Isaca CISM Practice Test 18
Question 170
An e-commerce company's board wants proof its security investment is reducing account takeover risk. A security manager has a defined assignment: account for growth in customer accounts. Which action BEST fulfills that specific assignment?
- Normalize events against active users and transaction volume
- Update event definitions and data collection to include new authentication paths
- Measure confirmed takeover incidence and effective account recovery trends
- Present residual risk, control gaps and planned investments in business terms
Explanation
Correct Answer
A:Raw counts may mislead when business grows. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Metrics need stable meaning across architecture changes. That action primarily serves the different objective to adapt the metric after new login methods are introduced. It is not the step that directly satisfies the stated need to account for growth in customer accounts.
C:Spending is an input rather than the goal. That action primarily serves the different objective to establish an outcome-focused metric. It is not the step that directly satisfies the stated need to account for growth in customer accounts.
D:The board governs exposure not tooling details. That action primarily serves the different objective to report remaining exposure to the board. It is not the step that directly satisfies the stated need to account for growth in customer accounts.
Question 171
An insurer is adopting confidential computing for sensitive actuarial models. The accountable executive now asks the team to integrate security architecture with operating controls. What should the security manager recommend?
- Review contractual exit, patching and emergency support arrangements
- Track attestation failures, platform updates and exception decisions
- Define attestation, key release, identity and monitoring requirements for the design
- Evaluate data-in-use risks and alternative protections with asset owners
Explanation
Correct Answer
C:Confidential computation still requires governance. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:New technology can introduce concentration risk. That action primarily serves the different objective to manage dependencies on a specialized platform vendor. It is not the step that directly satisfies the stated need to integrate security architecture with operating controls.
B:Protection can degrade with configuration drift. That action primarily serves the different objective to monitor whether the architecture stays effective. It is not the step that directly satisfies the stated need to integrate security architecture with operating controls.
D:Technology choice should follow a threat model. That action primarily serves the different objective to assess whether the technology addresses a defined threat. It is not the step that directly satisfies the stated need to integrate security architecture with operating controls.
Question 172
A regional hospital has a ransomware playbook but has never exercised it with clinical leaders. After reviewing the situation, the management objective is to identify missing decisions in the playbook. Which response MOST directly addresses it?
- Run a tabletop involving clinical downtime, executive decisions and response handoffs
- Retest previously failed decision points and record approved corrections
- Update playbook steps, training and decision thresholds based on observed weaknesses
- Record unresolved escalation, isolation and care-continuity choices from the exercise
Explanation
Correct Answer
D:Gaps should become actionable findings. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Scenario discussion exposes governance gaps without endangering patients. That action primarily serves the different objective to select a realistic readiness exercise. It is not the step that directly satisfies the stated need to identify missing decisions in the playbook.
B:Closing an action item requires evidence. That action primarily serves the different objective to verify remediation of exercise findings. It is not the step that directly satisfies the stated need to identify missing decisions in the playbook.
C:Exercises should drive measurable improvement. That action primarily serves the different objective to use lessons to improve operational readiness. It is not the step that directly satisfies the stated need to identify missing decisions in the playbook.
Question 173
A manufacturer receives alerts suggesting malware on an isolated engineering workstation. For the next governance decision, the team must preserve evidence before destructive remediation. Which choice BEST provides that outcome?
- Validate clean state, monitoring and root cause before releasing the workstation
- Capture volatile state and relevant logs using authorized procedures
- Correlate credible telemetry and asset impact before classifying severity
- Use classification and escalation thresholds to activate the appropriate response team
Explanation
Correct Answer
B:Early evidence can disappear after reboot. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Removing an alert does not prove eradication. That action primarily serves the different objective to confirm safe closure of the event. It is not the step that directly satisfies the stated need to preserve evidence before destructive remediation.
C:An alert alone is not a confirmed incident. That action primarily serves the different objective to determine whether the event is a security incident. It is not the step that directly satisfies the stated need to preserve evidence before destructive remediation.
D:Notifications should follow the incident criteria. That action primarily serves the different objective to decide who should be notified internally. It is not the step that directly satisfies the stated need to preserve evidence before destructive remediation.
Question 174
A bank discovers signs that a privileged administrator account was used outside approved working hours. The security program has been tasked specifically to prevent ongoing misuse of the suspected credential. Which approach should be selected?
- Assess systems touched, potential data exposure and verified misuse against classification criteria
- Correlate privileged session logs, approvals and the operator's work record
- Review session controls and strengthen just-in-time privileges after root-cause analysis
- Revoke risky sessions and rotate credentials under the authorized response plan
Explanation
Correct Answer
D:Credential containment can limit further access. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Severity depends on business consequence. That action primarily serves the different objective to decide whether the event triggers higher-severity escalation. It is not the step that directly satisfies the stated need to prevent ongoing misuse of the suspected credential.
B:Context is required to evaluate an anomaly. That action primarily serves the different objective to verify suspicious activity before assuming malicious intent. It is not the step that directly satisfies the stated need to prevent ongoing misuse of the suspected credential.
C:Prevention should address the exploited path. That action primarily serves the different objective to reduce future privileged account misuse. It is not the step that directly satisfies the stated need to prevent ongoing misuse of the suspected credential.
Question 175
A national retailer receives conflicting severity ratings for similar security events in different stores. A security manager has a defined assignment: clarify who is authorized to change incident severity. Which action BEST fulfills that specific assignment?
- Sample incident records and compare severity decisions with policy
- Set business impact, affected data and service criticality thresholds
- Name an incident commander with documented decision and review authority
- Review evidence and change criteria through formal response governance
Explanation
Correct Answer
C:Severity changes require accountable judgment. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A document alone does not prove consistent classification. That action primarily serves the different objective to check whether stores use the classification correctly. It is not the step that directly satisfies the stated need to clarify who is authorized to change incident severity.
B:Uniform criteria support comparable escalation. That action primarily serves the different objective to define consistent incident categorization criteria. It is not the step that directly satisfies the stated need to clarify who is authorized to change incident severity.
D:Lessons can expose inadequate thresholds. That action primarily serves the different objective to adjust thresholds after a near-miss. It is not the step that directly satisfies the stated need to clarify who is authorized to change incident severity.
Question 176
An airline needs to plan recovery of reservation and baggage systems after a regional data-center loss. The accountable executive now asks the team to determine acceptable downtime and data loss. What should the security manager recommend?
- Conduct a business impact analysis with booking, airport and operations owners
- Evaluate alternatives against the approved objectives and cost constraints
- Exercise the service dependencies and measure actual restoration against objectives
- Set business-approved recovery time and point objectives for each service
Explanation
Correct Answer
D:Recovery requirements must follow process impact. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:BIA ranks business consequences. That action primarily serves the different objective to identify which services are business-critical. It is not the step that directly satisfies the stated need to determine acceptable downtime and data loss.
B:Technical recovery should meet business targets. That action primarily serves the different objective to choose appropriate recovery architecture. It is not the step that directly satisfies the stated need to determine acceptable downtime and data loss.
C:Architecture claims need operating proof. That action primarily serves the different objective to validate the recovery approach. It is not the step that directly satisfies the stated need to determine acceptable downtime and data loss.
Question 177
A bank's continuity plan assumes backups will restore online banking within two hours, but no full restore has been tested. After reviewing the situation, the management objective is to plan an end-to-end recovery exercise. Which response MOST directly addresses it?
- Repeat the failed restoration conditions and capture completion evidence
- Escalate the shortfall and fund changes with accountable owners
- Record the untested recovery assumption as a material continuity risk
- Test application, data, identity and network restoration in a controlled environment
Explanation
Correct Answer
D:Recovery involves complete dependencies. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Follow-up confirms effectiveness. That action primarily serves the different objective to revalidate after remediation. It is not the step that directly satisfies the stated need to plan an end-to-end recovery exercise.
B:Unmet targets create residual risk. That action primarily serves the different objective to respond when the test exceeds its recovery target. It is not the step that directly satisfies the stated need to plan an end-to-end recovery exercise.
C:Untested targets are not validated capability. That action primarily serves the different objective to identify a critical gap in readiness evidence. It is not the step that directly satisfies the stated need to plan an end-to-end recovery exercise.
Question 178
A food distributor has a business continuity plan for warehouse outages but not disruption of cloud scheduling. For the next governance decision, the team must select an alternative workflow for scheduling outages. Which choice BEST provides that outcome?
- Exercise dispatch personnel and vendor handoffs during a simulation
- Update the BIA and dependency map to include cloud scheduling and logistics partners
- Develop a tested manual or secondary scheduling process with defined capacity limits
- Correct dependency, communications and staffing gaps and retest
Explanation
Correct Answer
C:Workarounds must support essential activities. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A plan unread by staff is ineffective. That action primarily serves the different objective to train staff on the alternate workflow. It is not the step that directly satisfies the stated need to select an alternative workflow for scheduling outages.
B:Continuity scope follows actual operations. That action primarily serves the different objective to identify missing critical dependencies. It is not the step that directly satisfies the stated need to select an alternative workflow for scheduling outages.
D:Exercise evidence should drive revisions. That action primarily serves the different objective to improve the plan following a failed exercise. It is not the step that directly satisfies the stated need to select an alternative workflow for scheduling outages.
Question 179
A university has copied data to a second region but disaster recovery tests fail because identity services are unavailable. The security program has been tasked specifically to add missing recovery components. Which approach should be selected?
- Analyze authentication and dependent service requirements in the recovery path
- Design tested identity, DNS and network recovery dependencies
- Time the integrated service test and compare to approved recovery objectives
- Update runbooks, owner actions and architecture, then retest
Explanation
Correct Answer
B:A complete service requires supporting systems. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Data replicas alone cannot restore access. That action primarily serves the different objective to identify why the recovery design fails. It is not the step that directly satisfies the stated need to add missing recovery components.
C:DR must meet business commitments. That action primarily serves the different objective to measure actual recovery against commitments. It is not the step that directly satisfies the stated need to add missing recovery components.
D:Repeated test failures need structural correction. That action primarily serves the different objective to correct the plan after testing reveals gaps. It is not the step that directly satisfies the stated need to add missing recovery components.
Question 180
A software vendor's incident response plan has a generic contact list but unclear decision authority during a breach. The on-call team disagrees whether a suspicious privileged-access alert warrants activating the formal incident response structure. A security manager has a defined assignment: specify when to activate the response plan. Which action BEST fulfills that specific assignment?
- Define classification triggers and callout thresholds
- Assign incident commander, legal, operations and business decision roles
- Schedule a routine annual review of incident contacts without specifying when suspected compromise activates formal response
- Run an exercise with out-of-hours contact and approval paths
Explanation
Correct Answer
A:Consistent criteria prevent activation delays. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Clear authority reduces confusion. That action primarily serves the different objective to define incident command responsibilities. It is not the step that directly satisfies the stated need to specify when to activate the response plan.
C:Periodic maintenance cannot replace defined incident classification and activation criteria. Without thresholds, responders will continue to disagree about when to mobilize.
D:Contacts may fail under realistic conditions. That action primarily serves the different objective to test communication during simulated escalation. It is not the step that directly satisfies the stated need to specify when to activate the response plan.
