Isaca CISM Practice Test 20
Question 190
A hospital detects unauthorized changes to medication inventory records but systems remain online. A security manager has a defined assignment: contain continued unauthorized modification. Which action BEST fulfills that specific assignment?
- Reconcile approved source data and verify corrections with clinical owners
- Reconcile affected transactions with trusted audit and source records
- Address the exploited authorization path and monitor sensitive record changes
- Restrict suspect identities and privileged change paths under incident authority
Explanation
Correct Answer
D:Targeted containment protects records. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Rollback without validation may propagate errors. That action primarily serves the different objective to restore trusted data carefully. It is not the step that directly satisfies the stated need to contain continued unauthorized modification.
B:Integrity failure can persist without downtime. That action primarily serves the different objective to confirm which records may be untrustworthy. It is not the step that directly satisfies the stated need to contain continued unauthorized modification.
C:Root-cause treatment closes the weakness. That action primarily serves the different objective to prevent recurrence. It is not the step that directly satisfies the stated need to contain continued unauthorized modification.
Question 191
A logistics firm restored a ransomware-affected server from backup but has not established that its data is trustworthy. The accountable executive now asks the team to ensure the intrusion path is closed. What should the security manager recommend?
- Compare trusted checkpoints and business reconciliations against restored records
- Confirm eradication and access control remediation before reconnecting
- Capture actual downtime and data loss against agreed RTO/RPO
- Incorporate incident lessons into backup, testing and validation steps
Explanation
Correct Answer
B:Reconnection may reintroduce compromise. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Restoration does not guarantee correctness. That action primarily serves the different objective to verify restored data integrity before reopening access. It is not the step that directly satisfies the stated need to ensure the intrusion path is closed.
C:Service restoration should be evaluated. That action primarily serves the different objective to measure whether objectives were met. It is not the step that directly satisfies the stated need to ensure the intrusion path is closed.
D:Future readiness needs feedback. That action primarily serves the different objective to improve the recovery procedure. It is not the step that directly satisfies the stated need to ensure the intrusion path is closed.
Question 192
A security team closes an incident when malware is removed but never examines why privileged access was granted. After reviewing the situation, the management objective is to record what went well and poorly during response. Which response MOST directly addresses it?
- Conduct a structured cross-functional post-incident review
- Report material weaknesses and treatment commitments to risk authorities
- Retest the originally exploited pathway and monitoring gaps
- Trace authorization, process and technology failures that enabled the breach
Explanation
Correct Answer
A:Improvement requires candid evidence. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Executive oversight needs consequences. That action primarily serves the different objective to inform governance of residual exposure. It is not the step that directly satisfies the stated need to record what went well and poorly during response.
C:Closure should reflect outcomes. That action primarily serves the different objective to verify corrective actions reduce risk. It is not the step that directly satisfies the stated need to record what went well and poorly during response.
D:Removing malware is not causal analysis. That action primarily serves the different objective to identify the root cause beyond the immediate symptom. It is not the step that directly satisfies the stated need to record what went well and poorly during response.
Question 193
A logistics company historically tested incident communications only in daylight hours despite a major overnight outage. The latest night drill met its aggregate timing target but several vendor handoffs were not acknowledged. For the next governance decision, the team must identify failed contact dependencies. Which choice BEST provides that outcome?
- Repeat the failed callout sequence and measure response against target
- Trigger contact-list updates and brief drills when roles change
- Record unreachable owners and delayed vendor acknowledgments
- Repeat the overnight callout test and record only the total elapsed response time
Explanation
Correct Answer
C:Exercise gaps require specifics. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Changes require retesting. That action primarily serves the different objective to verify remediation of communication gaps. It is not the step that directly satisfies the stated need to identify failed contact dependencies.
B:Readiness records age quickly. That action primarily serves the different objective to maintain readiness after staff turnover. It is not the step that directly satisfies the stated need to identify failed contact dependencies.
D:An aggregate elapsed time conceals which business owner or vendor acknowledgement failed. The present diagnosis requires identifying each unreachable contact and dependent escalation route.
Question 194
A multinational organization activates incident response simultaneously in multiple countries but has no unified incident commander. The security program has been tasked specifically to coordinate national legal and privacy requirements. Which approach should be selected?
- Include coordination failures in post-incident improvements
- Define a lead incident commander and delegated regional responsibilities
- Use business impact and command authority to resolve cross-border tradeoffs
- Assign local legal leads to the global response team and map jurisdiction triggers
Explanation
Correct Answer
D:Response needs local compliance expertise. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Governance must learn from the event. That action primarily serves the different objective to review cross-region decision delays. It is not the step that directly satisfies the stated need to coordinate national legal and privacy requirements.
B:One command model reduces conflicting containment. That action primarily serves the different objective to establish an incident command structure. It is not the step that directly satisfies the stated need to coordinate national legal and privacy requirements.
C:Containment can have global consequences. That action primarily serves the different objective to manage conflicting containment requests. It is not the step that directly satisfies the stated need to coordinate national legal and privacy requirements.
Question 195
A university's security center labels every phishing report as a high-severity incident. A security manager has a defined assignment: prioritize investigative effort. Which action BEST fulfills that specific assignment?
- Update analyst guidance and retrain teams on classification examples
- Sample incident records and compare ratings with defined criteria
- Triage indicators, exposure and critical service impact under approved rules
- Define validation and categorization criteria based on evidence and impact
Explanation
Correct Answer
C:Resource allocation depends on severity. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Clear criteria improve consistency. That action primarily serves the different objective to refine procedures after repeated false positives. It is not the step that directly satisfies the stated need to prioritize investigative effort.
B:Classification quality can be tested. That action primarily serves the different objective to measure misclassification trends. It is not the step that directly satisfies the stated need to prioritize investigative effort.
D:Severity should follow actual consequences. That action primarily serves the different objective to distinguish reports from confirmed compromise. It is not the step that directly satisfies the stated need to prioritize investigative effort.
Question 196
A fintech must update executives while investigators still disagree over whether customer data was exposed. The accountable executive now asks the team to document the current incident impact. What should the security manager recommend?
- Publish an authorized update explaining material factual changes
- Link affected services, data categories and operational losses to evidence
- Have legal counsel determine triggering facts and deadlines for applicable laws
- Issue a status report showing known facts, unknowns and next verification steps
Explanation
Correct Answer
B:Impact statements need support. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Communications must stay accurate. That action primarily serves the different objective to correct previous status when evidence changes. It is not the step that directly satisfies the stated need to document the current incident impact.
C:Notification is not solely a technical judgment. That action primarily serves the different objective to coordinate any legal notifications. It is not the step that directly satisfies the stated need to document the current incident impact.
D:Transparent uncertainty avoids false claims. That action primarily serves the different objective to separate verified facts from unconfirmed hypotheses. It is not the step that directly satisfies the stated need to document the current incident impact.
Question 197
A public utility has isolated an affected control-system host after a breach, and the team must verify it is clean before full restoration. After reviewing the situation, the management objective is to sequence recovery around safety needs. Which response MOST directly addresses it?
- Test operational control and communications end to end before handback
- Coordinate controlled restoration with engineering and safety teams
- Document recovery evidence, residual exposure and lessons for governance
- Validate the environment against known indicators and required baselines
Explanation
Correct Answer
B:Recovery must protect physical operations. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Network availability does not guarantee process safety. That action primarily serves the different objective to validate dependent business processes. It is not the step that directly satisfies the stated need to sequence recovery around safety needs.
C:A closeout supports accountability. That action primarily serves the different objective to complete the incident record. It is not the step that directly satisfies the stated need to sequence recovery around safety needs.
D:An infected host can reinfect systems. That action primarily serves the different objective to confirm eradication before declaring normal operations. It is not the step that directly satisfies the stated need to sequence recovery around safety needs.
Question 198
A bank suspects a cyberattack on an interbank settlement gateway with extremely limited tolerated downtime. For the next governance decision, the team must invoke the right business authority for high-impact action. Which choice BEST provides that outcome?
- Escalate to approved crisis and settlement risk decision makers
- Assess architecture resilience and alternate settlement routes with business owners
- Review network and transaction telemetry against known indicators
- Coordinate selective isolation with payment operations and regulators as appropriate
Explanation
Correct Answer
A:Security engineers cannot unilaterally accept systemic effects. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Systemic dependencies can warrant redesign. That action primarily serves the different objective to review strategic dependencies after stabilization. It is not the step that directly satisfies the stated need to invoke the right business authority for high-impact action.
C:A firewall change is not proof of containment. That action primarily serves the different objective to verify that targeted containment blocks the attack path. It is not the step that directly satisfies the stated need to invoke the right business authority for high-impact action.
D:Broad shutdown could cause systemic impact. That action primarily serves the different objective to define a containment option that preserves critical processing. It is not the step that directly satisfies the stated need to invoke the right business authority for high-impact action.
Question 199
A manufacturing group relies on one outsourced cloud identity service for business continuity across every plant. The security program has been tasked specifically to define a workable continuity approach. Which approach should be selected?
- Map cloud identity availability to safety, production and remote access workflows
- Exercise the dependency failure and verify operational targets
- Assess contract resilience, alternate providers and residual shared risk
- Design and test approved identity fallback or alternate access arrangements
Explanation
Correct Answer
D:Continuity needs an executable alternative. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Shared dependencies can concentrate outage impact. That action primarily serves the different objective to identify the common dependency across plants. It is not the step that directly satisfies the stated need to define a workable continuity approach.
B:A plan may fail at scale. That action primarily serves the different objective to test a cloud identity outage across plants. It is not the step that directly satisfies the stated need to define a workable continuity approach.
C:One service can affect all plants. That action primarily serves the different objective to review provider concentration exposure. It is not the step that directly satisfies the stated need to define a workable continuity approach.
Question 200
A government data center has backups but no plan to reconstruct application dependencies after a major outage. A security manager has a defined assignment: set business-approved recovery targets. Which action BEST fulfills that specific assignment?
- Map identities, databases, networks and application dependencies
- Exercise full-service restoration and validate business transactions
- Assign fixes, fund missing capacity and retest failed dependencies
- Use BIA findings to define RTO/RPO for affected services
Explanation
Correct Answer
D:Technical targets need business justification. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Recovery order affects service usability. That action primarily serves the different objective to establish the sequence needed for recovery. It is not the step that directly satisfies the stated need to set business-approved recovery targets.
B:Backup existence does not prove recoverability. That action primarily serves the different objective to verify recoverability in a realistic environment. It is not the step that directly satisfies the stated need to set business-approved recovery targets.
C:Gaps require verified remediation. That action primarily serves the different objective to close observed recovery gaps. It is not the step that directly satisfies the stated need to set business-approved recovery targets.
