Isaca CISM Practice Test 27
Question 260
A hospital tracks security controls by purchase date and vendor name but cannot prove effectiveness. The accountable executive now asks the team to distinguish operating from design effectiveness. What should the security manager recommend?
- Retest the failed condition and record independent closure evidence
- Test whether controls function repeatedly in the production context
- Document the risk scenario and measurable preventive or detective result
- Use configuration inspection, operation sampling and controlled security tests
Explanation
Correct Answer
B:A good design may be badly operated. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Implementation claims are not sufficient. That action primarily serves the different objective to verify correction of an identified weakness. It is not the step that directly satisfies the stated need to distinguish operating from design effectiveness.
C:Control intent must be explicit. That action primarily serves the different objective to define the expected outcome of each control. It is not the step that directly satisfies the stated need to distinguish operating from design effectiveness.
D:Multiple evidence types improve assurance. That action primarily serves the different objective to select independent validation methods. It is not the step that directly satisfies the stated need to distinguish operating from design effectiveness.
Question 261
A security operations department reports thousands of alerts to senior leadership with no risk prioritization. After reviewing the situation, the management objective is to present actionable escalation choices. Which response MOST directly addresses it?
- Connect confirmed incidents and control failures to impacted services
- Consult risk owners about required decisions and risk thresholds
- Show options, residual exposure, owner and deadline for material gaps
- Evaluate whether reports led to timely treatment and improve measures
Explanation
Correct Answer
C:Executives need clear decisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Alert volume alone is ambiguous. That action primarily serves the different objective to translate operational data into meaningful risk measures. It is not the step that directly satisfies the stated need to present actionable escalation choices.
B:Reporting should serve its audience. That action primarily serves the different objective to identify business decisions the report should support. It is not the step that directly satisfies the stated need to present actionable escalation choices.
D:A report is useful when it changes decisions. That action primarily serves the different objective to refine the reporting program from feedback. It is not the step that directly satisfies the stated need to present actionable escalation choices.
Question 262
A critical infrastructure company has no agreed metrics for its identity control modernization program. For the next governance decision, the team must distinguish delivery outputs from effectiveness. Which choice BEST provides that outcome?
- Inventory accounts, existing controls and known exceptions before reporting progress
- Report both enrollment rates and test evidence of controlled access
- Define privileged account coverage and verified unauthorized-access prevention targets
- Reassess what access pathways must be included in the metric
Explanation
Correct Answer
B:Enrollment does not prove prevention. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A baseline enables comparison. That action primarily serves the different objective to create a reliable measurement baseline. It is not the step that directly satisfies the stated need to distinguish delivery outputs from effectiveness.
C:Metrics should match risk objectives. That action primarily serves the different objective to select measures based on intended risk outcomes. It is not the step that directly satisfies the stated need to distinguish delivery outputs from effectiveness.
D:Changed architecture can invalidate the denominator. That action primarily serves the different objective to revise the measure after identity architecture changes. It is not the step that directly satisfies the stated need to distinguish delivery outputs from effectiveness.
Question 263
A bank is implementing a zero-trust access program for remote contractors. The security program has been tasked specifically to pilot the access controls with representative users. Which approach should be selected?
- Automate entitlement removal using contract lifecycle triggers
- Test legitimate workflows and prohibited lateral paths before scaling
- Require verified identity, device assurance and per-application authorization
- Map contractor identities, devices and target applications
Explanation
Correct Answer
B:Usability and enforcement both matter. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Lifecycle integration prevents lingering accounts. That action primarily serves the different objective to revoke access after contract completion. It is not the step that directly satisfies the stated need to pilot the access controls with representative users.
C:Broad network access is unnecessary. That action primarily serves the different objective to choose least-privilege access design. It is not the step that directly satisfies the stated need to pilot the access controls with representative users.
D:Access design needs the real workflow. That action primarily serves the different objective to identify which access paths require protection. It is not the step that directly satisfies the stated need to pilot the access controls with representative users.
Question 264
A global retailer is launching a security communications program during a company reorganization. A security manager has a defined assignment: translate enterprise policy into usable guidance. Which action BEST fulfills that specific assignment?
- Assign approved spokespersons, update cadence and escalation routes
- Publish role-specific instructions in relevant languages and channels
- Map executives, store operations, suppliers and technical teams to specific messages
- Revise unclear instructions and retest with affected audiences
Explanation
Correct Answer
B:Comprehension is needed for adoption. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Conflicting messages undermine response. That action primarily serves the different objective to establish trusted communication ownership. It is not the step that directly satisfies the stated need to translate enterprise policy into usable guidance.
C:One message cannot serve all audiences. That action primarily serves the different objective to identify audiences and decisions they need to make. It is not the step that directly satisfies the stated need to translate enterprise policy into usable guidance.
D:Feedback should change the program. That action primarily serves the different objective to update communication after staff feedback. It is not the step that directly satisfies the stated need to translate enterprise policy into usable guidance.
Question 265
A government cloud migration introduces new identity and data trust boundaries not covered by the security architecture. The accountable executive now asks the team to review proposed deviations to the pattern. What should the security manager recommend?
- Require documented design risk acceptance before authorizing exceptions
- Map new identity federation and data paths against the enterprise threat model
- Define identity isolation, logging and encryption reference designs for the new platform
- Use incident and assessment findings to improve architecture standards
Explanation
Correct Answer
A:Bypasses must remain governed. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:New trust boundaries change exposure. That action primarily serves the different objective to identify architecture assumptions that must be updated. It is not the step that directly satisfies the stated need to review proposed deviations to the pattern.
C:Patterns support consistent decisions. That action primarily serves the different objective to select a reusable secure architecture pattern. It is not the step that directly satisfies the stated need to review proposed deviations to the pattern.
D:Architecture must evolve with experience. That action primarily serves the different objective to adjust the reference for ongoing modernization. It is not the step that directly satisfies the stated need to review proposed deviations to the pattern.
Question 266
A large university has deployed centralized logging but discovers critical research servers do not forward events. Configuration rollout is reportedly complete, but investigators have seen intermittent silence from several critical research systems. After reviewing the situation, the management objective is to detect collection gaps early. Which response MOST directly addresses it?
- Map critical research workloads to required security event types
- Monitor telemetry heartbeat and expected event volumes by asset
- Review logging retention and access restrictions with legal and privacy owners
- Assume telemetry collection is healthy because every host has a documented forwarding-policy configuration
Explanation
Correct Answer
B:Silent gaps undermine detection. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Coverage should follow assets and risks. That action primarily serves the different objective to identify which services create high-value detection evidence. It is not the step that directly satisfies the stated need to detect collection gaps early.
C:Monitoring data also has governance duties. That action primarily serves the different objective to respond when data-retention laws change. It is not the step that directly satisfies the stated need to detect collection gaps early.
D:A documented configuration does not prove logs are arriving. Monitoring heartbeat and expected event volumes by asset is necessary to find actual collection gaps early.
Question 267
A financial firm moves email threat filtering to a managed security service. For the next governance decision, the team must integrate provider alerts into internal decisions. Which choice BEST provides that outcome?
- Define escalation paths, evidence formats and accountability handoffs
- Review capability tests, assurance and resilience against the firm's requirements
- Review fourth-party access, assurance and contract obligations
- Document detection scope, response authority, data access and escalation timing
Explanation
Correct Answer
A:Alerts without ownership can be lost. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Price is not sufficient evidence. That action primarily serves the different objective to evaluate the provider before selection. It is not the step that directly satisfies the stated need to integrate provider alerts into internal decisions.
C:Provider changes can change the firm's risk. That action primarily serves the different objective to reassess after the provider changes its analysis subcontractor. It is not the step that directly satisfies the stated need to integrate provider alerts into internal decisions.
D:Outsourcing needs precise boundaries. That action primarily serves the different objective to specify expected outcomes and service boundaries. It is not the step that directly satisfies the stated need to integrate provider alerts into internal decisions.
Question 268
A retail firm has standard operating procedures for patching, but teams say the policy gives no decision thresholds. The security program has been tasked specifically to manage exemptions for unsupported applications. Which approach should be selected?
- Define mandatory risk-based remediation objectives approved by management
- Record business approval, compensating controls and expiry dates
- Introduce emergency escalation criteria based on exposure and impact
- Specify testing, change windows, rollback and escalation steps
Explanation
Correct Answer
B:A waiver must be governed. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Policy should state required outcomes. That action primarily serves the different objective to establish the enterprise's patch risk policy. It is not the step that directly satisfies the stated need to manage exemptions for unsupported applications.
C:Risk changes justify policy review. That action primarily serves the different objective to revise rules when actively exploited vulnerabilities surge. It is not the step that directly satisfies the stated need to manage exemptions for unsupported applications.
D:Procedures implement policy. That action primarily serves the different objective to write executable patch procedures for each platform. It is not the step that directly satisfies the stated need to manage exemptions for unsupported applications.
Question 269
A cloud software startup reports high test coverage but repeated access-control vulnerabilities reach production. A security manager has a defined assignment: assign responsibility for remediation. Which action BEST fulfills that specific assignment?
- Review negative authorization cases across tenant and user boundaries
- Track similar auth defects and unauthorized-access signals by service
- Tie confirmed findings to product owners and release deadlines
- Add abuse-path and privilege-boundary tests to the release pipeline
Explanation
Correct Answer
C:Findings need accountable action. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Code coverage does not prove security cases. That action primarily serves the different objective to identify why existing tests miss authorization flaws. It is not the step that directly satisfies the stated need to assign responsibility for remediation.
B:Repeated patterns reveal a systematic weakness. That action primarily serves the different objective to monitor post-release recurrence. It is not the step that directly satisfies the stated need to assign responsibility for remediation.
D:Security tests must exercise expected denial. That action primarily serves the different objective to update the test strategy. It is not the step that directly satisfies the stated need to assign responsibility for remediation.
Question 270
An e-commerce company's board wants proof its security investment is reducing account takeover risk. The accountable executive now asks the team to validate that declines are not reporting artifacts. What should the security manager recommend?
- Measure confirmed takeover incidence and effective account recovery trends
- Reconcile fraud reports, detection changes and help desk outcomes
- Normalize events against active users and transaction volume
- Update event definitions and data collection to include new authentication paths
Explanation
Correct Answer
B:Changes in measurement can mimic improvement. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Spending is an input rather than the goal. That action primarily serves the different objective to establish an outcome-focused metric. It is not the step that directly satisfies the stated need to validate that declines are not reporting artifacts.
C:Raw counts may mislead when business grows. That action primarily serves the different objective to account for growth in customer accounts. It is not the step that directly satisfies the stated need to validate that declines are not reporting artifacts.
D:Metrics need stable meaning across architecture changes. That action primarily serves the different objective to adapt the metric after new login methods are introduced. It is not the step that directly satisfies the stated need to validate that declines are not reporting artifacts.
