Isaca CISM Practice Test 26
Question 250
A sales organization suffered credential theft after repeated social engineering calls to its help desk. The accountable executive now asks the team to prevent overrides of high-risk identity resets. What should the security manager recommend?
- Review actual identity-proofing calls and escalation decisions
- Train on verification procedures and supervised escalation drills
- Implement dual approval and recorded verification for sensitive recovery requests
- Update training and procedural controls for the new contact channel
Explanation
Correct Answer
C:Preventive workflow limits social engineering. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Real-world patterns reveal weaknesses. That action primarily serves the different objective to identify behavior gaps in service desk authentication. It is not the step that directly satisfies the stated need to prevent overrides of high-risk identity resets.
B:Scenario practice improves response. That action primarily serves the different objective to teach staff how to challenge urgent callers safely. It is not the step that directly satisfies the stated need to prevent overrides of high-risk identity resets.
D:Threat changes should alter practice. That action primarily serves the different objective to respond when attackers switch to collaboration chat. It is not the step that directly satisfies the stated need to prevent overrides of high-risk identity resets.
Question 251
An insurance firm finds archived customer records without usable ownership or retention tags. After reviewing the situation, the management objective is to assign accountable data stewards. Which response MOST directly addresses it?
- Have business owners approve disposition and access decisions
- Map repositories, records, owners and legal hold requirements
- Review deletion logs, hold exceptions and sampled archive records
- Apply a documented sensitivity and retention taxonomy
Explanation
Correct Answer
A:IT custody does not establish data ownership. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Deleting unknown records may violate obligations. That action primarily serves the different objective to reconstruct the inventory before bulk deletion. It is not the step that directly satisfies the stated need to assign accountable data stewards.
C:Evidence must support claimed retention compliance. That action primarily serves the different objective to verify disposition without exposing sensitive data. It is not the step that directly satisfies the stated need to assign accountable data stewards.
D:Different records require different handling. That action primarily serves the different objective to classify records based on business and privacy impact. It is not the step that directly satisfies the stated need to assign accountable data stewards.
Question 252
An analytics platform gives administrators permanent privileged access to production datasets. For the next governance decision, the team must detect misuse of privileged sessions. Which choice BEST provides that outcome?
- Introduce just-in-time elevated roles with approval and expiry
- Define break-glass authorization and independent post-use review
- Collect actionable privileged activity logs with independent monitoring
- Reconcile entitlements with the new role and promptly revoke unneeded privileges
Explanation
Correct Answer
C:Visibility is needed to identify abuse. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Temporary privilege reduces persistent exposure. That action primarily serves the different objective to reduce standing privilege. It is not the step that directly satisfies the stated need to detect misuse of privileged sessions.
B:Availability exceptions need accountability. That action primarily serves the different objective to ensure emergency data access remains possible. It is not the step that directly satisfies the stated need to detect misuse of privileged sessions.
D:Access must follow job responsibility. That action primarily serves the different objective to respond to an administrator changing departments. It is not the step that directly satisfies the stated need to detect misuse of privileged sessions.
Question 253
A health insurer deploys a machine learning claims service and needs security controls integrated before release. The security program has been tasked specifically to prevent unreviewed model changes. Which approach should be selected?
- Use controlled model promotion with accountable approval and version history
- Review drift, sensitive-output reports and supplier changes with risk owners
- Embed data minimization, access control and testing criteria into design acceptance
- Threat-model sensitive data use, model access and third-party dependencies
Explanation
Correct Answer
A:Model updates can alter risk unexpectedly. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Operational conditions may change after approval. That action primarily serves the different objective to monitor post-deployment model risk. It is not the step that directly satisfies the stated need to prevent unreviewed model changes.
C:Security design should precede release. That action primarily serves the different objective to choose secure development requirements. It is not the step that directly satisfies the stated need to prevent unreviewed model changes.
D:AI workflows introduce data and model risks. That action primarily serves the different objective to identify risks to training and inference workflows. It is not the step that directly satisfies the stated need to prevent unreviewed model changes.
Question 254
A nonprofit runs yearly penetration testing but does not repair repeated high-severity findings. A security manager has a defined assignment: verify corrections rather than trust ticket closure. Which action BEST fulfills that specific assignment?
- Update threat scenarios to include newly deployed services and data flows
- Create accountable remediation tasks with agreed severity targets
- Retest affected attack paths and retain validation evidence
- Rank confirmed exploitable findings by donor-system exposure and impact
Explanation
Correct Answer
C:A closed ticket is not a verified fix. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Test plans must reflect real architecture. That action primarily serves the different objective to improve testing scope for new platforms. It is not the step that directly satisfies the stated need to verify corrections rather than trust ticket closure.
B:Unowned reports cannot fix risk. That action primarily serves the different objective to assign clear owners and deadlines. It is not the step that directly satisfies the stated need to verify corrections rather than trust ticket closure.
D:Testing value comes from risk reduction. That action primarily serves the different objective to prioritize actionable remediation. It is not the step that directly satisfies the stated need to verify corrections rather than trust ticket closure.
Question 255
A multinational's data loss prevention program blocks harmless collaboration but misses confidential file exports. The accountable executive now asks the team to pilot enforcement without disrupting work. What should the security manager recommend?
- Review classification and authorized sharing patterns with data owners
- Map sensitivity labels and risky destinations to enforceable DLP conditions
- Run monitored policy simulations and tune false positives before blocking
- Reassess data egress coverage and extend approved monitoring and controls
Explanation
Correct Answer
C:Testing reduces user disruption. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Rules need business context. That action primarily serves the different objective to clarify protected information and valid workflows. It is not the step that directly satisfies the stated need to pilot enforcement without disrupting work.
B:Risk-based rules improve targeting. That action primarily serves the different objective to select policy rules for meaningful leakage channels. It is not the step that directly satisfies the stated need to pilot enforcement without disrupting work.
D:New channels can evade old rules. That action primarily serves the different objective to respond when employees use a new file-transfer service. It is not the step that directly satisfies the stated need to pilot enforcement without disrupting work.
Question 256
A large university is moving endpoints to a centralized security management platform. After reviewing the situation, the management objective is to deploy safely across research departments. Which response MOST directly addresses it?
- Inventory operating systems, critical applications and management constraints
- Pilot in representative departments and use staged deployment controls
- Approve supported protection, hardening and telemetry settings by device class
- Document exceptions with compensating controls and review dates
Explanation
Correct Answer
B:Research workloads may have compatibility needs. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Device diversity affects control rollout. That action primarily serves the different objective to understand unsupported devices and workloads. It is not the step that directly satisfies the stated need to deploy safely across research departments.
C:Baselines establish a standard. That action primarily serves the different objective to define a minimum endpoint security baseline. It is not the step that directly satisfies the stated need to deploy safely across research departments.
D:Exceptions need deliberate risk acceptance. That action primarily serves the different objective to handle endpoints that cannot support a mandatory setting. It is not the step that directly satisfies the stated need to deploy safely across research departments.
Question 257
An enterprise uses multiple public clouds and wants consistent access controls without forcing identical implementations. For the next governance decision, the team must implement platform-native baselines. Which choice BEST provides that outcome?
- Document customer-managed and provider-managed controls per service
- Translate the common outcomes into approved configurations in each cloud
- Monitor baseline deviations and assess service feature releases
- Set common identity, logging and data-protection control objectives
Explanation
Correct Answer
B:Uniform intent may need different technical controls. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Cloud responsibility varies by service model. That action primarily serves the different objective to map each provider's responsibility boundaries. It is not the step that directly satisfies the stated need to implement platform-native baselines.
C:Cloud control behavior changes over time. That action primarily serves the different objective to detect control drift after provider changes. It is not the step that directly satisfies the stated need to implement platform-native baselines.
D:Outcomes can be comparable across platforms. That action primarily serves the different objective to define cross-cloud security outcomes. It is not the step that directly satisfies the stated need to implement platform-native baselines.
Question 258
A transport company manages thousands of certificates for vehicle APIs and fears accidental expiry. The security program has been tasked specifically to implement safe rotation without service interruption. Which approach should be selected?
- Alert on certificate age, failed handshakes and unexpected key use
- Track certificate owners, dependencies and expiration dates
- Use overlapping trust and staged replacement with partner validation
- Assign automated rotation ownership and emergency recovery procedures
Explanation
Correct Answer
C:Cutover can fail if clients are not prepared. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Early warning supports prevention. That action primarily serves the different objective to monitor for impending expiration and unusual use. It is not the step that directly satisfies the stated need to implement safe rotation without service interruption.
B:Unknown credentials create outage risks. That action primarily serves the different objective to establish an accurate credential inventory. It is not the step that directly satisfies the stated need to implement safe rotation without service interruption.
D:Renewal needs operational accountability. That action primarily serves the different objective to define certificate renewal responsibilities. It is not the step that directly satisfies the stated need to implement safe rotation without service interruption.
Question 259
A national retailer plans secure coding practices for a rapidly growing delivery application. A security manager has a defined assignment: automate a suitable mix of tests. Which action BEST fulfills that specific assignment?
- Use source/dependency analysis and targeted dynamic testing in the pipeline
- Require threat modeling and risk acceptance criteria for significant features
- Embed product security responsibilities in development and release governance
- Track confirmed recurring weaknesses and time to remediate by team
Explanation
Correct Answer
A:Different tests find different weaknesses. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Early decisions affect architecture. That action primarily serves the different objective to integrate security into product planning. It is not the step that directly satisfies the stated need to automate a suitable mix of tests.
C:Ownership prevents late-stage gaps. That action primarily serves the different objective to assign owners of application security requirements. It is not the step that directly satisfies the stated need to automate a suitable mix of tests.
D:Outcomes reveal process maturity. That action primarily serves the different objective to measure whether security engineering is improving. It is not the step that directly satisfies the stated need to automate a suitable mix of tests.
Question 260
A hospital tracks security controls by purchase date and vendor name but cannot prove effectiveness. The accountable executive now asks the team to distinguish operating from design effectiveness. What should the security manager recommend?
- Retest the failed condition and record independent closure evidence
- Test whether controls function repeatedly in the production context
- Document the risk scenario and measurable preventive or detective result
- Use configuration inspection, operation sampling and controlled security tests
Explanation
Correct Answer
B:A good design may be badly operated. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Implementation claims are not sufficient. That action primarily serves the different objective to verify correction of an identified weakness. It is not the step that directly satisfies the stated need to distinguish operating from design effectiveness.
C:Control intent must be explicit. That action primarily serves the different objective to define the expected outcome of each control. It is not the step that directly satisfies the stated need to distinguish operating from design effectiveness.
D:Multiple evidence types improve assurance. That action primarily serves the different objective to select independent validation methods. It is not the step that directly satisfies the stated need to distinguish operating from design effectiveness.
