Isaca CISM Practice Test 1
Question 1
A multinational retailer has acquired regional chains whose store leaders use different security approval practices. A security manager has a defined assignment: identify which local behaviors weaken the common control model. Which action BEST fulfills that specific assignment?
- Translate the approved controls into local operating procedures and role-specific training
- Interview regional leaders and map actual exception practices before designing the integration
- Review exception frequency and completion of control milestones by region
- Present a business case linking prioritized security changes to store uptime and loss exposure
Explanation
Correct Answer
B:Observed decision behavior reveals gaps that a generic global policy cannot show. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Operational procedures translate policy into repeatable behavior. That action primarily serves the different objective to make new security requirements usable by store employees. It is not the step that directly satisfies the stated need to identify which local behaviors weaken the common control model.
C:Regional evidence shows whether the governance rollout works. That action primarily serves the different objective to evaluate whether store practices are converging toward the target. It is not the step that directly satisfies the stated need to identify which local behaviors weaken the common control model.
D:A business-aligned case explains why controls matter to revenue operations. That action primarily serves the different objective to gain support for security integration without ignoring retail operations. It is not the step that directly satisfies the stated need to identify which local behaviors weaken the common control model.
Question 2
A healthcare provider is opening clinics in jurisdictions with differing privacy, retention and breach-notification duties. The accountable executive now asks the team to identify obligations before deciding on one global retention setting. What should the security manager recommend?
- Map each obligation to a control owner and retained compliance evidence
- Trigger a privacy and security requirements review before patient records are collected
- Name compliance owners and a review cadence for each jurisdiction
- Create a jurisdiction-by-data-type obligations register reviewed with legal counsel
Explanation
Correct Answer
D:Documented requirements prevent a global default from violating a local obligation. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Traceability demonstrates how requirements are fulfilled. That action primarily serves the different objective to make evidence available for regulator inquiries. It is not the step that directly satisfies the stated need to identify obligations before deciding on one global retention setting.
B:Early assessment avoids retrofitting controls after processing begins. That action primarily serves the different objective to handle a proposed clinic expansion into a new jurisdiction. It is not the step that directly satisfies the stated need to identify obligations before deciding on one global retention setting.
C:Without owners legal changes may never reach the control framework. That action primarily serves the different objective to assign responsibility for tracking changing patient-data rules. It is not the step that directly satisfies the stated need to identify obligations before deciding on one global retention setting.
Question 3
A logistics company has separate security, IT operations and business risk committees that keep overruling one another. After reviewing the situation, the management objective is to clarify who can authorize acceptance of delivery-platform risk. Which response MOST directly addresses it?
- Assign the security committee oversight of risk while process owners implement controls
- Define business risk owner authority and escalation thresholds in a governance charter
- Roll up exposures, tolerance breaches and accountable owners into decision-ready reporting
- Escalate the documented residual risk to the designated senior risk authority
Explanation
Correct Answer
B:Business accountability cannot be replaced by an IT-only vote. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Independent oversight avoids self-approval of effectiveness. That action primarily serves the different objective to separate security oversight from operational execution. It is not the step that directly satisfies the stated need to clarify who can authorize acceptance of delivery-platform risk.
C:The board needs risk decisions rather than raw alert counts. That action primarily serves the different objective to inform the board without sending every technical defect. It is not the step that directly satisfies the stated need to clarify who can authorize acceptance of delivery-platform risk.
D:A local project lead cannot approve exposures above the established delegation. That action primarily serves the different objective to settle a disputed exception that exceeds delegated authority. It is not the step that directly satisfies the stated need to clarify who can authorize acceptance of delivery-platform risk.
Question 4
An insurer's board wants a cyber strategy for its transition from branch offices to online customer services. The updated digital strategy includes partner APIs and online identity onboarding that were absent from the branch-office plan. For the next governance decision, the team must connect the cyber strategy to the digital business strategy. Which choice BEST provides that outcome?
- Derive security outcomes from the online service roadmap and business risk appetite
- Present expected business benefits, risk exposure and alternative investment options
- Reapprove the branch-network security program unchanged while the online API roadmap is still being assessed
- Assign owners, milestones and financing for approved security initiatives
Explanation
Correct Answer
A:Strategy must support business objectives rather than tool preferences. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Executives approve defensible business tradeoffs, not an uncosted technology list. That action primarily serves the different objective to gain authorization for security strategy investments. It is not the step that directly satisfies the stated need to connect the cyber strategy to the digital business strategy.
C:Reapproval of the old branch-oriented strategy cannot establish the security objectives required by the current digital-service and partner roadmap. The strategy must derive outcomes from the new business direction.
D:Accountability and resources turn a strategy into delivery. That action primarily serves the different objective to translate strategy into accountable organizational execution. It is not the step that directly satisfies the stated need to connect the cyber strategy to the digital business strategy.
Question 5
A payments firm is adopting a common security framework across independently managed subsidiaries. The security program has been tasked specifically to select a governance framework without blindly inheriting every control. Which approach should be selected?
- Require authorized business risk owners to approve documented deviations
- Perform a gap assessment of the acquired control model before extending mandatory requirements
- Map framework objectives to business risks, obligations and existing control capabilities
- Report target control outcomes and independently assessed coverage gaps
Explanation
Correct Answer
C:Tailoring preserves relevance to enterprise conditions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Exception decisions remain accountable to the risk-taking business. That action primarily serves the different objective to allocate decision rights for framework exceptions. It is not the step that directly satisfies the stated need to select a governance framework without blindly inheriting every control.
B:Integration needs evidence of compatibility and unresolved risk. That action primarily serves the different objective to revisit the framework after a major acquisition. It is not the step that directly satisfies the stated need to select a governance framework without blindly inheriting every control.
D:Adoption is shown through results rather than the number of policies distributed. That action primarily serves the different objective to demonstrate framework adoption to directors. It is not the step that directly satisfies the stated need to select a governance framework without blindly inheriting every control.
Question 6
A university has too little capital to execute all proposed security initiatives before the academic year. A security manager has a defined assignment: determine which proposals deserve funding priority. Which action BEST fulfills that specific assignment?
- Bring a revised scope and investment justification to the appropriate sponsor
- Use capacity planning to identify needed skills and sequence hiring or outsourced support
- Use risk reduction, educational-service impact and dependencies to rank proposals
- Attach approved owners, milestones and measurable results to each funded initiative
Explanation
Correct Answer
C:Business consequences establish funding priority. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Material budget changes need a renewed decision. That action primarily serves the different objective to respond when an approved project's cost rises materially. It is not the step that directly satisfies the stated need to determine which proposals deserve funding priority.
B:People and capabilities are part of the program budget. That action primarily serves the different objective to address a projected staffing shortfall during implementation. It is not the step that directly satisfies the stated need to determine which proposals deserve funding priority.
D:Accountable plans prevent untracked spending. That action primarily serves the different objective to avoid funding a program with no accountable outcomes. It is not the step that directly satisfies the stated need to determine which proposals deserve funding priority.
Question 7
An industrial manufacturer is moving from a command-driven security culture to a cross-functional safety culture. The accountable executive now asks the team to understand why workers bypass the new cyber procedures. What should the security manager recommend?
- Enforce the documented exception and risk-acceptance escalation route
- Use interviews and workflow observations to identify pressure points before revising controls
- Track unsafe exception trends and the closure of worker-reported security issues
- Translate security policy into plant-specific instructions with visible leadership sponsorship
Explanation
Correct Answer
B:Unsafe workarounds can be caused by workflow conflicts. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A supervisor cannot silently bypass enterprise risk authority. That action primarily serves the different objective to respond to a supervisor who informally waives a critical control. It is not the step that directly satisfies the stated need to understand why workers bypass the new cyber procedures.
C:Behavior and response evidence provide stronger signals than attendance counts. That action primarily serves the different objective to measure whether the culture change is taking hold. It is not the step that directly satisfies the stated need to understand why workers bypass the new cyber procedures.
D:Local procedures need practical management backing. That action primarily serves the different objective to make requirements credible to shift supervisors. It is not the step that directly satisfies the stated need to understand why workers bypass the new cyber procedures.
Question 8
A global e-commerce company outsources payment processing while remaining accountable for customer information. After reviewing the situation, the management objective is to determine which compliance responsibilities cannot be delegated. Which response MOST directly addresses it?
- Invoke contract review and assess downstream data access before permitting the new subcontractor
- Maintain a traceable record of processor assurance and organizational compensating controls
- Review independent assurance evidence and unresolved findings against contracted controls
- Map statutory and contractual accountability to the company and processor with legal review
Explanation
Correct Answer
D:Outsourcing performance does not erase the organization's compliance duties. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Additional providers can change legal and cyber exposure. That action primarily serves the different objective to respond to processor use of an undisclosed fourth party. It is not the step that directly satisfies the stated need to determine which compliance responsibilities cannot be delegated.
B:Evidence must show which party operates each required safeguard. That action primarily serves the different objective to support customers requesting audit evidence. It is not the step that directly satisfies the stated need to determine which compliance responsibilities cannot be delegated.
C:Continuous oversight is necessary after onboarding. That action primarily serves the different objective to verify performance after the processing contract begins. It is not the step that directly satisfies the stated need to determine which compliance responsibilities cannot be delegated.
Question 9
An energy company has created a new CISO role, but line executives assume it owns every cyber risk. For the next governance decision, the team must explain ownership of business information risk. Which choice BEST provides that outcome?
- Document that business process owners accept their risks while the CISO advises and monitors
- Test risk-owner decisions in real cases and report unresolved role conflicts
- Route the policy through defined executive governance and legal consultation
- Separate implementation responsibility from independent control assurance
Explanation
Correct Answer
A:The security function facilitates risk governance but cannot own all business decisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:An organization chart alone does not prove accountable practice. That action primarily serves the different objective to judge whether responsibilities are actually understood. It is not the step that directly satisfies the stated need to explain ownership of business information risk.
C:Enterprise policy needs authority beyond one technology department. That action primarily serves the different objective to approve a cross-functional policy with competing demands. It is not the step that directly satisfies the stated need to explain ownership of business information risk.
D:A self-review may conceal failures. That action primarily serves the different objective to prevent controls from being judged only by their designers. It is not the step that directly satisfies the stated need to explain ownership of business information risk.
Question 10
A bank wants to expand into embedded finance partnerships and expose customer APIs to third parties. The security program has been tasked specifically to incorporate ecosystem dependence into the security strategy. Which approach should be selected?
- Define service and data risk ownership with explicit partner handoffs
- Revisit risk appetite, contract obligations and capacity forecasts for the enlarged ecosystem
- Compare risk and business impact of alternative API protection approaches
- Identify partner/API risk scenarios and link them to business growth objectives
Explanation
Correct Answer
D:Security strategy must account for new revenue channels. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Interfaces between organizations create ownership gaps. That action primarily serves the different objective to assign accountability across bank and partners. It is not the step that directly satisfies the stated need to incorporate ecosystem dependence into the security strategy.
B:Growth may outstrip previously accepted exposure. That action primarily serves the different objective to check strategic assumptions after partnership expansion. It is not the step that directly satisfies the stated need to incorporate ecosystem dependence into the security strategy.
C:Decision makers need options framed in business consequences. That action primarily serves the different objective to present options for security investment to the board. It is not the step that directly satisfies the stated need to incorporate ecosystem dependence into the security strategy.
