Isaca CISM Practice Test 10
Question 90
A hospital detects unauthorized changes to medication inventory records but systems remain online. An authoritative list of altered transactions has not yet been established, and clinical management has prohibited data changes until the affected records are identified from independent evidence. The security program has been tasked specifically to confirm which records may be untrustworthy. Which approach should be selected?
- Reconcile affected transactions with trusted audit and source records
- Reconcile approved source data and verify corrections with clinical owners
- Address the exploited authorization path and monitor sensitive record changes
- Coordinate clinical assessment of affected medication decisions
Explanation
Correct Answer
A:Integrity failure can persist without downtime. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Rollback without validation may propagate errors. That action primarily serves the different objective to restore trusted data carefully. It is not the step that directly satisfies the stated need to confirm which records may be untrustworthy.
C:Root-cause treatment closes the weakness. That action primarily serves the different objective to prevent recurrence. It is not the step that directly satisfies the stated need to confirm which records may be untrustworthy.
D:Business impact can extend beyond IT. That action primarily serves the different objective to determine whether patient safety is threatened. It is not the step that directly satisfies the stated need to confirm which records may be untrustworthy.
Question 91
A logistics firm restored a ransomware-affected server from backup but has not established that its data is trustworthy. A security manager has a defined assignment: verify restored data integrity before reopening access. Which action BEST fulfills that specific assignment?
- Incorporate incident lessons into backup, testing and validation steps
- Capture actual downtime and data loss against agreed RTO/RPO
- Follow approved priorities for logistics routing and customer updates
- Compare trusted checkpoints and business reconciliations against restored records
Explanation
Correct Answer
D:Restoration does not guarantee correctness. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Future readiness needs feedback. That action primarily serves the different objective to improve the recovery procedure. It is not the step that directly satisfies the stated need to verify restored data integrity before reopening access.
B:Service restoration should be evaluated. That action primarily serves the different objective to measure whether objectives were met. It is not the step that directly satisfies the stated need to verify restored data integrity before reopening access.
C:Recovery sequence matters. That action primarily serves the different objective to restore service in business dependency order. It is not the step that directly satisfies the stated need to verify restored data integrity before reopening access.
Question 92
A security team closes an incident when malware is removed but never examines why privileged access was granted. The accountable executive now asks the team to identify the root cause beyond the immediate symptom. What should the security manager recommend?
- Retest the originally exploited pathway and monitoring gaps
- Report material weaknesses and treatment commitments to risk authorities
- Trace authorization, process and technology failures that enabled the breach
- Turn findings into prioritized, funded changes and due dates
Explanation
Correct Answer
C:Removing malware is not causal analysis. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Closure should reflect outcomes. That action primarily serves the different objective to verify corrective actions reduce risk. It is not the step that directly satisfies the stated need to identify the root cause beyond the immediate symptom.
B:Executive oversight needs consequences. That action primarily serves the different objective to inform governance of residual exposure. It is not the step that directly satisfies the stated need to identify the root cause beyond the immediate symptom.
D:Lessons need accountable execution. That action primarily serves the different objective to assign corrective measures with owners. It is not the step that directly satisfies the stated need to identify the root cause beyond the immediate symptom.
Question 93
A logistics company tests incident communications only in daylight hours though a major outage occurred overnight. After reviewing the situation, the management objective is to test realistic staffing and communication conditions. Which response MOST directly addresses it?
- Create backups for critical decision roles and verified alternate channels
- Repeat the failed callout sequence and measure response against target
- Trigger contact-list updates and brief drills when roles change
- Run an unannounced authorized out-of-hours escalation exercise
Explanation
Correct Answer
D:Exercises should reflect actual incident timing. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Single points of failure delay response. That action primarily serves the different objective to repair the contact and authority model. It is not the step that directly satisfies the stated need to test realistic staffing and communication conditions.
B:Changes require retesting. That action primarily serves the different objective to verify remediation of communication gaps. It is not the step that directly satisfies the stated need to test realistic staffing and communication conditions.
C:Readiness records age quickly. That action primarily serves the different objective to maintain readiness after staff turnover. It is not the step that directly satisfies the stated need to test realistic staffing and communication conditions.
Question 94
A multinational organization activates incident response simultaneously in multiple countries but has no unified incident commander. For the next governance decision, the team must establish an incident command structure. Which choice BEST provides that outcome?
- Maintain a common status record and approved communication cadence
- Include coordination failures in post-incident improvements
- Define a lead incident commander and delegated regional responsibilities
- Use business impact and command authority to resolve cross-border tradeoffs
Explanation
Correct Answer
C:One command model reduces conflicting containment. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Shared facts prevent fragmented decisions. That action primarily serves the different objective to share accurate incident state across regions. It is not the step that directly satisfies the stated need to establish an incident command structure.
B:Governance must learn from the event. That action primarily serves the different objective to review cross-region decision delays. It is not the step that directly satisfies the stated need to establish an incident command structure.
D:Containment can have global consequences. That action primarily serves the different objective to manage conflicting containment requests. It is not the step that directly satisfies the stated need to establish an incident command structure.
Question 95
A university's security center labels every phishing report as a high-severity incident. Sampled messages include unclicked phishing links as well as potentially suspicious logins, and the center has not agreed what establishes compromise. The security program has been tasked specifically to distinguish reports from confirmed compromise. Which approach should be selected?
- Define validation and categorization criteria based on evidence and impact
- Update analyst guidance and retrain teams on classification examples
- Apply the high-severity response threshold to messages naming a faculty account before verifying account misuse
- Sample incident records and compare ratings with defined criteria
Explanation
Correct Answer
A:Severity should follow actual consequences. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Clear criteria improve consistency. That action primarily serves the different objective to refine procedures after repeated false positives. It is not the step that directly satisfies the stated need to distinguish reports from confirmed compromise.
C:An account name in a phishing report does not establish that the account was compromised. Escalating every reported message prematurely repeats the classification failure; evidence-based validation criteria must be defined first.
D:Classification quality can be tested. That action primarily serves the different objective to measure misclassification trends. It is not the step that directly satisfies the stated need to distinguish reports from confirmed compromise.
Question 96
A fintech must update executives while investigators still disagree over whether customer data was exposed. A security manager has a defined assignment: separate verified facts from unconfirmed hypotheses. Which action BEST fulfills that specific assignment?
- Publish an authorized update explaining material factual changes
- Have legal counsel determine triggering facts and deadlines for applicable laws
- Issue a status report showing known facts, unknowns and next verification steps
- Present risk-based response options and consequences to the incident authority
Explanation
Correct Answer
C:Transparent uncertainty avoids false claims. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Communications must stay accurate. That action primarily serves the different objective to correct previous status when evidence changes. It is not the step that directly satisfies the stated need to separate verified facts from unconfirmed hypotheses.
B:Notification is not solely a technical judgment. That action primarily serves the different objective to coordinate any legal notifications. It is not the step that directly satisfies the stated need to separate verified facts from unconfirmed hypotheses.
D:Leaders can act despite uncertainty. That action primarily serves the different objective to seek timely decisions without speculation. It is not the step that directly satisfies the stated need to separate verified facts from unconfirmed hypotheses.
Question 97
A public utility has isolated an affected control-system host after a breach, and the team must verify it is clean before full restoration. The accountable executive now asks the team to confirm eradication before declaring normal operations. What should the security manager recommend?
- Test operational control and communications end to end before handback
- Increase detection and log review for recurrence indicators
- Validate the environment against known indicators and required baselines
- Document recovery evidence, residual exposure and lessons for governance
Explanation
Correct Answer
C:Before the isolated host is returned to production, verify it and related systems against trusted baselines and the incident indicators, and confirm that the exploited access path is closed. A functioning network alone does not prove eradication.
Incorrect Answers
A:Operational process tests establish that plant functions work after recovery. They cannot show that the isolated, previously affected host and its environment are free of the compromise that caused the incident.
B:Heightened event monitoring is valuable after reconnection, but simply watching for recurrence does not establish clean baselines and eradication before restoration.
D:An incident closeout records actions and accepted residual risk, but paperwork is not evidence that the original compromise has been removed from the affected control-system environment.
Question 98
A bank suspects a cyberattack on an interbank settlement gateway with extremely limited tolerated downtime. After reviewing the situation, the management objective is to define a containment option that preserves critical processing. Which response MOST directly addresses it?
- Coordinate selective isolation with payment operations and regulators as appropriate
- Assess architecture resilience and alternate settlement routes with business owners
- Use preapproved forensic collection compatible with required continuity
- Review network and transaction telemetry against known indicators
Explanation
Correct Answer
A:Broad shutdown could cause systemic impact. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Systemic dependencies can warrant redesign. That action primarily serves the different objective to review strategic dependencies after stabilization. It is not the step that directly satisfies the stated need to define a containment option that preserves critical processing.
C:Evidence needs must be balanced with operational risk. That action primarily serves the different objective to preserve volatile evidence while maintaining safety. It is not the step that directly satisfies the stated need to define a containment option that preserves critical processing.
D:A firewall change is not proof of containment. That action primarily serves the different objective to verify that targeted containment blocks the attack path. It is not the step that directly satisfies the stated need to define a containment option that preserves critical processing.
Question 99
A manufacturing group relies on one outsourced cloud identity service for business continuity across every plant. For the next governance decision, the team must identify the common dependency across plants. Which choice BEST provides that outcome?
- Exercise the dependency failure and verify operational targets
- Assess contract resilience, alternate providers and residual shared risk
- Set tightly controlled emergency access with post-use monitoring
- Map cloud identity availability to safety, production and remote access workflows
Explanation
Correct Answer
D:Shared dependencies can concentrate outage impact. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A plan may fail at scale. That action primarily serves the different objective to test a cloud identity outage across plants. It is not the step that directly satisfies the stated need to identify the common dependency across plants.
B:One service can affect all plants. That action primarily serves the different objective to review provider concentration exposure. It is not the step that directly satisfies the stated need to identify the common dependency across plants.
C:Availability exceptions need oversight. That action primarily serves the different objective to ensure fallback does not create excessive privileges. It is not the step that directly satisfies the stated need to identify the common dependency across plants.
Question 100
A government data center has backups but no plan to reconstruct application dependencies after a major outage. The security program has been tasked specifically to establish the sequence needed for recovery. Which approach should be selected?
- Exercise full-service restoration and validate business transactions
- Map identities, databases, networks and application dependencies
- Assign fixes, fund missing capacity and retest failed dependencies
- Document repeatable runbooks with named owners and prerequisites
Explanation
Correct Answer
B:Recovery order affects service usability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Backup existence does not prove recoverability. That action primarily serves the different objective to verify recoverability in a realistic environment. It is not the step that directly satisfies the stated need to establish the sequence needed for recovery.
C:Gaps require verified remediation. That action primarily serves the different objective to close observed recovery gaps. It is not the step that directly satisfies the stated need to establish the sequence needed for recovery.
D:Recovery must be executable. That action primarily serves the different objective to prepare detailed technical restoration procedures. It is not the step that directly satisfies the stated need to establish the sequence needed for recovery.
