Isaca CISM Practice Test 13
Question 120
A fintech discovers that its production API has an unpatched weakness but compensating controls restrict exploitability. A security manager has a defined assignment: assign accountability for the vulnerability decision. Which action BEST fulfills that specific assignment?
- Monitor patch progress, attack indicators and the effectiveness of the compensating control
- Verify the fixed API and retire exceptions only after retesting
- Validate reachability, authentication barriers and business impact of exploitation
- Record the service owner as risk owner with security providing challenge
Explanation
Correct Answer
D:Operations owns the risk from its service. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Tracking reveals when the temporary risk worsens. That action primarily serves the different objective to track exposure through remediation. It is not the step that directly satisfies the stated need to assign accountability for the vulnerability decision.
B:A change ticket is not evidence the weakness was resolved. That action primarily serves the different objective to close the issue appropriately. It is not the step that directly satisfies the stated need to assign accountability for the vulnerability decision.
C:A severity score alone does not measure realized business risk. That action primarily serves the different objective to establish how exposed the weakness is in context. It is not the step that directly satisfies the stated need to assign accountability for the vulnerability decision.
Question 121
A bank estimates fraud exposure for a new mobile payment feature with incomplete loss data. The accountable executive now asks the team to identify the consequences that matter to the business. What should the security manager recommend?
- Use documented loss ranges, assumptions and sensitivity scenarios instead of one false-precision number
- Compare plausible loss outcomes with approved risk tolerance and control cost
- Assess fraud loss, regulatory exposure and customer trust against business objectives
- Update loss assumptions using actual fraud and control performance evidence
Explanation
Correct Answer
C:Impact spans more than direct monetary theft. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Uncertainty must remain visible to decision makers. That action primarily serves the different objective to select an analysis appropriate to uncertain loss estimates. It is not the step that directly satisfies the stated need to identify the consequences that matter to the business.
B:Treatment should reflect risk appetite. That action primarily serves the different objective to choose a treatment threshold. It is not the step that directly satisfies the stated need to identify the consequences that matter to the business.
D:New evidence can change the prior decision. That action primarily serves the different objective to reassess after initial transaction data becomes available. It is not the step that directly satisfies the stated need to identify the consequences that matter to the business.
Question 122
A manufacturer reports high cyber risk in its industrial control network, but its IT department claims ownership of the exposure. After reviewing the situation, the management objective is to establish who implements the selected security controls. Which response MOST directly addresses it?
- Assign the plant business executive as risk owner and security as adviser
- Assign accountable plant engineering and IT control owners with clear interfaces
- Report control health and operating exceptions to plant risk owners
- Document current exposure, options, decision authority and review date in the risk register
Explanation
Correct Answer
B:Risk ownership and control execution are distinct. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Business executives own operational impact. That action primarily serves the different objective to determine who can accept the production shutdown consequence. It is not the step that directly satisfies the stated need to establish who implements the selected security controls.
C:An accepted risk requires ongoing observation. That action primarily serves the different objective to validate that residual risk is being monitored. It is not the step that directly satisfies the stated need to establish who implements the selected security controls.
D:Traceable decisions support oversight. That action primarily serves the different objective to record the basis for acceptance or treatment. It is not the step that directly satisfies the stated need to establish who implements the selected security controls.
Question 123
A cloud retailer cannot immediately remove a legacy authentication dependency in a critical order system. For the next governance decision, the team must select a defensible near-term mitigation. Which choice BEST provides that outcome?
- Reduce reachable attack paths and impose stronger compensating authentication monitoring
- Require time-limited risk treatment with approved controls and milestones
- Reassess residual exposure against fresh threat evidence before the exception expires
- Fund a migration plan with tested cutover and rollback gates
Explanation
Correct Answer
A:Compensating controls reduce exposure while modernization proceeds. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Temporary acceptance must have an end condition. That action primarily serves the different objective to avoid leaving an unbounded vulnerability exception. It is not the step that directly satisfies the stated need to select a defensible near-term mitigation.
C:Approval cannot be treated as permanent. That action primarily serves the different objective to determine whether acceptance should be renewed. It is not the step that directly satisfies the stated need to select a defensible near-term mitigation.
D:Structural remediation addresses the source of risk. That action primarily serves the different objective to show a path to eliminate the dependency. It is not the step that directly satisfies the stated need to select a defensible near-term mitigation.
Question 124
An online marketplace plans to stop storing cardholder data by switching to a payment service provider. The security program has been tasked specifically to identify the remaining risk after outsourcing. Which approach should be selected?
- Review fallback arrangements and residual exposure with procurement and the risk owner
- Eliminate local card-data processing and token handling where technically feasible
- Assess provider outages, integration attacks and contractual dependence
- Validate data-flow diagrams and storage scans show removal of card data
Explanation
Correct Answer
C:Risk is changed rather than completely erased. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Third-party deterioration can change treatment adequacy. That action primarily serves the different objective to respond when the provider's risk profile deteriorates. It is not the step that directly satisfies the stated need to identify the remaining risk after outsourcing.
B:Removing an activity can avoid a related category of risk. That action primarily serves the different objective to choose a risk response that removes the original exposure. It is not the step that directly satisfies the stated need to identify the remaining risk after outsourcing.
D:Architecture intent must match actual processing. That action primarily serves the different objective to verify that the response was executed. It is not the step that directly satisfies the stated need to identify the remaining risk after outsourcing.
Question 125
A shipping company is deciding whether to buy cyber insurance for cargo booking disruption. A security manager has a defined assignment: avoid assuming insurance fixes operational recovery. Which action BEST fulfills that specific assignment?
- Secure approval from finance and the cargo booking risk owner
- Review policy changes, incident conditions and residual exposures at renewal
- Compare covered loss scenarios, exclusions, deductibles and response conditions
- Maintain controls and tested continuity plans alongside coverage
Explanation
Correct Answer
D:Insurance cannot restore shipping systems. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Risk financing must have accountable sponsors. That action primarily serves the different objective to assign responsibility for the transfer decision. It is not the step that directly satisfies the stated need to avoid assuming insurance fixes operational recovery.
B:Coverage and threats can change. That action primarily serves the different objective to check whether the risk response remains viable. It is not the step that directly satisfies the stated need to avoid assuming insurance fixes operational recovery.
C:Risk transfer depends on contract wording. That action primarily serves the different objective to identify which losses can actually be transferred. It is not the step that directly satisfies the stated need to avoid assuming insurance fixes operational recovery.
Question 126
An industrial company receives 200 critical-looking vulnerability alerts affecting different production networks. The accountable executive now asks the team to confirm the alerts represent real deficiencies. What should the security manager recommend?
- Retest corrected conditions under approved plant change controls
- Aggregate material residual exposure and accountable remediation owners for leadership
- Use reachable attack paths, asset criticality and operational impact to rank findings
- Validate findings with asset owners and non-disruptive evidence
Explanation
Correct Answer
D:False positives can waste remediation effort. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Closing alerts without validating fixes is inadequate. That action primarily serves the different objective to verify remedial work was effective. It is not the step that directly satisfies the stated need to confirm the alerts represent real deficiencies.
B:Management needs business impact and delays. That action primarily serves the different objective to report overdue high-exposure weaknesses. It is not the step that directly satisfies the stated need to confirm the alerts represent real deficiencies.
C:A high score on an isolated asset may be lower priority. That action primarily serves the different objective to prioritize risk beyond a technical severity label. It is not the step that directly satisfies the stated need to confirm the alerts represent real deficiencies.
Question 127
A services firm wants cyber threat intelligence to influence executive risk decisions rather than produce unread bulletins. After reviewing the situation, the management objective is to assess whether an indicator applies locally. Which response MOST directly addresses it?
- Select threats tied to critical services and likely business impacts
- Correlate external threat information with internal assets and telemetry
- Reprioritize sources and analytic use cases using emerging exposure evidence
- Measure time from relevant warning to verified risk treatment
Explanation
Correct Answer
B:External reports alone do not prove exposure. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Collection should answer business risk questions. That action primarily serves the different objective to define intelligence requirements for management. It is not the step that directly satisfies the stated need to assess whether an indicator applies locally.
C:Intelligence requirements should evolve. That action primarily serves the different objective to adjust collection when threats shift. It is not the step that directly satisfies the stated need to assess whether an indicator applies locally.
D:Decision latency is a meaningful outcome. That action primarily serves the different objective to track whether intelligence improves response. It is not the step that directly satisfies the stated need to assess whether an indicator applies locally.
Question 128
A government office compares risks to citizen identity records and an internal test website. For the next governance decision, the team must identify asset-specific impact. Which choice BEST provides that outcome?
- Reassess on material process, threat or control changes
- Include identity harm and statutory duties for citizen records rather than only infrastructure cost
- Use consistent impact and likelihood scales tied to public-service objectives
- Present the affected service and treatment options to the authorized executive
Explanation
Correct Answer
B:Sensitivity changes consequence. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Risk assessments are not one-time artifacts. That action primarily serves the different objective to monitor whether the ranking changes. It is not the step that directly satisfies the stated need to identify asset-specific impact.
C:Inconsistent scales undermine prioritization. That action primarily serves the different objective to choose comparable assessment criteria. It is not the step that directly satisfies the stated need to identify asset-specific impact.
D:Exceeding appetite requires decision authority. That action primarily serves the different objective to escalate a risk above agreed tolerance. It is not the step that directly satisfies the stated need to identify asset-specific impact.
Question 129
A company relies on monthly heat maps, but executives cannot tell whether accepted risks are deteriorating. The security program has been tasked specifically to define thresholds for executive action. Which approach should be selected?
- Reconcile indicators with source systems and investigate inconsistent reporting
- Add product-specific exposure measures and owners before scaling usage
- Use control failures, threat activity and critical overdue exceptions linked to each top risk
- Set risk tolerance breaches and escalation levels approved by risk owners
Explanation
Correct Answer
D:Thresholds connect monitoring to decisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Bad data creates misleading trends. That action primarily serves the different objective to validate the risk data quality. It is not the step that directly satisfies the stated need to define thresholds for executive action.
B:New activities create new monitoring needs. That action primarily serves the different objective to refresh monitoring as a new product launches. It is not the step that directly satisfies the stated need to define thresholds for executive action.
C:Forward-looking signals are more useful than a colored square. That action primarily serves the different objective to select indicators that reveal worsening exposure. It is not the step that directly satisfies the stated need to define thresholds for executive action.
Question 130
A franchise organization lets branch managers accept local cyber risks without written limits. A security manager has a defined assignment: identify risk owners for shared customer systems. Which action BEST fulfills that specific assignment?
- Review residual risk periodically and when circumstances change
- Escalate it to the enterprise risk committee before relying on the exception
- Assign named accountable business owners for cross-branch services
- Define acceptance limits and escalation rules approved by enterprise governance
Explanation
Correct Answer
C:Shared platforms require enterprise-wide ownership. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Acceptance is not a one-off event. That action primarily serves the different objective to check that accepted risks stay acceptable. It is not the step that directly satisfies the stated need to identify risk owners for shared customer systems.
B:Unauthorized decisions do not establish formal acceptance. That action primarily serves the different objective to address a branch accepting risk above its limit. It is not the step that directly satisfies the stated need to identify risk owners for shared customer systems.
D:Delegation needs boundaries. That action primarily serves the different objective to establish delegated risk authority. It is not the step that directly satisfies the stated need to identify risk owners for shared customer systems.
