research more than cost. There are coverage options that can be very valuable long after you buy the policy, such as the option to convert term life to permanent life insurance. Also, look at whether there’s an accelerated death benefit, which gives you access to money from your own death benefit if you become terminally ill.

Be Truthful On the Application

No matter what type of life insurance you’re applying for, be thorough and truthful on the application.

“Pay attention to each question carefully and be ready to respond with information around specific medical conditions you have. Giving more detailed information will help streamline the process as well as get a more accurate underwriting decision,” says Tavan of Legal & General America.

Intentional misrepresentations can lead to application denials or, worse, denial of a claim after you pass away. Life insurance companies have many ways to verify application information. Technology on the backend allows them to verify data from additional sources.

Have a Plan in Case of a Rejection

If the company rejects you for no-exam life insurance because of your health, don’t give up your life insurance search. If you need life insurance, you likely have other routes.

• Be prepared to go through a more traditional underwriting process that involves a life insurance medical exam.
• Work with an experienced life insurance agent who can identify insurers known to be more friendly to your specific health conditions.
• An experienced life insurance agent can shop around your application anonymously so that you don’t risk another rejection.

Looking for traditional term life insurance? See Forbes Advisor’s ratings of the best term life insurance.