Isaca CISM Practice Test 16
Question 150
A sales organization suffered credential theft after repeated social engineering calls to its help desk. A security manager has a defined assignment: teach staff how to challenge urgent callers safely. Which action BEST fulfills that specific assignment?
- Review actual identity-proofing calls and escalation decisions
- Update training and procedural controls for the new contact channel
- Train on verification procedures and supervised escalation drills
- Test sampled reset requests and track unauthorized exceptions
Explanation
Correct Answer
C:Scenario practice improves response. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Real-world patterns reveal weaknesses. That action primarily serves the different objective to identify behavior gaps in service desk authentication. It is not the step that directly satisfies the stated need to teach staff how to challenge urgent callers safely.
B:Threat changes should alter practice. That action primarily serves the different objective to respond when attackers switch to collaboration chat. It is not the step that directly satisfies the stated need to teach staff how to challenge urgent callers safely.
D:Proof of behavior matters more than course attendance. That action primarily serves the different objective to measure effectiveness after training changes. It is not the step that directly satisfies the stated need to teach staff how to challenge urgent callers safely.
Question 151
An insurance firm finds archived customer records without usable ownership or retention tags. The accountable executive now asks the team to classify records based on business and privacy impact. What should the security manager recommend?
- Map repositories, records, owners and legal hold requirements
- Enforce retention and authorized deletion using recorded approvals
- Apply a documented sensitivity and retention taxonomy
- Review deletion logs, hold exceptions and sampled archive records
Explanation
Correct Answer
C:Different records require different handling. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Deleting unknown records may violate obligations. That action primarily serves the different objective to reconstruct the inventory before bulk deletion. It is not the step that directly satisfies the stated need to classify records based on business and privacy impact.
B:Lifecycle obligations need operating controls. That action primarily serves the different objective to implement lifecycle controls consistently. It is not the step that directly satisfies the stated need to classify records based on business and privacy impact.
D:Evidence must support claimed retention compliance. That action primarily serves the different objective to verify disposition without exposing sensitive data. It is not the step that directly satisfies the stated need to classify records based on business and privacy impact.
Question 152
An analytics platform gives administrators permanent privileged access to production datasets. After reviewing the situation, the management objective is to ensure emergency data access remains possible. Which response MOST directly addresses it?
- Reconcile entitlements with the new role and promptly revoke unneeded privileges
- Review sampled grants and test expiry against the approved role model
- Introduce just-in-time elevated roles with approval and expiry
- Define break-glass authorization and independent post-use review
Explanation
Correct Answer
D:Availability exceptions need accountability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Access must follow job responsibility. That action primarily serves the different objective to respond to an administrator changing departments. It is not the step that directly satisfies the stated need to ensure emergency data access remains possible.
B:Documentation cannot replace enforcement. That action primarily serves the different objective to validate that access is appropriately restricted. It is not the step that directly satisfies the stated need to ensure emergency data access remains possible.
C:Temporary privilege reduces persistent exposure. That action primarily serves the different objective to reduce standing privilege. It is not the step that directly satisfies the stated need to ensure emergency data access remains possible.
Question 153
A health insurer deploys a machine learning claims service and needs security controls integrated before release. For the next governance decision, the team must choose secure development requirements. Which choice BEST provides that outcome?
- Embed data minimization, access control and testing criteria into design acceptance
- Review drift, sensitive-output reports and supplier changes with risk owners
- Threat-model sensitive data use, model access and third-party dependencies
- Exercise unauthorized inference access and inspect audit events
Explanation
Correct Answer
A:Security design should precede release. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Operational conditions may change after approval. That action primarily serves the different objective to monitor post-deployment model risk. It is not the step that directly satisfies the stated need to choose secure development requirements.
C:AI workflows introduce data and model risks. That action primarily serves the different objective to identify risks to training and inference workflows. It is not the step that directly satisfies the stated need to choose secure development requirements.
D:Positive test evidence validates enforcement. That action primarily serves the different objective to test whether security controls work. It is not the step that directly satisfies the stated need to choose secure development requirements.
Question 154
A nonprofit runs yearly penetration testing but does not repair repeated high-severity findings. The security program has been tasked specifically to assign clear owners and deadlines. Which approach should be selected?
- Create accountable remediation tasks with agreed severity targets
- Update threat scenarios to include newly deployed services and data flows
- Escalate repeat findings and root causes to the responsible executives
- Rank confirmed exploitable findings by donor-system exposure and impact
Explanation
Correct Answer
A:Unowned reports cannot fix risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Test plans must reflect real architecture. That action primarily serves the different objective to improve testing scope for new platforms. It is not the step that directly satisfies the stated need to assign clear owners and deadlines.
C:Persistent patterns may need structural investment. That action primarily serves the different objective to report recurring control failure to governance. It is not the step that directly satisfies the stated need to assign clear owners and deadlines.
D:Testing value comes from risk reduction. That action primarily serves the different objective to prioritize actionable remediation. It is not the step that directly satisfies the stated need to assign clear owners and deadlines.
Question 155
A multinational's data loss prevention program blocks harmless collaboration but misses confidential file exports. A security manager has a defined assignment: select policy rules for meaningful leakage channels. Which action BEST fulfills that specific assignment?
- Reassess data egress coverage and extend approved monitoring and controls
- Measure confirmed leakage events and bypass paths by channel
- Map sensitivity labels and risky destinations to enforceable DLP conditions
- Review classification and authorized sharing patterns with data owners
Explanation
Correct Answer
C:Risk-based rules improve targeting. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:New channels can evade old rules. That action primarily serves the different objective to respond when employees use a new file-transfer service. It is not the step that directly satisfies the stated need to select policy rules for meaningful leakage channels.
B:Alert count alone is not protection. That action primarily serves the different objective to evaluate actual DLP control coverage. It is not the step that directly satisfies the stated need to select policy rules for meaningful leakage channels.
D:Rules need business context. That action primarily serves the different objective to clarify protected information and valid workflows. It is not the step that directly satisfies the stated need to select policy rules for meaningful leakage channels.
Question 156
A large university is moving endpoints to a centralized security management platform. The endpoint population includes lab machines, staff laptops and specialist research devices with different supported protection settings. The accountable executive now asks the team to define a minimum endpoint security baseline. What should the security manager recommend?
- Inventory operating systems, critical applications and management constraints
- Document exceptions with compensating controls and review dates
- Approve supported protection, hardening and telemetry settings by device class
- Report deployment percentage as proof of adequate endpoint protection before defining required safeguards for each device class
Explanation
Correct Answer
C:Baselines establish a standard. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Device diversity affects control rollout. That action primarily serves the different objective to understand unsupported devices and workloads. It is not the step that directly satisfies the stated need to define a minimum endpoint security baseline.
B:Exceptions need deliberate risk acceptance. That action primarily serves the different objective to handle endpoints that cannot support a mandatory setting. It is not the step that directly satisfies the stated need to define a minimum endpoint security baseline.
D:Enrollment statistics cannot establish a minimum security baseline. Protection, hardening and telemetry requirements must first be approved for the differing device capabilities and risks.
Question 157
An enterprise uses multiple public clouds and wants consistent access controls without forcing identical implementations. After reviewing the situation, the management objective is to map each provider's responsibility boundaries. Which response MOST directly addresses it?
- Review privilege paths and logging evidence for each implementation
- Monitor baseline deviations and assess service feature releases
- Document customer-managed and provider-managed controls per service
- Set common identity, logging and data-protection control objectives
Explanation
Correct Answer
C:Cloud responsibility varies by service model. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Similar policy names may yield different rights. That action primarily serves the different objective to test effective access across clouds. It is not the step that directly satisfies the stated need to map each provider's responsibility boundaries.
B:Cloud control behavior changes over time. That action primarily serves the different objective to detect control drift after provider changes. It is not the step that directly satisfies the stated need to map each provider's responsibility boundaries.
D:Outcomes can be comparable across platforms. That action primarily serves the different objective to define cross-cloud security outcomes. It is not the step that directly satisfies the stated need to map each provider's responsibility boundaries.
Question 158
A transport company manages thousands of certificates for vehicle APIs and fears accidental expiry. For the next governance decision, the team must define certificate renewal responsibilities. Which choice BEST provides that outcome?
- Track certificate owners, dependencies and expiration dates
- Exercise renewal and rollback on representative service paths
- Assign automated rotation ownership and emergency recovery procedures
- Alert on certificate age, failed handshakes and unexpected key use
Explanation
Correct Answer
C:Renewal needs operational accountability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Unknown credentials create outage risks. That action primarily serves the different objective to establish an accurate credential inventory. It is not the step that directly satisfies the stated need to define certificate renewal responsibilities.
B:A runbook alone may contain errors. That action primarily serves the different objective to test rotation before a major deadline. It is not the step that directly satisfies the stated need to define certificate renewal responsibilities.
D:Early warning supports prevention. That action primarily serves the different objective to monitor for impending expiration and unusual use. It is not the step that directly satisfies the stated need to define certificate renewal responsibilities.
Question 159
A national retailer plans secure coding practices for a rapidly growing delivery application. The security program has been tasked specifically to assign owners of application security requirements. Which approach should be selected?
- Embed product security responsibilities in development and release governance
- Track confirmed recurring weaknesses and time to remediate by team
- Pause release or obtain authorized risk treatment based on business impact
- Require threat modeling and risk acceptance criteria for significant features
Explanation
Correct Answer
A:Ownership prevents late-stage gaps. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Outcomes reveal process maturity. That action primarily serves the different objective to measure whether security engineering is improving. It is not the step that directly satisfies the stated need to assign owners of application security requirements.
C:Deadlines do not eliminate product risk. That action primarily serves the different objective to handle a critical flaw found before launch. It is not the step that directly satisfies the stated need to assign owners of application security requirements.
D:Early decisions affect architecture. That action primarily serves the different objective to integrate security into product planning. It is not the step that directly satisfies the stated need to assign owners of application security requirements.
Question 160
A hospital tracks security controls by purchase date and vendor name but cannot prove effectiveness. A security manager has a defined assignment: select independent validation methods. Which action BEST fulfills that specific assignment?
- Link failed tests to residual impact, remediation dates and accountable owners
- Use configuration inspection, operation sampling and controlled security tests
- Document the risk scenario and measurable preventive or detective result
- Retest the failed condition and record independent closure evidence
Explanation
Correct Answer
B:Multiple evidence types improve assurance. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Management needs impact and ownership. That action primarily serves the different objective to report ineffective controls to risk owners. It is not the step that directly satisfies the stated need to select independent validation methods.
C:Control intent must be explicit. That action primarily serves the different objective to define the expected outcome of each control. It is not the step that directly satisfies the stated need to select independent validation methods.
D:Implementation claims are not sufficient. That action primarily serves the different objective to verify correction of an identified weakness. It is not the step that directly satisfies the stated need to select independent validation methods.
