Isaca CISM Practice Test 14
Question 130
A franchise organization lets branch managers accept local cyber risks without written limits. A security manager has a defined assignment: identify risk owners for shared customer systems. Which action BEST fulfills that specific assignment?
- Review residual risk periodically and when circumstances change
- Escalate it to the enterprise risk committee before relying on the exception
- Assign named accountable business owners for cross-branch services
- Define acceptance limits and escalation rules approved by enterprise governance
Explanation
Correct Answer
C:Shared platforms require enterprise-wide ownership. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Acceptance is not a one-off event. That action primarily serves the different objective to check that accepted risks stay acceptable. It is not the step that directly satisfies the stated need to identify risk owners for shared customer systems.
B:Unauthorized decisions do not establish formal acceptance. That action primarily serves the different objective to address a branch accepting risk above its limit. It is not the step that directly satisfies the stated need to identify risk owners for shared customer systems.
D:Delegation needs boundaries. That action primarily serves the different objective to establish delegated risk authority. It is not the step that directly satisfies the stated need to identify risk owners for shared customer systems.
Question 131
A healthcare supplier introduces an AI summarization service handling sensitive medical notes. The AI provider has not yet supplied a usable map of where prompts, summaries, subprocessors and retained data are handled; the data inventory must be established before assurance monitoring can be scoped. The accountable executive now asks the team to identify relevant information assets and flows. What should the security manager recommend?
- Map prompts, outputs, provider access and retention paths
- Model data leakage, prompt abuse, vendor handling and incorrect-output scenarios
- Track high-risk outputs, access exceptions and provider changes against thresholds
- Assign a business service owner and specialist control owners
Explanation
Correct Answer
A:Data-flow mapping exposes security and privacy obligations. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:AI service risks differ from conventional infrastructure. That action primarily serves the different objective to discover threats specific to this new dependency. It is not the step that directly satisfies the stated need to identify relevant information assets and flows.
C:New-model risks need continuing assurance. That action primarily serves the different objective to monitor whether safeguards remain effective. It is not the step that directly satisfies the stated need to identify relevant information assets and flows.
D:Vendor technology cannot replace internal risk ownership. That action primarily serves the different objective to ensure accountability for model risk. It is not the step that directly satisfies the stated need to identify relevant information assets and flows.
Question 132
An e-commerce firm estimates its cyber risk using a single average annual loss number despite highly variable holiday traffic. After reviewing the situation, the management objective is to separate uncertainty from controllable risk. Which response MOST directly addresses it?
- Document assumptions and confidence limits on frequency and financial severity
- Include trust, contractual commitments and recovery time in the risk report
- Use actual incident, fraud and downtime evidence to revise assumptions
- Model plausible peak-season loss scenarios and sensitivity to demand
Explanation
Correct Answer
A:Uncertain estimates should not masquerade as facts. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Business impact is broader than invoices. That action primarily serves the different objective to present financial and nonfinancial consequences. It is not the step that directly satisfies the stated need to separate uncertainty from controllable risk.
C:Operational experience updates the model. That action primarily serves the different objective to recalibrate risk after a peak shopping season. It is not the step that directly satisfies the stated need to separate uncertainty from controllable risk.
D:The mean can hide tail impacts. That action primarily serves the different objective to represent severe but infrequent exposure. It is not the step that directly satisfies the stated need to separate uncertainty from controllable risk.
Question 133
A utilities operator has many risk exceptions but no way to know which are approaching expiration. For the next governance decision, the team must prioritize review of exceptional exposures. Which choice BEST provides that outcome?
- Track owners, approval dates, expiry, compensating controls and affected systems
- Measure overdue reviews and exceptions without verified safeguards
- Require new risk evidence and authorized acceptance before each renewal
- Sort by materiality, upcoming expiry and changes in threat conditions
Explanation
Correct Answer
D:Review effort should focus on greatest risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Structured records support governance. That action primarily serves the different objective to maintain a usable exception inventory. It is not the step that directly satisfies the stated need to prioritize review of exceptional exposures.
B:Process quality can be measured. That action primarily serves the different objective to evaluate exception-management effectiveness. It is not the step that directly satisfies the stated need to prioritize review of exceptional exposures.
C:Old approval does not justify indefinite exposure. That action primarily serves the different objective to prevent automatic rollovers. It is not the step that directly satisfies the stated need to prioritize review of exceptional exposures.
Question 134
A transportation platform has a partner integration whose legacy protocol cannot support the new encryption standard. The security program has been tasked specifically to reduce exposure while a replacement is built. Which approach should be selected?
- Reassess severity against tolerance and authorize continuity or disconnection
- Assess interception exposure, data classification and external access paths
- Agree on a protocol migration plan with partner milestones and contractual duties
- Restrict connectivity and add compensating transport controls with a sunset date
Explanation
Correct Answer
D:Interim controls can narrow impact. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:New threat information can invalidate prior acceptance. That action primarily serves the different objective to decide whether to suspend the integration after a new exploit appears. It is not the step that directly satisfies the stated need to reduce exposure while a replacement is built.
B:Treatment depends on information sensitivity. That action primarily serves the different objective to identify the risk introduced by the legacy channel. It is not the step that directly satisfies the stated need to reduce exposure while a replacement is built.
C:Partner dependencies require joint remediation. That action primarily serves the different objective to create a sustainable treatment path. It is not the step that directly satisfies the stated need to reduce exposure while a replacement is built.
Question 135
A software company discovers that privileged users can bypass the approval workflow in its production pipeline. A security manager has a defined assignment: identify effective compensating controls. Which action BEST fulfills that specific assignment?
- Name the release process owner and privileged access control owner
- Test the pathway from privileged actions to unauthorized releases and sensitive code
- Perform a controlled retest of blocked self-approved releases and monitor exceptions
- Check independent monitoring and approval evidence for privileged changes
Explanation
Correct Answer
D:Dual evidence may reduce exposure while fixing access. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Cross-functional weaknesses need explicit accountability. That action primarily serves the different objective to assign responsibility for remediation. It is not the step that directly satisfies the stated need to identify effective compensating controls.
B:A control gap matters through its consequences. That action primarily serves the different objective to assess how the bypass affects business assets. It is not the step that directly satisfies the stated need to identify effective compensating controls.
C:Policy text without effective enforcement is insufficient. That action primarily serves the different objective to validate that the exploit path is closed. It is not the step that directly satisfies the stated need to identify effective compensating controls.
Question 136
A municipality finds network-connected water equipment installed by a maintenance contractor without a security review. The accountable executive now asks the team to assess safety and continuity consequences. What should the security manager recommend?
- Evaluate credible cyber pathways with plant engineers and safety specialists
- Update maintenance contracts with authorized access and reporting requirements
- Track new device connections and remote sessions against an approved baseline
- Inventory contractor-installed devices and map connectivity into control networks
Explanation
Correct Answer
A:Operational risk is not only data loss. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Contractor access needs enforceable limits. That action primarily serves the different objective to assign vendor responsibilities. It is not the step that directly satisfies the stated need to assess safety and continuity consequences.
C:Monitoring detects drift after remediation. That action primarily serves the different objective to establish ongoing risk monitoring. It is not the step that directly satisfies the stated need to assess safety and continuity consequences.
D:Unknown devices create unassessed exposure. That action primarily serves the different objective to identify exposed operational technology assets. It is not the step that directly satisfies the stated need to assess safety and continuity consequences.
Question 137
A cloud company has accepted several high risks, and new regulations impose tighter customer data handling duties. After reviewing the situation, the management objective is to determine whether previous acceptance is still valid. Which response MOST directly addresses it?
- Collect independent operating evidence before closing regulatory risk items
- Present legal consequences, affected services and accountable risk owners
- Compare accepted exposures with the new statutory duties and enforcement dates
- Reassess residual exposures against updated risk appetite and mandatory compliance
Explanation
Correct Answer
D:Acceptance cannot override law. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A planned control is not an implemented control. That action primarily serves the different objective to confirm treatment obligations are fulfilled. It is not the step that directly satisfies the stated need to determine whether previous acceptance is still valid.
B:Executive decisions require explicit impact. That action primarily serves the different objective to communicate required decisions to leaders. It is not the step that directly satisfies the stated need to determine whether previous acceptance is still valid.
C:A regulatory shift changes acceptable risk. That action primarily serves the different objective to identify which risk assumptions have changed. It is not the step that directly satisfies the stated need to determine whether previous acceptance is still valid.
Question 138
A manufacturer is adopting a cloud-hosted production forecasting engine that shares sensitive recipes with a technology supplier. For the next governance decision, the team must determine whether contractual controls address the risk. Which choice BEST provides that outcome?
- Assess audit rights, subcontractor restrictions and incident notice against the data flow
- Require segregation, minimal data transfer and verified provider controls before rollout
- Reassess stored data, new subprocessors and access paths after each material change
- Analyze supplier access, data handling and model-output leakage pathways
Explanation
Correct Answer
A:Contract terms must reflect the actual processing. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Technical and contractual controls can lower risk. That action primarily serves the different objective to select additional treatment when residual risk exceeds appetite. It is not the step that directly satisfies the stated need to determine whether contractual controls address the risk.
C:Service evolution can create new exposure. That action primarily serves the different objective to monitor risks after the supplier adds new AI features. It is not the step that directly satisfies the stated need to determine whether contractual controls address the risk.
D:Critical intellectual property may be exposed outside the plant. That action primarily serves the different objective to identify material threats from sharing recipes. It is not the step that directly satisfies the stated need to determine whether contractual controls address the risk.
Question 139
A regional bank is implementing the security program approved by its new digital banking strategy. The security program has been tasked specifically to sequence work with dependent projects. Which approach should be selected?
- Use a workforce plan that combines training, recruitment and qualified external support
- Create a funded roadmap tied to the digital platform milestones
- Build a skills and capacity assessment against prioritized security outcomes
- Measure risk-reducing control performance against approved targets
Explanation
Correct Answer
B:Program dependencies affect delivery order. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Capability gaps need sustainable solutions. That action primarily serves the different objective to resolve scarce specialist capacity. It is not the step that directly satisfies the stated need to sequence work with dependent projects.
C:Tool purchases cannot replace required people and operating capacity. That action primarily serves the different objective to estimate program resources before selecting vendors. It is not the step that directly satisfies the stated need to sequence work with dependent projects.
D:Completed purchase orders do not demonstrate risk reduction. That action primarily serves the different objective to evaluate whether program investments deliver outcomes. It is not the step that directly satisfies the stated need to sequence work with dependent projects.
Question 140
A hospital's data inventory excludes confidential imaging archives managed by a research partner. A security manager has a defined assignment: assign classification based on harm and obligations. Which action BEST fulfills that specific assignment?
- Reassess permitted use, retention and access with the asset owner
- Map data sets, locations, owners and external processing relationships
- Classify patient imaging using sensitivity, clinical need and applicable duties
- Integrate discovery and owner review into the data lifecycle
Explanation
Correct Answer
C:Business impact and regulation guide classification. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Information sensitivity changes with purpose. That action primarily serves the different objective to verify classification remains correct after research scope changes. It is not the step that directly satisfies the stated need to assign classification based on harm and obligations.
B:Incomplete inventories hide sensitive information. That action primarily serves the different objective to identify all information assets in the patient workflow. It is not the step that directly satisfies the stated need to assign classification based on harm and obligations.
D:Periodic discovery limits inventory drift. That action primarily serves the different objective to detect newly created unclassified datasets. It is not the step that directly satisfies the stated need to assign classification based on harm and obligations.
