Isaca CISM Practice Test 23
Question 220
A fintech discovers that its production API has an unpatched weakness but compensating controls restrict exploitability. The accountable executive now asks the team to choose an interim response if code remediation is delayed. What should the security manager recommend?
- Record the service owner as risk owner with security providing challenge
- Validate reachability, authentication barriers and business impact of exploitation
- Require tested compensating controls with an approved expiry and patch date
- Verify the fixed API and retire exceptions only after retesting
Explanation
Correct Answer
C:Temporary measures need limits and ownership. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Operations owns the risk from its service. That action primarily serves the different objective to assign accountability for the vulnerability decision. It is not the step that directly satisfies the stated need to choose an interim response if code remediation is delayed.
B:A severity score alone does not measure realized business risk. That action primarily serves the different objective to establish how exposed the weakness is in context. It is not the step that directly satisfies the stated need to choose an interim response if code remediation is delayed.
D:A change ticket is not evidence the weakness was resolved. That action primarily serves the different objective to close the issue appropriately. It is not the step that directly satisfies the stated need to choose an interim response if code remediation is delayed.
Question 221
A bank estimates fraud exposure for a new mobile payment feature with incomplete loss data. After reviewing the situation, the management objective is to communicate confidence in the assessment. Which response MOST directly addresses it?
- Present ranges and evidence quality alongside the risk rating
- Use documented loss ranges, assumptions and sensitivity scenarios instead of one false-precision number
- Update loss assumptions using actual fraud and control performance evidence
- Assess fraud loss, regulatory exposure and customer trust against business objectives
Explanation
Correct Answer
A:A point score can conceal weak supporting data. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Uncertainty must remain visible to decision makers. That action primarily serves the different objective to select an analysis appropriate to uncertain loss estimates. It is not the step that directly satisfies the stated need to communicate confidence in the assessment.
C:New evidence can change the prior decision. That action primarily serves the different objective to reassess after initial transaction data becomes available. It is not the step that directly satisfies the stated need to communicate confidence in the assessment.
D:Impact spans more than direct monetary theft. That action primarily serves the different objective to identify the consequences that matter to the business. It is not the step that directly satisfies the stated need to communicate confidence in the assessment.
Question 222
A manufacturer reports high cyber risk in its industrial control network, but its IT department claims ownership of the exposure. For the next governance decision, the team must resolve conflicting risk responses across plants. Which choice BEST provides that outcome?
- Assign accountable plant engineering and IT control owners with clear interfaces
- Assign the plant business executive as risk owner and security as adviser
- Report control health and operating exceptions to plant risk owners
- Escalate decisions above local tolerance through the enterprise risk authority
Explanation
Correct Answer
D:Plant managers cannot accept exposures beyond delegated appetite. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Risk ownership and control execution are distinct. That action primarily serves the different objective to establish who implements the selected security controls. It is not the step that directly satisfies the stated need to resolve conflicting risk responses across plants.
B:Business executives own operational impact. That action primarily serves the different objective to determine who can accept the production shutdown consequence. It is not the step that directly satisfies the stated need to resolve conflicting risk responses across plants.
C:An accepted risk requires ongoing observation. That action primarily serves the different objective to validate that residual risk is being monitored. It is not the step that directly satisfies the stated need to resolve conflicting risk responses across plants.
Question 223
A cloud retailer cannot immediately remove a legacy authentication dependency in a critical order system. The security program has been tasked specifically to decide who may accept the remaining customer-order risk. Which approach should be selected?
- Require time-limited risk treatment with approved controls and milestones
- Seek acceptance from the authorized business risk executive
- Reassess residual exposure against fresh threat evidence before the exception expires
- Reduce reachable attack paths and impose stronger compensating authentication monitoring
Explanation
Correct Answer
B:A security engineer cannot accept enterprise revenue consequences. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Temporary acceptance must have an end condition. That action primarily serves the different objective to avoid leaving an unbounded vulnerability exception. It is not the step that directly satisfies the stated need to decide who may accept the remaining customer-order risk.
C:Approval cannot be treated as permanent. That action primarily serves the different objective to determine whether acceptance should be renewed. It is not the step that directly satisfies the stated need to decide who may accept the remaining customer-order risk.
D:Compensating controls reduce exposure while modernization proceeds. That action primarily serves the different objective to select a defensible near-term mitigation. It is not the step that directly satisfies the stated need to decide who may accept the remaining customer-order risk.
Question 224
An online marketplace plans to stop storing cardholder data by switching to a payment service provider. A security manager has a defined assignment: allocate accountability for the new dependency. Which action BEST fulfills that specific assignment?
- Eliminate local card-data processing and token handling where technically feasible
- Retain a marketplace business owner for payment-service risk
- Review fallback arrangements and residual exposure with procurement and the risk owner
- Assess provider outages, integration attacks and contractual dependence
Explanation
Correct Answer
B:Delegation of processing does not transfer all accountability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Removing an activity can avoid a related category of risk. That action primarily serves the different objective to choose a risk response that removes the original exposure. It is not the step that directly satisfies the stated need to allocate accountability for the new dependency.
C:Third-party deterioration can change treatment adequacy. That action primarily serves the different objective to respond when the provider's risk profile deteriorates. It is not the step that directly satisfies the stated need to allocate accountability for the new dependency.
D:Risk is changed rather than completely erased. That action primarily serves the different objective to identify the remaining risk after outsourcing. It is not the step that directly satisfies the stated need to allocate accountability for the new dependency.
Question 225
A shipping company is deciding whether to buy cyber insurance for cargo booking disruption. The broker's covered event types, exclusions and deductible terms have been documented. Finance must now select among available coverage limits based on plausible retained cargo-booking losses and risk tolerance. The accountable executive now asks the team to choose a coverage level based on exposure. What should the security manager recommend?
- Compare covered loss scenarios, exclusions, deductibles and response conditions
- Maintain controls and tested continuity plans alongside coverage
- Review policy changes, incident conditions and residual exposures at renewal
- Compare financial impact scenarios and retained risk against appetite
Explanation
Correct Answer
D:Coverage is an economic risk decision. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Risk transfer depends on contract wording. That action primarily serves the different objective to identify which losses can actually be transferred. It is not the step that directly satisfies the stated need to choose a coverage level based on exposure.
B:Insurance cannot restore shipping systems. That action primarily serves the different objective to avoid assuming insurance fixes operational recovery. It is not the step that directly satisfies the stated need to choose a coverage level based on exposure.
C:Coverage and threats can change. That action primarily serves the different objective to check whether the risk response remains viable. It is not the step that directly satisfies the stated need to choose a coverage level based on exposure.
Question 226
An industrial company receives 200 critical-looking vulnerability alerts affecting different production networks. After reviewing the situation, the management objective is to select mitigation without threatening factory safety. Which response MOST directly addresses it?
- Coordinate compensating protection and maintenance windows with operations
- Use reachable attack paths, asset criticality and operational impact to rank findings
- Validate findings with asset owners and non-disruptive evidence
- Retest corrected conditions under approved plant change controls
Explanation
Correct Answer
A:Safety and availability constrain remediation. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:A high score on an isolated asset may be lower priority. That action primarily serves the different objective to prioritize risk beyond a technical severity label. It is not the step that directly satisfies the stated need to select mitigation without threatening factory safety.
C:False positives can waste remediation effort. That action primarily serves the different objective to confirm the alerts represent real deficiencies. It is not the step that directly satisfies the stated need to select mitigation without threatening factory safety.
D:Closing alerts without validating fixes is inadequate. That action primarily serves the different objective to verify remedial work was effective. It is not the step that directly satisfies the stated need to select mitigation without threatening factory safety.
Question 227
A services firm wants cyber threat intelligence to influence executive risk decisions rather than produce unread bulletins. For the next governance decision, the team must act on intelligence suggesting near-term exploitation. Which choice BEST provides that outcome?
- Reprioritize sources and analytic use cases using emerging exposure evidence
- Select threats tied to critical services and likely business impacts
- Trigger targeted control checks and risk-owner decisions for affected services
- Correlate external threat information with internal assets and telemetry
Explanation
Correct Answer
C:Action follows relevance assessment. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Intelligence requirements should evolve. That action primarily serves the different objective to adjust collection when threats shift. It is not the step that directly satisfies the stated need to act on intelligence suggesting near-term exploitation.
B:Collection should answer business risk questions. That action primarily serves the different objective to define intelligence requirements for management. It is not the step that directly satisfies the stated need to act on intelligence suggesting near-term exploitation.
D:External reports alone do not prove exposure. That action primarily serves the different objective to assess whether an indicator applies locally. It is not the step that directly satisfies the stated need to act on intelligence suggesting near-term exploitation.
Question 228
A government office compares risks to citizen identity records and an internal test website. The security program has been tasked specifically to show uncertainty in probability estimates. Which approach should be selected?
- Use consistent impact and likelihood scales tied to public-service objectives
- Document qualitative ranges and the evidence supporting each rating
- Reassess on material process, threat or control changes
- Include identity harm and statutory duties for citizen records rather than only infrastructure cost
Explanation
Correct Answer
B:Confidence matters to risk decisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Inconsistent scales undermine prioritization. That action primarily serves the different objective to choose comparable assessment criteria. It is not the step that directly satisfies the stated need to show uncertainty in probability estimates.
C:Risk assessments are not one-time artifacts. That action primarily serves the different objective to monitor whether the ranking changes. It is not the step that directly satisfies the stated need to show uncertainty in probability estimates.
D:Sensitivity changes consequence. That action primarily serves the different objective to identify asset-specific impact. It is not the step that directly satisfies the stated need to show uncertainty in probability estimates.
Question 229
A company relies on monthly heat maps, but executives cannot tell whether accepted risks are deteriorating. A security manager has a defined assignment: report risk without losing context. Which action BEST fulfills that specific assignment?
- Set risk tolerance breaches and escalation levels approved by risk owners
- Add product-specific exposure measures and owners before scaling usage
- Present exposure trends, uncertainty, treatment status and accountable owners
- Use control failures, threat activity and critical overdue exceptions linked to each top risk
Explanation
Correct Answer
C:Leadership needs actionable risk context. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Thresholds connect monitoring to decisions. That action primarily serves the different objective to define thresholds for executive action. It is not the step that directly satisfies the stated need to report risk without losing context.
B:New activities create new monitoring needs. That action primarily serves the different objective to refresh monitoring as a new product launches. It is not the step that directly satisfies the stated need to report risk without losing context.
D:Forward-looking signals are more useful than a colored square. That action primarily serves the different objective to select indicators that reveal worsening exposure. It is not the step that directly satisfies the stated need to report risk without losing context.
Question 230
A franchise organization lets branch managers accept local cyber risks without written limits. The accountable executive now asks the team to prevent undocumented permanent exceptions. What should the security manager recommend?
- Maintain risk decisions with reason, expiry and compensating controls
- Define acceptance limits and escalation rules approved by enterprise governance
- Assign named accountable business owners for cross-branch services
- Escalate it to the enterprise risk committee before relying on the exception
Explanation
Correct Answer
A:An audit trail supports timely challenge. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Delegation needs boundaries. That action primarily serves the different objective to establish delegated risk authority. It is not the step that directly satisfies the stated need to prevent undocumented permanent exceptions.
C:Shared platforms require enterprise-wide ownership. That action primarily serves the different objective to identify risk owners for shared customer systems. It is not the step that directly satisfies the stated need to prevent undocumented permanent exceptions.
D:Unauthorized decisions do not establish formal acceptance. That action primarily serves the different objective to address a branch accepting risk above its limit. It is not the step that directly satisfies the stated need to prevent undocumented permanent exceptions.
