Isaca CISM Practice Test 17
Question 160
A hospital tracks security controls by purchase date and vendor name but cannot prove effectiveness. A security manager has a defined assignment: select independent validation methods. Which action BEST fulfills that specific assignment?
- Link failed tests to residual impact, remediation dates and accountable owners
- Use configuration inspection, operation sampling and controlled security tests
- Document the risk scenario and measurable preventive or detective result
- Retest the failed condition and record independent closure evidence
Explanation
Correct Answer
B:Multiple evidence types improve assurance. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Management needs impact and ownership. That action primarily serves the different objective to report ineffective controls to risk owners. It is not the step that directly satisfies the stated need to select independent validation methods.
C:Control intent must be explicit. That action primarily serves the different objective to define the expected outcome of each control. It is not the step that directly satisfies the stated need to select independent validation methods.
D:Implementation claims are not sufficient. That action primarily serves the different objective to verify correction of an identified weakness. It is not the step that directly satisfies the stated need to select independent validation methods.
Question 161
A security operations department reports thousands of alerts to senior leadership with no risk prioritization. The accountable executive now asks the team to translate operational data into meaningful risk measures. What should the security manager recommend?
- Consult risk owners about required decisions and risk thresholds
- Evaluate whether reports led to timely treatment and improve measures
- Connect confirmed incidents and control failures to impacted services
- Reconcile incident and asset records and explain uncertainty
Explanation
Correct Answer
C:Alert volume alone is ambiguous. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Reporting should serve its audience. That action primarily serves the different objective to identify business decisions the report should support. It is not the step that directly satisfies the stated need to translate operational data into meaningful risk measures.
B:A report is useful when it changes decisions. That action primarily serves the different objective to refine the reporting program from feedback. It is not the step that directly satisfies the stated need to translate operational data into meaningful risk measures.
D:Poor data quality undermines confidence. That action primarily serves the different objective to verify reported information is reliable. It is not the step that directly satisfies the stated need to translate operational data into meaningful risk measures.
Question 162
A critical infrastructure company has no agreed metrics for its identity control modernization program. After reviewing the situation, the management objective is to create a reliable measurement baseline. Which response MOST directly addresses it?
- Escalate material access gaps and accountable remediation owners
- Define privileged account coverage and verified unauthorized-access prevention targets
- Reassess what access pathways must be included in the metric
- Inventory accounts, existing controls and known exceptions before reporting progress
Explanation
Correct Answer
D:A baseline enables comparison. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Management needs actionable exceptions. That action primarily serves the different objective to inform executives of unfavorable trends. It is not the step that directly satisfies the stated need to create a reliable measurement baseline.
B:Metrics should match risk objectives. That action primarily serves the different objective to select measures based on intended risk outcomes. It is not the step that directly satisfies the stated need to create a reliable measurement baseline.
C:Changed architecture can invalidate the denominator. That action primarily serves the different objective to revise the measure after identity architecture changes. It is not the step that directly satisfies the stated need to create a reliable measurement baseline.
Question 163
A bank is implementing a zero-trust access program for remote contractors. For the next governance decision, the team must choose least-privilege access design. Which choice BEST provides that outcome?
- Map contractor identities, devices and target applications
- Require verified identity, device assurance and per-application authorization
- Automate entitlement removal using contract lifecycle triggers
- Review contractor expiry, access logs and policy exceptions
Explanation
Correct Answer
B:Broad network access is unnecessary. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Access design needs the real workflow. That action primarily serves the different objective to identify which access paths require protection. It is not the step that directly satisfies the stated need to choose least-privilege access design.
C:Lifecycle integration prevents lingering accounts. That action primarily serves the different objective to revoke access after contract completion. It is not the step that directly satisfies the stated need to choose least-privilege access design.
D:Trust decisions need periodic reassessment. That action primarily serves the different objective to verify continuous access governance. It is not the step that directly satisfies the stated need to choose least-privilege access design.
Question 164
A global retailer is launching a security communications program during a company reorganization. The security program has been tasked specifically to establish trusted communication ownership. Which approach should be selected?
- Revise unclear instructions and retest with affected audiences
- Assign approved spokespersons, update cadence and escalation routes
- Map executives, store operations, suppliers and technical teams to specific messages
- Test whether workers correctly act on critical security notices
Explanation
Correct Answer
B:Conflicting messages undermine response. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Feedback should change the program. That action primarily serves the different objective to update communication after staff feedback. It is not the step that directly satisfies the stated need to establish trusted communication ownership.
C:One message cannot serve all audiences. That action primarily serves the different objective to identify audiences and decisions they need to make. It is not the step that directly satisfies the stated need to establish trusted communication ownership.
D:Message delivery does not prove understanding. That action primarily serves the different objective to evaluate communications effectiveness. It is not the step that directly satisfies the stated need to establish trusted communication ownership.
Question 165
A government cloud migration introduces new identity and data trust boundaries not covered by the security architecture. A security manager has a defined assignment: select a reusable secure architecture pattern. Which action BEST fulfills that specific assignment?
- Map new identity federation and data paths against the enterprise threat model
- Check actual trust paths and privileged access against the approved reference
- Define identity isolation, logging and encryption reference designs for the new platform
- Use incident and assessment findings to improve architecture standards
Explanation
Correct Answer
C:Patterns support consistent decisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:New trust boundaries change exposure. That action primarily serves the different objective to identify architecture assumptions that must be updated. It is not the step that directly satisfies the stated need to select a reusable secure architecture pattern.
B:A diagram alone is insufficient. That action primarily serves the different objective to test conformance after deployment. It is not the step that directly satisfies the stated need to select a reusable secure architecture pattern.
D:Architecture must evolve with experience. That action primarily serves the different objective to adjust the reference for ongoing modernization. It is not the step that directly satisfies the stated need to select a reusable secure architecture pattern.
Question 166
A large university has deployed centralized logging but discovers critical research servers do not forward events. The security team has tested detections on enrolled servers, but the critical unmonitored hosts still do not transmit logs. The accountable executive now asks the team to implement dependable log collection. What should the security manager recommend?
- Review logging retention and access restrictions with legal and privacy owners
- Map critical research workloads to required security event types
- Standardize authenticated forwarding, time synchronization and protected retention
- Validate one detection scenario using only the research servers that were already forwarding events
Explanation
Correct Answer
C:Logs must be accurate and available. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Monitoring data also has governance duties. That action primarily serves the different objective to respond when data-retention laws change. It is not the step that directly satisfies the stated need to implement dependable log collection.
B:Coverage should follow assets and risks. That action primarily serves the different objective to identify which services create high-value detection evidence. It is not the step that directly satisfies the stated need to implement dependable log collection.
D:Testing a rule on systems with existing telemetry does not repair collection from missing research hosts. Reliable time-synchronized authenticated forwarding must be deployed and protected first.
Question 167
A financial firm moves email threat filtering to a managed security service. After reviewing the situation, the management objective is to evaluate the provider before selection. Which response MOST directly addresses it?
- Track missed detections, actionable alert timing and response quality
- Document detection scope, response authority, data access and escalation timing
- Review capability tests, assurance and resilience against the firm's requirements
- Review fourth-party access, assurance and contract obligations
Explanation
Correct Answer
C:Price is not sufficient evidence. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Service-level compliance should reflect outcomes. That action primarily serves the different objective to measure service performance after go-live. It is not the step that directly satisfies the stated need to evaluate the provider before selection.
B:Outsourcing needs precise boundaries. That action primarily serves the different objective to specify expected outcomes and service boundaries. It is not the step that directly satisfies the stated need to evaluate the provider before selection.
D:Provider changes can change the firm's risk. That action primarily serves the different objective to reassess after the provider changes its analysis subcontractor. It is not the step that directly satisfies the stated need to evaluate the provider before selection.
Question 168
A retail firm has standard operating procedures for patching, but teams say the policy gives no decision thresholds. For the next governance decision, the team must write executable patch procedures for each platform. Which choice BEST provides that outcome?
- Specify testing, change windows, rollback and escalation steps
- Sample patch records and validate deployed versions on critical systems
- Introduce emergency escalation criteria based on exposure and impact
- Define mandatory risk-based remediation objectives approved by management
Explanation
Correct Answer
A:Procedures implement policy. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:A checklist is not technical evidence. That action primarily serves the different objective to test whether procedures are followed. It is not the step that directly satisfies the stated need to write executable patch procedures for each platform.
C:Risk changes justify policy review. That action primarily serves the different objective to revise rules when actively exploited vulnerabilities surge. It is not the step that directly satisfies the stated need to write executable patch procedures for each platform.
D:Policy should state required outcomes. That action primarily serves the different objective to establish the enterprise's patch risk policy. It is not the step that directly satisfies the stated need to write executable patch procedures for each platform.
Question 169
A cloud software startup reports high test coverage but repeated access-control vulnerabilities reach production. The security program has been tasked specifically to update the test strategy. Which approach should be selected?
- Add abuse-path and privilege-boundary tests to the release pipeline
- Retest the previously exploitable authorization paths in a staging environment
- Track similar auth defects and unauthorized-access signals by service
- Review negative authorization cases across tenant and user boundaries
Explanation
Correct Answer
A:Security tests must exercise expected denial. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:A reviewed patch may still fail. That action primarily serves the different objective to verify fixes without trusting code review alone. It is not the step that directly satisfies the stated need to update the test strategy.
C:Repeated patterns reveal a systematic weakness. That action primarily serves the different objective to monitor post-release recurrence. It is not the step that directly satisfies the stated need to update the test strategy.
D:Code coverage does not prove security cases. That action primarily serves the different objective to identify why existing tests miss authorization flaws. It is not the step that directly satisfies the stated need to update the test strategy.
Question 170
An e-commerce company's board wants proof its security investment is reducing account takeover risk. A security manager has a defined assignment: account for growth in customer accounts. Which action BEST fulfills that specific assignment?
- Normalize events against active users and transaction volume
- Update event definitions and data collection to include new authentication paths
- Measure confirmed takeover incidence and effective account recovery trends
- Present residual risk, control gaps and planned investments in business terms
Explanation
Correct Answer
A:Raw counts may mislead when business grows. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Metrics need stable meaning across architecture changes. That action primarily serves the different objective to adapt the metric after new login methods are introduced. It is not the step that directly satisfies the stated need to account for growth in customer accounts.
C:Spending is an input rather than the goal. That action primarily serves the different objective to establish an outcome-focused metric. It is not the step that directly satisfies the stated need to account for growth in customer accounts.
D:The board governs exposure not tooling details. That action primarily serves the different objective to report remaining exposure to the board. It is not the step that directly satisfies the stated need to account for growth in customer accounts.
