Isaca CISM Practice Test 24
Question 230
A franchise organization lets branch managers accept local cyber risks without written limits. The accountable executive now asks the team to prevent undocumented permanent exceptions. What should the security manager recommend?
- Maintain risk decisions with reason, expiry and compensating controls
- Define acceptance limits and escalation rules approved by enterprise governance
- Assign named accountable business owners for cross-branch services
- Escalate it to the enterprise risk committee before relying on the exception
Explanation
Correct Answer
A:An audit trail supports timely challenge. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Delegation needs boundaries. That action primarily serves the different objective to establish delegated risk authority. It is not the step that directly satisfies the stated need to prevent undocumented permanent exceptions.
C:Shared platforms require enterprise-wide ownership. That action primarily serves the different objective to identify risk owners for shared customer systems. It is not the step that directly satisfies the stated need to prevent undocumented permanent exceptions.
D:Unauthorized decisions do not establish formal acceptance. That action primarily serves the different objective to address a branch accepting risk above its limit. It is not the step that directly satisfies the stated need to prevent undocumented permanent exceptions.
Question 231
A healthcare supplier introduces an AI summarization service handling sensitive medical notes. After reviewing the situation, the management objective is to choose a treatment appropriate to risk tolerance. Which response MOST directly addresses it?
- Model data leakage, prompt abuse, vendor handling and incorrect-output scenarios
- Require safeguards for authorized access, data minimization and monitoring before rollout
- Track high-risk outputs, access exceptions and provider changes against thresholds
- Map prompts, outputs, provider access and retention paths
Explanation
Correct Answer
B:Controls should reflect sensitive clinical data. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:AI service risks differ from conventional infrastructure. That action primarily serves the different objective to discover threats specific to this new dependency. It is not the step that directly satisfies the stated need to choose a treatment appropriate to risk tolerance.
C:New-model risks need continuing assurance. That action primarily serves the different objective to monitor whether safeguards remain effective. It is not the step that directly satisfies the stated need to choose a treatment appropriate to risk tolerance.
D:Data-flow mapping exposes security and privacy obligations. That action primarily serves the different objective to identify relevant information assets and flows. It is not the step that directly satisfies the stated need to choose a treatment appropriate to risk tolerance.
Question 232
An e-commerce firm estimates its cyber risk using a single average annual loss number despite highly variable holiday traffic. The firm has already modeled several credible peak-season extreme-loss cases and documented their uncertainty. Business risk owners now have to choose between mitigation investments of different costs. For the next governance decision, the team must select risk treatment against seasonal appetite. Which choice BEST provides that outcome?
- Use actual incident, fraud and downtime evidence to revise assumptions
- Model plausible peak-season loss scenarios and sensitivity to demand
- Compare extreme-loss scenarios with tolerance and response costs
- Document assumptions and confidence limits on frequency and financial severity
Explanation
Correct Answer
C:Peak conditions may drive treatment. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Operational experience updates the model. That action primarily serves the different objective to recalibrate risk after a peak shopping season. It is not the step that directly satisfies the stated need to select risk treatment against seasonal appetite.
B:The mean can hide tail impacts. That action primarily serves the different objective to represent severe but infrequent exposure. It is not the step that directly satisfies the stated need to select risk treatment against seasonal appetite.
D:Uncertain estimates should not masquerade as facts. That action primarily serves the different objective to separate uncertainty from controllable risk. It is not the step that directly satisfies the stated need to select risk treatment against seasonal appetite.
Question 233
A utilities operator has many risk exceptions but no way to know which are approaching expiration. The security program has been tasked specifically to escalate an exception whose safeguard stopped operating. Which approach should be selected?
- Require new risk evidence and authorized acceptance before each renewal
- Track owners, approval dates, expiry, compensating controls and affected systems
- Notify the risk owner and invoke the defined tolerance escalation process
- Sort by materiality, upcoming expiry and changes in threat conditions
Explanation
Correct Answer
C:A failed compensating control changes residual risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Old approval does not justify indefinite exposure. That action primarily serves the different objective to prevent automatic rollovers. It is not the step that directly satisfies the stated need to escalate an exception whose safeguard stopped operating.
B:Structured records support governance. That action primarily serves the different objective to maintain a usable exception inventory. It is not the step that directly satisfies the stated need to escalate an exception whose safeguard stopped operating.
D:Review effort should focus on greatest risk. That action primarily serves the different objective to prioritize review of exceptional exposures. It is not the step that directly satisfies the stated need to escalate an exception whose safeguard stopped operating.
Question 234
A transportation platform has a partner integration whose legacy protocol cannot support the new encryption standard. A security manager has a defined assignment: determine who may retain the exposure temporarily. Which action BEST fulfills that specific assignment?
- Assess interception exposure, data classification and external access paths
- Restrict connectivity and add compensating transport controls with a sunset date
- Reassess severity against tolerance and authorize continuity or disconnection
- Obtain documented acceptance from the owner of the transport business process
Explanation
Correct Answer
D:The business owns consequences of residual risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Treatment depends on information sensitivity. That action primarily serves the different objective to identify the risk introduced by the legacy channel. It is not the step that directly satisfies the stated need to determine who may retain the exposure temporarily.
B:Interim controls can narrow impact. That action primarily serves the different objective to reduce exposure while a replacement is built. It is not the step that directly satisfies the stated need to determine who may retain the exposure temporarily.
C:New threat information can invalidate prior acceptance. That action primarily serves the different objective to decide whether to suspend the integration after a new exploit appears. It is not the step that directly satisfies the stated need to determine who may retain the exposure temporarily.
Question 235
A software company discovers that privileged users can bypass the approval workflow in its production pipeline. The accountable executive now asks the team to choose an enduring control improvement. What should the security manager recommend?
- Test the pathway from privileged actions to unauthorized releases and sensitive code
- Check independent monitoring and approval evidence for privileged changes
- Implement enforceable separation of approval and production deployment duties
- Perform a controlled retest of blocked self-approved releases and monitor exceptions
Explanation
Correct Answer
C:Preventive controls eliminate unauthorized self-approval. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A control gap matters through its consequences. That action primarily serves the different objective to assess how the bypass affects business assets. It is not the step that directly satisfies the stated need to choose an enduring control improvement.
B:Dual evidence may reduce exposure while fixing access. That action primarily serves the different objective to identify effective compensating controls. It is not the step that directly satisfies the stated need to choose an enduring control improvement.
D:Policy text without effective enforcement is insufficient. That action primarily serves the different objective to validate that the exploit path is closed. It is not the step that directly satisfies the stated need to choose an enduring control improvement.
Question 236
A municipality finds network-connected water equipment installed by a maintenance contractor without a security review. After reviewing the situation, the management objective is to choose an immediately safe exposure reduction. Which response MOST directly addresses it?
- Track new device connections and remote sessions against an approved baseline
- Evaluate credible cyber pathways with plant engineers and safety specialists
- Inventory contractor-installed devices and map connectivity into control networks
- Restrict unneeded remote access while coordinating with plant operations
Explanation
Correct Answer
D:Protection must not interrupt vital processes. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Monitoring detects drift after remediation. That action primarily serves the different objective to establish ongoing risk monitoring. It is not the step that directly satisfies the stated need to choose an immediately safe exposure reduction.
B:Operational risk is not only data loss. That action primarily serves the different objective to assess safety and continuity consequences. It is not the step that directly satisfies the stated need to choose an immediately safe exposure reduction.
C:Unknown devices create unassessed exposure. That action primarily serves the different objective to identify exposed operational technology assets. It is not the step that directly satisfies the stated need to choose an immediately safe exposure reduction.
Question 237
A cloud company has accepted several high risks, and new regulations impose tighter customer data handling duties. Legal has identified mandatory customer-data safeguards that are not currently operating, and executives require a funded remediation response. For the next governance decision, the team must propose treatment for obligations not currently satisfied. Which choice BEST provides that outcome?
- Reassess residual exposures against updated risk appetite and mandatory compliance
- Compare accepted exposures with the new statutory duties and enforcement dates
- Close the regulatory remediation item when its control owner supplies an approved implementation schedule
- Fund controls and deadlines that address the identified compliance gap
Explanation
Correct Answer
D:Obligations need concrete remediation. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Acceptance cannot override law. That action primarily serves the different objective to determine whether previous acceptance is still valid. It is not the step that directly satisfies the stated need to propose treatment for obligations not currently satisfied.
B:A regulatory shift changes acceptable risk. That action primarily serves the different objective to identify which risk assumptions have changed. It is not the step that directly satisfies the stated need to propose treatment for obligations not currently satisfied.
C:A schedule is not a funded treatment or evidence the obligation has been met. Legal has identified the gap; the immediate decision is to resource controls and deadlines with an accountable owner.
Question 238
A manufacturer is adopting a cloud-hosted production forecasting engine that shares sensitive recipes with a technology supplier. The security program has been tasked specifically to assign acceptance authority for remaining exposure. Which approach should be selected?
- Have the product business owner decide with legal and security advice
- Assess audit rights, subcontractor restrictions and incident notice against the data flow
- Analyze supplier access, data handling and model-output leakage pathways
- Reassess stored data, new subprocessors and access paths after each material change
Explanation
Correct Answer
A:The owner of recipe value accepts business risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Contract terms must reflect the actual processing. That action primarily serves the different objective to determine whether contractual controls address the risk. It is not the step that directly satisfies the stated need to assign acceptance authority for remaining exposure.
C:Critical intellectual property may be exposed outside the plant. That action primarily serves the different objective to identify material threats from sharing recipes. It is not the step that directly satisfies the stated need to assign acceptance authority for remaining exposure.
D:Service evolution can create new exposure. That action primarily serves the different objective to monitor risks after the supplier adds new AI features. It is not the step that directly satisfies the stated need to assign acceptance authority for remaining exposure.
Question 239
A regional bank is implementing the security program approved by its new digital banking strategy. A security manager has a defined assignment: assign accountability for program delivery. Which action BEST fulfills that specific assignment?
- Create a funded roadmap tied to the digital platform milestones
- Name owners for controls, funding, integration and reporting
- Measure risk-reducing control performance against approved targets
- Build a skills and capacity assessment against prioritized security outcomes
Explanation
Correct Answer
B:Clear responsibility supports execution. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Program dependencies affect delivery order. That action primarily serves the different objective to sequence work with dependent projects. It is not the step that directly satisfies the stated need to assign accountability for program delivery.
C:Completed purchase orders do not demonstrate risk reduction. That action primarily serves the different objective to evaluate whether program investments deliver outcomes. It is not the step that directly satisfies the stated need to assign accountability for program delivery.
D:Tool purchases cannot replace required people and operating capacity. That action primarily serves the different objective to estimate program resources before selecting vendors. It is not the step that directly satisfies the stated need to assign accountability for program delivery.
Question 240
A hospital's data inventory excludes confidential imaging archives managed by a research partner. The accountable executive now asks the team to ensure the partner applies correct handling protections. What should the security manager recommend?
- Reassess permitted use, retention and access with the asset owner
- Map data sets, locations, owners and external processing relationships
- Classify patient imaging using sensitivity, clinical need and applicable duties
- Define contractually required safeguards derived from the classification
Explanation
Correct Answer
D:Outside custody does not eliminate handling obligations. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Information sensitivity changes with purpose. That action primarily serves the different objective to verify classification remains correct after research scope changes. It is not the step that directly satisfies the stated need to ensure the partner applies correct handling protections.
B:Incomplete inventories hide sensitive information. That action primarily serves the different objective to identify all information assets in the patient workflow. It is not the step that directly satisfies the stated need to ensure the partner applies correct handling protections.
C:Business impact and regulation guide classification. That action primarily serves the different objective to assign classification based on harm and obligations. It is not the step that directly satisfies the stated need to ensure the partner applies correct handling protections.
