Isaca CISM Practice Test 21
Question 200
A government data center has backups but no plan to reconstruct application dependencies after a major outage. A security manager has a defined assignment: set business-approved recovery targets. Which action BEST fulfills that specific assignment?
- Map identities, databases, networks and application dependencies
- Exercise full-service restoration and validate business transactions
- Assign fixes, fund missing capacity and retest failed dependencies
- Use BIA findings to define RTO/RPO for affected services
Explanation
Correct Answer
D:Technical targets need business justification. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Recovery order affects service usability. That action primarily serves the different objective to establish the sequence needed for recovery. It is not the step that directly satisfies the stated need to set business-approved recovery targets.
B:Backup existence does not prove recoverability. That action primarily serves the different objective to verify recoverability in a realistic environment. It is not the step that directly satisfies the stated need to set business-approved recovery targets.
C:Gaps require verified remediation. That action primarily serves the different objective to close observed recovery gaps. It is not the step that directly satisfies the stated need to set business-approved recovery targets.
Question 201
A multinational retailer has acquired regional chains whose store leaders use different security approval practices. After reviewing the situation, the management objective is to gain support for security integration without ignoring retail operations. Which response MOST directly addresses it?
- Review exception frequency and completion of control milestones by region
- Interview regional leaders and map actual exception practices before designing the integration
- Present a business case linking prioritized security changes to store uptime and loss exposure
- Publish a responsibility matrix approved by regional executives and the enterprise risk committee
Explanation
Correct Answer
C:A business-aligned case explains why controls matter to revenue operations. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Regional evidence shows whether the governance rollout works. That action primarily serves the different objective to evaluate whether store practices are converging toward the target. It is not the step that directly satisfies the stated need to gain support for security integration without ignoring retail operations.
B:Observed decision behavior reveals gaps that a generic global policy cannot show. That action primarily serves the different objective to identify which local behaviors weaken the common control model. It is not the step that directly satisfies the stated need to gain support for security integration without ignoring retail operations.
D:Named owners prevent local exceptions from becoming ungoverned decisions. That action primarily serves the different objective to define accountable security decision-makers across the acquired chains. It is not the step that directly satisfies the stated need to gain support for security integration without ignoring retail operations.
Question 202
A healthcare provider is opening clinics in jurisdictions with differing privacy, retention and breach-notification duties. For the next governance decision, the team must assign responsibility for tracking changing patient-data rules. Which choice BEST provides that outcome?
- Name compliance owners and a review cadence for each jurisdiction
- Create a jurisdiction-by-data-type obligations register reviewed with legal counsel
- Trigger a privacy and security requirements review before patient records are collected
- Ask legal counsel to document controlling requirements and the permissible treatment for each data flow
Explanation
Correct Answer
A:Without owners legal changes may never reach the control framework. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Documented requirements prevent a global default from violating a local obligation. That action primarily serves the different objective to identify obligations before deciding on one global retention setting. It is not the step that directly satisfies the stated need to assign responsibility for tracking changing patient-data rules.
C:Early assessment avoids retrofitting controls after processing begins. That action primarily serves the different objective to handle a proposed clinic expansion into a new jurisdiction. It is not the step that directly satisfies the stated need to assign responsibility for tracking changing patient-data rules.
D:Legal interpretation must precede a conflicting operating rule. That action primarily serves the different objective to resolve an apparent conflict between contract and local law. It is not the step that directly satisfies the stated need to assign responsibility for tracking changing patient-data rules.
Question 203
A logistics company has separate security, IT operations and business risk committees that keep overruling one another. The security program has been tasked specifically to separate security oversight from operational execution. Which approach should be selected?
- Assign the security committee oversight of risk while process owners implement controls
- Establish a single approved decision hierarchy and cross-committee referral path
- Define business risk owner authority and escalation thresholds in a governance charter
- Escalate the documented residual risk to the designated senior risk authority
Explanation
Correct Answer
A:Independent oversight avoids self-approval of effectiveness. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:A clear hierarchy resolves overlapping mandates. That action primarily serves the different objective to prevent conflicting policy decisions among committees. It is not the step that directly satisfies the stated need to separate security oversight from operational execution.
C:Business accountability cannot be replaced by an IT-only vote. That action primarily serves the different objective to clarify who can authorize acceptance of delivery-platform risk. It is not the step that directly satisfies the stated need to separate security oversight from operational execution.
D:A local project lead cannot approve exposures above the established delegation. That action primarily serves the different objective to settle a disputed exception that exceeds delegated authority. It is not the step that directly satisfies the stated need to separate security oversight from operational execution.
Question 204
An insurer's board wants a cyber strategy for its transition from branch offices to online customer services. Finance has requested a decision-ready justification for two mutually exclusive identity-platform investments. A security manager has a defined assignment: gain authorization for security strategy investments. Which action BEST fulfills that specific assignment?
- Present expected business benefits, risk exposure and alternative investment options
- Reassess the security strategy against the revised business plan and threat landscape
- List desired online security capabilities for the board without quantifying investment alternatives, costs or remaining exposure
- Prioritize initiatives by risk reduction, dependencies and business delivery dates
Explanation
Correct Answer
A:Executives approve defensible business tradeoffs, not an uncosted technology list. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:A change in business direction can invalidate old assumptions. That action primarily serves the different objective to refresh the strategy after major online platform changes. It is not the step that directly satisfies the stated need to gain authorization for security strategy investments.
C:A capability list can support strategic alignment, but it cannot substantiate the financial approval decision. A decision-ready business case must compare benefits, risk exposure and alternatives.
D:A sequenced roadmap makes limited resources actionable. That action primarily serves the different objective to choose an ordered plan when funds cannot cover every initiative. It is not the step that directly satisfies the stated need to gain authorization for security strategy investments.
Question 205
A payments firm is adopting a common security framework across independently managed subsidiaries. The accountable executive now asks the team to allocate decision rights for framework exceptions. What should the security manager recommend?
- Map framework objectives to business risks, obligations and existing control capabilities
- Perform a gap assessment of the acquired control model before extending mandatory requirements
- Publish an enterprise control taxonomy and agreed definitions for reporting
- Require authorized business risk owners to approve documented deviations
Explanation
Correct Answer
D:Exception decisions remain accountable to the risk-taking business. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Tailoring preserves relevance to enterprise conditions. That action primarily serves the different objective to select a governance framework without blindly inheriting every control. It is not the step that directly satisfies the stated need to allocate decision rights for framework exceptions.
B:Integration needs evidence of compatibility and unresolved risk. That action primarily serves the different objective to revisit the framework after a major acquisition. It is not the step that directly satisfies the stated need to allocate decision rights for framework exceptions.
C:Common terms make cross-subsidiary evidence comparable. That action primarily serves the different objective to establish consistency when subsidiaries use different terminology. It is not the step that directly satisfies the stated need to allocate decision rights for framework exceptions.
Question 206
A university has too little capital to execute all proposed security initiatives before the academic year. After reviewing the situation, the management objective is to avoid funding a program with no accountable outcomes. Which response MOST directly addresses it?
- Develop a business case with alternatives, cost, residual risk and expected benefits
- Bring a revised scope and investment justification to the appropriate sponsor
- Attach approved owners, milestones and measurable results to each funded initiative
- Use risk reduction, educational-service impact and dependencies to rank proposals
Explanation
Correct Answer
C:Accountable plans prevent untracked spending. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Tradeoff evidence supports a prudent board decision. That action primarily serves the different objective to defend a proposed network security investment. It is not the step that directly satisfies the stated need to avoid funding a program with no accountable outcomes.
B:Material budget changes need a renewed decision. That action primarily serves the different objective to respond when an approved project's cost rises materially. It is not the step that directly satisfies the stated need to avoid funding a program with no accountable outcomes.
D:Business consequences establish funding priority. That action primarily serves the different objective to determine which proposals deserve funding priority. It is not the step that directly satisfies the stated need to avoid funding a program with no accountable outcomes.
Question 207
An industrial manufacturer is moving from a command-driven security culture to a cross-functional safety culture. For the next governance decision, the team must make requirements credible to shift supervisors. Which choice BEST provides that outcome?
- Translate security policy into plant-specific instructions with visible leadership sponsorship
- Use interviews and workflow observations to identify pressure points before revising controls
- Enforce the documented exception and risk-acceptance escalation route
- Include plant operations and safety representatives in security governance decisions
Explanation
Correct Answer
A:Local procedures need practical management backing. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Unsafe workarounds can be caused by workflow conflicts. That action primarily serves the different objective to understand why workers bypass the new cyber procedures. It is not the step that directly satisfies the stated need to make requirements credible to shift supervisors.
C:A supervisor cannot silently bypass enterprise risk authority. That action primarily serves the different objective to respond to a supervisor who informally waives a critical control. It is not the step that directly satisfies the stated need to make requirements credible to shift supervisors.
D:Ownership grows when controls reflect actual plant tasks. That action primarily serves the different objective to obtain worker participation in security design. It is not the step that directly satisfies the stated need to make requirements credible to shift supervisors.
Question 208
A global e-commerce company outsources payment processing while remaining accountable for customer information. The security program has been tasked specifically to verify performance after the processing contract begins. Which approach should be selected?
- Review independent assurance evidence and unresolved findings against contracted controls
- Include measurable security, audit, incident notice and subcontractor provisions in the contract
- Maintain a traceable record of processor assurance and organizational compensating controls
- Map statutory and contractual accountability to the company and processor with legal review
Explanation
Correct Answer
A:Continuous oversight is necessary after onboarding. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Contract rights support oversight and remediation. That action primarily serves the different objective to make the processor's control commitments enforceable. It is not the step that directly satisfies the stated need to verify performance after the processing contract begins.
C:Evidence must show which party operates each required safeguard. That action primarily serves the different objective to support customers requesting audit evidence. It is not the step that directly satisfies the stated need to verify performance after the processing contract begins.
D:Outsourcing performance does not erase the organization's compliance duties. That action primarily serves the different objective to determine which compliance responsibilities cannot be delegated. It is not the step that directly satisfies the stated need to verify performance after the processing contract begins.
Question 209
An energy company has created a new CISO role, but line executives assume it owns every cyber risk. A security manager has a defined assignment: prevent controls from being judged only by their designers. Which action BEST fulfills that specific assignment?
- Document that business process owners accept their risks while the CISO advises and monitors
- Approve a governance charter linking the CISO, risk committee and board
- Test risk-owner decisions in real cases and report unresolved role conflicts
- Separate implementation responsibility from independent control assurance
Explanation
Correct Answer
D:A self-review may conceal failures. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:The security function facilitates risk governance but cannot own all business decisions. That action primarily serves the different objective to explain ownership of business information risk. It is not the step that directly satisfies the stated need to prevent controls from being judged only by their designers.
B:Governance must provide access to decision makers. That action primarily serves the different objective to give the CISO a formal escalation path. It is not the step that directly satisfies the stated need to prevent controls from being judged only by their designers.
C:An organization chart alone does not prove accountable practice. That action primarily serves the different objective to judge whether responsibilities are actually understood. It is not the step that directly satisfies the stated need to prevent controls from being judged only by their designers.
Question 210
A bank wants to expand into embedded finance partnerships and expose customer APIs to third parties. The accountable executive now asks the team to present options for security investment to the board. What should the security manager recommend?
- Identify partner/API risk scenarios and link them to business growth objectives
- Compare risk and business impact of alternative API protection approaches
- Build an architecture-driven security roadmap with business launch gates
- Revisit risk appetite, contract obligations and capacity forecasts for the enlarged ecosystem
Explanation
Correct Answer
B:Decision makers need options framed in business consequences. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Security strategy must account for new revenue channels. That action primarily serves the different objective to incorporate ecosystem dependence into the security strategy. It is not the step that directly satisfies the stated need to present options for security investment to the board.
C:Dependencies avoid releasing an ungoverned interface. That action primarily serves the different objective to prioritize controls that are dependencies for partner launch. It is not the step that directly satisfies the stated need to present options for security investment to the board.
D:Growth may outstrip previously accepted exposure. That action primarily serves the different objective to check strategic assumptions after partnership expansion. It is not the step that directly satisfies the stated need to present options for security investment to the board.
