Isaca CISM Practice Test 11
Question 100
A government data center has backups but no plan to reconstruct application dependencies after a major outage. The security program has been tasked specifically to establish the sequence needed for recovery. Which approach should be selected?
- Exercise full-service restoration and validate business transactions
- Map identities, databases, networks and application dependencies
- Assign fixes, fund missing capacity and retest failed dependencies
- Document repeatable runbooks with named owners and prerequisites
Explanation
Correct Answer
B:Recovery order affects service usability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Backup existence does not prove recoverability. That action primarily serves the different objective to verify recoverability in a realistic environment. It is not the step that directly satisfies the stated need to establish the sequence needed for recovery.
C:Gaps require verified remediation. That action primarily serves the different objective to close observed recovery gaps. It is not the step that directly satisfies the stated need to establish the sequence needed for recovery.
D:Recovery must be executable. That action primarily serves the different objective to prepare detailed technical restoration procedures. It is not the step that directly satisfies the stated need to establish the sequence needed for recovery.
Question 101
A multinational retailer has acquired regional chains whose store leaders use different security approval practices. The accountable executive now asks the team to define accountable security decision-makers across the acquired chains. What should the security manager recommend?
- Interview regional leaders and map actual exception practices before designing the integration
- Publish a responsibility matrix approved by regional executives and the enterprise risk committee
- Translate the approved controls into local operating procedures and role-specific training
- Review exception frequency and completion of control milestones by region
Explanation
Correct Answer
B:Named owners prevent local exceptions from becoming ungoverned decisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Observed decision behavior reveals gaps that a generic global policy cannot show. That action primarily serves the different objective to identify which local behaviors weaken the common control model. It is not the step that directly satisfies the stated need to define accountable security decision-makers across the acquired chains.
C:Operational procedures translate policy into repeatable behavior. That action primarily serves the different objective to make new security requirements usable by store employees. It is not the step that directly satisfies the stated need to define accountable security decision-makers across the acquired chains.
D:Regional evidence shows whether the governance rollout works. That action primarily serves the different objective to evaluate whether store practices are converging toward the target. It is not the step that directly satisfies the stated need to define accountable security decision-makers across the acquired chains.
Question 102
A healthcare provider is opening clinics in jurisdictions with differing privacy, retention and breach-notification duties. Legal staff have already collected the applicable obligations, but a supplier contract requires retention beyond a binding local deletion period, leaving a specific conflict to resolve before the clinic can set its rules. After reviewing the situation, the management objective is to resolve an apparent conflict between contract and local law. Which response MOST directly addresses it?
- Trigger a privacy and security requirements review before patient records are collected
- Create a jurisdiction-by-data-type obligations register reviewed with legal counsel
- Ask legal counsel to document controlling requirements and the permissible treatment for each data flow
- Map each obligation to a control owner and retained compliance evidence
Explanation
Correct Answer
C:Legal interpretation must precede a conflicting operating rule. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Early assessment avoids retrofitting controls after processing begins. That action primarily serves the different objective to handle a proposed clinic expansion into a new jurisdiction. It is not the step that directly satisfies the stated need to resolve an apparent conflict between contract and local law.
B:Documented requirements prevent a global default from violating a local obligation. That action primarily serves the different objective to identify obligations before deciding on one global retention setting. It is not the step that directly satisfies the stated need to resolve an apparent conflict between contract and local law.
D:Traceability demonstrates how requirements are fulfilled. That action primarily serves the different objective to make evidence available for regulator inquiries. It is not the step that directly satisfies the stated need to resolve an apparent conflict between contract and local law.
Question 103
A logistics company has separate security, IT operations and business risk committees that keep overruling one another. For the next governance decision, the team must prevent conflicting policy decisions among committees. Which choice BEST provides that outcome?
- Define business risk owner authority and escalation thresholds in a governance charter
- Escalate the documented residual risk to the designated senior risk authority
- Roll up exposures, tolerance breaches and accountable owners into decision-ready reporting
- Establish a single approved decision hierarchy and cross-committee referral path
Explanation
Correct Answer
D:A clear hierarchy resolves overlapping mandates. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Business accountability cannot be replaced by an IT-only vote. That action primarily serves the different objective to clarify who can authorize acceptance of delivery-platform risk. It is not the step that directly satisfies the stated need to prevent conflicting policy decisions among committees.
B:A local project lead cannot approve exposures above the established delegation. That action primarily serves the different objective to settle a disputed exception that exceeds delegated authority. It is not the step that directly satisfies the stated need to prevent conflicting policy decisions among committees.
C:The board needs risk decisions rather than raw alert counts. That action primarily serves the different objective to inform the board without sending every technical defect. It is not the step that directly satisfies the stated need to prevent conflicting policy decisions among committees.
Question 104
An insurer's board wants a cyber strategy for its transition from branch offices to online customer services. The security program has been tasked specifically to choose an ordered plan when funds cannot cover every initiative. Which approach should be selected?
- Reassess the security strategy against the revised business plan and threat landscape
- Assign owners, milestones and financing for approved security initiatives
- Derive security outcomes from the online service roadmap and business risk appetite
- Prioritize initiatives by risk reduction, dependencies and business delivery dates
Explanation
Correct Answer
D:A sequenced roadmap makes limited resources actionable. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A change in business direction can invalidate old assumptions. That action primarily serves the different objective to refresh the strategy after major online platform changes. It is not the step that directly satisfies the stated need to choose an ordered plan when funds cannot cover every initiative.
B:Accountability and resources turn a strategy into delivery. That action primarily serves the different objective to translate strategy into accountable organizational execution. It is not the step that directly satisfies the stated need to choose an ordered plan when funds cannot cover every initiative.
C:Strategy must support business objectives rather than tool preferences. That action primarily serves the different objective to connect the cyber strategy to the digital business strategy. It is not the step that directly satisfies the stated need to choose an ordered plan when funds cannot cover every initiative.
Question 105
A payments firm is adopting a common security framework across independently managed subsidiaries. A security manager has a defined assignment: establish consistency when subsidiaries use different terminology. Which action BEST fulfills that specific assignment?
- Publish an enterprise control taxonomy and agreed definitions for reporting
- Report target control outcomes and independently assessed coverage gaps
- Perform a gap assessment of the acquired control model before extending mandatory requirements
- Map framework objectives to business risks, obligations and existing control capabilities
Explanation
Correct Answer
A:Common terms make cross-subsidiary evidence comparable. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Adoption is shown through results rather than the number of policies distributed. That action primarily serves the different objective to demonstrate framework adoption to directors. It is not the step that directly satisfies the stated need to establish consistency when subsidiaries use different terminology.
C:Integration needs evidence of compatibility and unresolved risk. That action primarily serves the different objective to revisit the framework after a major acquisition. It is not the step that directly satisfies the stated need to establish consistency when subsidiaries use different terminology.
D:Tailoring preserves relevance to enterprise conditions. That action primarily serves the different objective to select a governance framework without blindly inheriting every control. It is not the step that directly satisfies the stated need to establish consistency when subsidiaries use different terminology.
Question 106
A university has too little capital to execute all proposed security initiatives before the academic year. The accountable executive now asks the team to defend a proposed network security investment. What should the security manager recommend?
- Develop a business case with alternatives, cost, residual risk and expected benefits
- Bring a revised scope and investment justification to the appropriate sponsor
- Use capacity planning to identify needed skills and sequence hiring or outsourced support
- Use risk reduction, educational-service impact and dependencies to rank proposals
Explanation
Correct Answer
A:Tradeoff evidence supports a prudent board decision. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Material budget changes need a renewed decision. That action primarily serves the different objective to respond when an approved project's cost rises materially. It is not the step that directly satisfies the stated need to defend a proposed network security investment.
C:People and capabilities are part of the program budget. That action primarily serves the different objective to address a projected staffing shortfall during implementation. It is not the step that directly satisfies the stated need to defend a proposed network security investment.
D:Business consequences establish funding priority. That action primarily serves the different objective to determine which proposals deserve funding priority. It is not the step that directly satisfies the stated need to defend a proposed network security investment.
Question 107
An industrial manufacturer is moving from a command-driven security culture to a cross-functional safety culture. After reviewing the situation, the management objective is to obtain worker participation in security design. Which response MOST directly addresses it?
- Use interviews and workflow observations to identify pressure points before revising controls
- Track unsafe exception trends and the closure of worker-reported security issues
- Enforce the documented exception and risk-acceptance escalation route
- Include plant operations and safety representatives in security governance decisions
Explanation
Correct Answer
D:Ownership grows when controls reflect actual plant tasks. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Unsafe workarounds can be caused by workflow conflicts. That action primarily serves the different objective to understand why workers bypass the new cyber procedures. It is not the step that directly satisfies the stated need to obtain worker participation in security design.
B:Behavior and response evidence provide stronger signals than attendance counts. That action primarily serves the different objective to measure whether the culture change is taking hold. It is not the step that directly satisfies the stated need to obtain worker participation in security design.
C:A supervisor cannot silently bypass enterprise risk authority. That action primarily serves the different objective to respond to a supervisor who informally waives a critical control. It is not the step that directly satisfies the stated need to obtain worker participation in security design.
Question 108
A global e-commerce company outsources payment processing while remaining accountable for customer information. For the next governance decision, the team must make the processor's control commitments enforceable. Which choice BEST provides that outcome?
- Invoke contract review and assess downstream data access before permitting the new subcontractor
- Include measurable security, audit, incident notice and subcontractor provisions in the contract
- Map statutory and contractual accountability to the company and processor with legal review
- Maintain a traceable record of processor assurance and organizational compensating controls
Explanation
Correct Answer
B:Contract rights support oversight and remediation. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Additional providers can change legal and cyber exposure. That action primarily serves the different objective to respond to processor use of an undisclosed fourth party. It is not the step that directly satisfies the stated need to make the processor's control commitments enforceable.
C:Outsourcing performance does not erase the organization's compliance duties. That action primarily serves the different objective to determine which compliance responsibilities cannot be delegated. It is not the step that directly satisfies the stated need to make the processor's control commitments enforceable.
D:Evidence must show which party operates each required safeguard. That action primarily serves the different objective to support customers requesting audit evidence. It is not the step that directly satisfies the stated need to make the processor's control commitments enforceable.
Question 109
An energy company has created a new CISO role, but line executives assume it owns every cyber risk. The security program has been tasked specifically to give the CISO a formal escalation path. Which approach should be selected?
- Route the policy through defined executive governance and legal consultation
- Approve a governance charter linking the CISO, risk committee and board
- Test risk-owner decisions in real cases and report unresolved role conflicts
- Document that business process owners accept their risks while the CISO advises and monitors
Explanation
Correct Answer
B:Governance must provide access to decision makers. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Enterprise policy needs authority beyond one technology department. That action primarily serves the different objective to approve a cross-functional policy with competing demands. It is not the step that directly satisfies the stated need to give the CISO a formal escalation path.
C:An organization chart alone does not prove accountable practice. That action primarily serves the different objective to judge whether responsibilities are actually understood. It is not the step that directly satisfies the stated need to give the CISO a formal escalation path.
D:The security function facilitates risk governance but cannot own all business decisions. That action primarily serves the different objective to explain ownership of business information risk. It is not the step that directly satisfies the stated need to give the CISO a formal escalation path.
Question 110
A bank wants to expand into embedded finance partnerships and expose customer APIs to third parties. A security manager has a defined assignment: prioritize controls that are dependencies for partner launch. Which action BEST fulfills that specific assignment?
- Identify partner/API risk scenarios and link them to business growth objectives
- Define service and data risk ownership with explicit partner handoffs
- Revisit risk appetite, contract obligations and capacity forecasts for the enlarged ecosystem
- Build an architecture-driven security roadmap with business launch gates
Explanation
Correct Answer
D:Dependencies avoid releasing an ungoverned interface. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Security strategy must account for new revenue channels. That action primarily serves the different objective to incorporate ecosystem dependence into the security strategy. It is not the step that directly satisfies the stated need to prioritize controls that are dependencies for partner launch.
B:Interfaces between organizations create ownership gaps. That action primarily serves the different objective to assign accountability across bank and partners. It is not the step that directly satisfies the stated need to prioritize controls that are dependencies for partner launch.
C:Growth may outstrip previously accepted exposure. That action primarily serves the different objective to check strategic assumptions after partnership expansion. It is not the step that directly satisfies the stated need to prioritize controls that are dependencies for partner launch.
