Isaca CISM Practice Test 15
Question 140
A hospital's data inventory excludes confidential imaging archives managed by a research partner. A security manager has a defined assignment: assign classification based on harm and obligations. Which action BEST fulfills that specific assignment?
- Reassess permitted use, retention and access with the asset owner
- Map data sets, locations, owners and external processing relationships
- Classify patient imaging using sensitivity, clinical need and applicable duties
- Integrate discovery and owner review into the data lifecycle
Explanation
Correct Answer
C:Business impact and regulation guide classification. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Information sensitivity changes with purpose. That action primarily serves the different objective to verify classification remains correct after research scope changes. It is not the step that directly satisfies the stated need to assign classification based on harm and obligations.
B:Incomplete inventories hide sensitive information. That action primarily serves the different objective to identify all information assets in the patient workflow. It is not the step that directly satisfies the stated need to assign classification based on harm and obligations.
D:Periodic discovery limits inventory drift. That action primarily serves the different objective to detect newly created unclassified datasets. It is not the step that directly satisfies the stated need to assign classification based on harm and obligations.
Question 141
A telecommunications firm cannot identify who owns encryption of call records stored across cloud platforms. The accountable executive now asks the team to identify where records are stored and replicated. What should the security manager recommend?
- Produce an approved data-flow and storage inventory including backup copies
- Review encryption configurations and key-access evidence across all copies
- Separate key ownership, privileged access and independent logging
- Assign the service owner to data risk and platform teams to control execution
Explanation
Correct Answer
A:Encryption scope depends on actual locations. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:A policy does not prove every replica is protected. That action primarily serves the different objective to evaluate whether data protection operates as intended. It is not the step that directly satisfies the stated need to identify where records are stored and replicated.
C:Key access can undermine encryption. That action primarily serves the different objective to prevent unmanaged key administrators. It is not the step that directly satisfies the stated need to identify where records are stored and replicated.
D:Data accountability and technical operation differ. That action primarily serves the different objective to define ownership for the records and storage controls. It is not the step that directly satisfies the stated need to identify where records are stored and replicated.
Question 142
A nonprofit is aligning its security program with a standard framework for donor confidence. After reviewing the situation, the management objective is to establish a common language for control ownership. Which response MOST directly addresses it?
- Obtain test evidence for selected controls and documented exceptions
- Reassess control applicability for changed technology and partners
- Map relevant framework outcomes to donor-data and mission risks
- Create a control catalog with consistent definitions and responsible roles
Explanation
Correct Answer
D:A common taxonomy supports oversight. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Self-declaration alone is weak assurance. That action primarily serves the different objective to validate claims of conformity. It is not the step that directly satisfies the stated need to establish a common language for control ownership.
B:Framework scope should follow service changes. That action primarily serves the different objective to refresh the framework mapping after new cloud services. It is not the step that directly satisfies the stated need to establish a common language for control ownership.
C:Framework adoption must be tailored to context. That action primarily serves the different objective to choose a framework without treating it as a complete risk analysis. It is not the step that directly satisfies the stated need to establish a common language for control ownership.
Question 143
A manufacturing group has security policy documents with inconsistent terminology and obsolete operating steps. For the next governance decision, the team must identify document ownership. Which choice BEST provides that outcome?
- Establish a hierarchy of policy, standards, procedures and advisory guidelines
- Assign approvals, review dates and business-control owners
- Require documented risk acceptance with compensating controls and expiry
- Observe operations and compare evidence with required standards
Explanation
Correct Answer
B:Unowned documents become stale. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Different document types serve different authority levels. That action primarily serves the different objective to separate mandatory policy intent from detailed instructions. It is not the step that directly satisfies the stated need to identify document ownership.
C:An exception should remain controlled. That action primarily serves the different objective to manage exceptions for a machine that cannot support the standard. It is not the step that directly satisfies the stated need to identify document ownership.
D:Publication alone does not show compliance. That action primarily serves the different objective to confirm control procedures are followed. It is not the step that directly satisfies the stated need to identify document ownership.
Question 144
A software provider must reduce unauthorized production database changes without delaying legitimate releases. The security program has been tasked specifically to ensure changes follow the intended path. Which approach should be selected?
- Integrate approval evidence into the automated deployment workflow
- Use emergency change authority with retrospective independent review
- Require independent approval and least-privilege access for sensitive deployment actions
- Alert on direct privileged writes outside approved deployment workflows
Explanation
Correct Answer
A:A policy alone cannot stop bypass. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Emergency processes need accountability. That action primarily serves the different objective to handle an emergency fix under a defined exception. It is not the step that directly satisfies the stated need to ensure changes follow the intended path.
C:Segregation reduces self-approved changes. That action primarily serves the different objective to select controls based on the production change risk. It is not the step that directly satisfies the stated need to ensure changes follow the intended path.
D:Operational signals reveal control failures. That action primarily serves the different objective to monitor changes that bypass approved release paths. It is not the step that directly satisfies the stated need to ensure changes follow the intended path.
Question 145
A retail group is deploying network access controls across stores that use many third-party maintenance devices. Maintenance devices connect to both low-trust vendor networks and high-availability production services, requiring a defensible segmentation design. A security manager has a defined assignment: choose segmentation boundaries for maintenance devices. Which action BEST fulfills that specific assignment?
- Isolate device groups according to trust and business dependency
- Apply the existing standard contractor-device VLAN to every maintenance system regardless of its production dependencies
- Inventory device paths and critical service communications
- Test blocked cross-zone paths and required allowed services
Explanation
Correct Answer
A:Segmentation limits compromise propagation. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:A uniform contractor VLAN ignores differences in trust level and critical production flows. The first design decision is risk-based isolation boundaries informed by business dependencies.
C:Unknown flows can cause operational outages. That action primarily serves the different objective to map actual dependencies before control rollout. It is not the step that directly satisfies the stated need to choose segmentation boundaries for maintenance devices.
D:Configuration alone cannot prove segmentation. That action primarily serves the different objective to verify the network controls enforce the design. It is not the step that directly satisfies the stated need to choose segmentation boundaries for maintenance devices.
Question 146
A payment processor has installed a web application firewall but still sees injection attempts reaching applications. The accountable executive now asks the team to identify why detection and blocking differ. What should the security manager recommend?
- Analyze rule configuration, exceptions and application routing
- Record test methods, observed bypasses and control owner responses
- Retest the previously successful attack paths under normal traffic conditions
- Use authorized attack simulations and application telemetry to test blocking
Explanation
Correct Answer
A:Misconfiguration can undermine designed controls. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Reproducible results support accountability. That action primarily serves the different objective to preserve evidence for governance decisions. It is not the step that directly satisfies the stated need to identify why detection and blocking differ.
C:Closure requires demonstrated improvement. That action primarily serves the different objective to verify improvements after tuning. It is not the step that directly satisfies the stated need to identify why detection and blocking differ.
D:A deployed firewall is not proof of protection. That action primarily serves the different objective to establish whether the control is effective. It is not the step that directly satisfies the stated need to identify why detection and blocking differ.
Question 147
A utilities firm conducts annual cyber training but plant operators still approve suspicious remote access requests. After reviewing the situation, the management objective is to develop relevant training scenarios. Which response MOST directly addresses it?
- Use realistic contractor remote-access and safety workflows
- Analyze root causes and rework targeted lessons before retesting
- Provide job aids and supervisor checks at access approval points
- Map operational technology access decisions to plant job responsibilities
Explanation
Correct Answer
A:Practice must match actual decisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Measured gaps should shape program content. That action primarily serves the different objective to adjust training after repeated drill failures. It is not the step that directly satisfies the stated need to develop relevant training scenarios.
C:Workflow reinforcement supports retention. That action primarily serves the different objective to reinforce the behavior in everyday work. It is not the step that directly satisfies the stated need to develop relevant training scenarios.
D:Generic material may miss role-specific risks. That action primarily serves the different objective to identify which roles need specialized training. It is not the step that directly satisfies the stated need to develop relevant training scenarios.
Question 148
A logistics firm moves its vehicle-tracking platform to a managed SaaS provider. For the next governance decision, the team must make security duties enforceable. Which choice BEST provides that outcome?
- Test access to exportable data and an alternate service transition path
- Require approval and impact assessment under supplier governance terms
- Review security controls, data flows, financial stability and service dependencies
- Add incident notice, audit rights, availability and data-return terms to the contract
Explanation
Correct Answer
D:Controls need contractual accountability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Exit readiness limits lock-in exposure. That action primarily serves the different objective to plan an orderly exit if the supplier fails. It is not the step that directly satisfies the stated need to make security duties enforceable.
B:Fourth-party changes can alter risk. That action primarily serves the different objective to manage a proposed subprocessor change. It is not the step that directly satisfies the stated need to make security duties enforceable.
C:Onboarding should be risk based. That action primarily serves the different objective to assess the supplier before contracting. It is not the step that directly satisfies the stated need to make security duties enforceable.
Question 149
A bank's cloud vendor depends on another company for physical data-center operations. The security program has been tasked specifically to define which assurance evidence is needed. Which approach should be selected?
- Map the provider's critical subcontractors and which controls they operate
- Escalate through the prime supplier and assess alternative service arrangements
- Evaluate correlated outages and recovery dependence across providers
- Obtain relevant reports and contract flow-down evidence for high-impact subcontractors
Explanation
Correct Answer
D:Primary supplier reports may not cover downstream work. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Invisible dependencies can concentrate risk. That action primarily serves the different objective to identify material fourth-party dependencies. It is not the step that directly satisfies the stated need to define which assurance evidence is needed.
B:The enterprise retains responsibility for service continuity. That action primarily serves the different objective to address a critical subcontractor's control failure. It is not the step that directly satisfies the stated need to define which assurance evidence is needed.
C:Multiple brands can share one failure domain. That action primarily serves the different objective to monitor concentration risk from common facilities. It is not the step that directly satisfies the stated need to define which assurance evidence is needed.
Question 150
A sales organization suffered credential theft after repeated social engineering calls to its help desk. A security manager has a defined assignment: teach staff how to challenge urgent callers safely. Which action BEST fulfills that specific assignment?
- Review actual identity-proofing calls and escalation decisions
- Update training and procedural controls for the new contact channel
- Train on verification procedures and supervised escalation drills
- Test sampled reset requests and track unauthorized exceptions
Explanation
Correct Answer
C:Scenario practice improves response. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Real-world patterns reveal weaknesses. That action primarily serves the different objective to identify behavior gaps in service desk authentication. It is not the step that directly satisfies the stated need to teach staff how to challenge urgent callers safely.
B:Threat changes should alter practice. That action primarily serves the different objective to respond when attackers switch to collaboration chat. It is not the step that directly satisfies the stated need to teach staff how to challenge urgent callers safely.
D:Proof of behavior matters more than course attendance. That action primarily serves the different objective to measure effectiveness after training changes. It is not the step that directly satisfies the stated need to teach staff how to challenge urgent callers safely.
