Isaca CISM Practice Test 29
Question 280
A software vendor's incident response plan has a generic contact list but unclear decision authority during a breach. The accountable executive now asks the team to create decision-ready action playbooks. What should the security manager recommend?
- Define classification triggers and callout thresholds
- Review the plan after organizational and supplier changes
- Assign incident commander, legal, operations and business decision roles
- Document containment options, approvals and dependencies by scenario
Explanation
Correct Answer
D:Teams need executable decisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Consistent criteria prevent activation delays. That action primarily serves the different objective to specify when to activate the response plan. It is not the step that directly satisfies the stated need to create decision-ready action playbooks.
B:Roles and contacts can quickly become obsolete. That action primarily serves the different objective to maintain the response plan as the firm changes. It is not the step that directly satisfies the stated need to create decision-ready action playbooks.
C:Clear authority reduces confusion. That action primarily serves the different objective to define incident command responsibilities. It is not the step that directly satisfies the stated need to create decision-ready action playbooks.
Question 281
A payments processor detects a breach that may involve customer data in several jurisdictions. After reviewing the situation, the management objective is to coordinate internal and external communications. Which response MOST directly addresses it?
- Use an approved communications process that separates confirmed facts from hypotheses
- Activate named spokespeople, customer contacts and regulator response owners
- Issue material corrections through the approved communications plan
- Involve legal and privacy leads in classifying impacted data, locations and time triggers
Explanation
Correct Answer
B:Consistent messaging needs ownership. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Inaccurate messages can create harm. That action primarily serves the different objective to avoid premature public statements. It is not the step that directly satisfies the stated need to coordinate internal and external communications.
C:Communication should remain accurate and current. That action primarily serves the different objective to update stakeholders as facts change. It is not the step that directly satisfies the stated need to coordinate internal and external communications.
D:Notice requirements differ across duties. That action primarily serves the different objective to identify applicable notification obligations early. It is not the step that directly satisfies the stated need to coordinate internal and external communications.
Question 282
An insurance investigation needs evidence from a compromised laptop that may later be used in litigation. For the next governance decision, the team must avoid destroying volatile evidence. Which choice BEST provides that outcome?
- Acquire forensic images using documented methods and integrity hashes
- Separate verified findings, methods, uncertainties and supporting evidence
- Record every transfer, holder, time and purpose in a chain-of-custody log
- Coordinate memory and live-state collection before disruptive changes where safe
Explanation
Correct Answer
D:Volatile artifacts can vanish. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Repeatable preservation supports admissibility. That action primarily serves the different objective to preserve the original evidence properly. It is not the step that directly satisfies the stated need to avoid destroying volatile evidence.
B:Conclusions must be traceable. That action primarily serves the different objective to prepare a defensible investigative report. It is not the step that directly satisfies the stated need to avoid destroying volatile evidence.
C:Custody history supports authenticity. That action primarily serves the different objective to document custody of the laptop and images. It is not the step that directly satisfies the stated need to avoid destroying volatile evidence.
Question 283
A hospital detects ransomware movement across workstations but isolating some devices could delay patient care. The security program has been tasked specifically to prevent further spread through shared credentials. Which approach should be selected?
- Reintroduce validated systems in order of clinical dependency
- Revoke compromised access and restrict lateral trust paths where feasible
- Apply approved patient-safety and security impact thresholds through incident command
- Coordinate with clinical leaders to isolate noncritical paths first and protect essential treatment
Explanation
Correct Answer
B:Containment includes identities. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Recovery should not reintroduce infection. That action primarily serves the different objective to plan staged restoration. It is not the step that directly satisfies the stated need to prevent further spread through shared credentials.
C:High-impact actions need authorized decisions. That action primarily serves the different objective to decide when emergency shutdown is warranted. It is not the step that directly satisfies the stated need to prevent further spread through shared credentials.
D:Containment must weigh immediate safety. That action primarily serves the different objective to select safe containment priorities. It is not the step that directly satisfies the stated need to prevent further spread through shared credentials.
Question 284
A retailer observes unusual outbound data volume from a customer analytics service. A security manager has a defined assignment: limit ongoing unauthorized transfers. Which action BEST fulfills that specific assignment?
- Monitor verified egress patterns and unauthorized destination changes
- Correlate data egress records, account activity and authorized business exports
- Preserve relevant logs, data flow records and cloud control-plane events
- Restrict identified risky accounts and outbound paths under incident authority
Explanation
Correct Answer
D:Targeted containment reduces exposure. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Ongoing assurance is needed. That action primarily serves the different objective to detect repeated leakage after remediation. It is not the step that directly satisfies the stated need to limit ongoing unauthorized transfers.
B:Volume anomalies require context. That action primarily serves the different objective to determine whether exfiltration occurred. It is not the step that directly satisfies the stated need to limit ongoing unauthorized transfers.
C:Evidence may be short-lived. That action primarily serves the different objective to protect evidence before response changes. It is not the step that directly satisfies the stated need to limit ongoing unauthorized transfers.
Question 285
A media company learns that its website provider suffered a breach affecting shared administration credentials. The accountable executive now asks the team to obtain reliable vendor updates. What should the security manager recommend?
- Rotate affected secrets and restrict provider access under the incident plan
- Require provider indicators and compare with local account and service logs
- Invoke contractual incident reporting and evidence-sharing obligations
- Reassess provider permissions, assurance gaps and alternate service options
Explanation
Correct Answer
C:Information should follow documented agreements. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Account exposure can propagate. That action primarily serves the different objective to contain exposed shared credentials. It is not the step that directly satisfies the stated need to obtain reliable vendor updates.
B:Vendor breach does not prove identical customer compromise. That action primarily serves the different objective to confirm the company's actual scope of exposure. It is not the step that directly satisfies the stated need to obtain reliable vendor updates.
D:Lessons should change third-party risk treatment. That action primarily serves the different objective to review supplier controls after the event. It is not the step that directly satisfies the stated need to obtain reliable vendor updates.
Question 286
A firm suspects an employee deliberately copied sensitive product plans before resignation. After reviewing the situation, the management objective is to contain potential continued misuse. Which response MOST directly addresses it?
- Coordinate with legal, HR and security under established investigative authority
- Secure access logs, device evidence and approved data access records
- Restrict access proportionately under approved employment and incident procedures
- Review offboarding, data access and monitoring controls after findings
Explanation
Correct Answer
C:Containment should avoid unnecessary rights violations. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Insider investigations require privacy safeguards. That action primarily serves the different objective to ensure investigation is authorized and proportionate. It is not the step that directly satisfies the stated need to contain potential continued misuse.
B:Evidence handling must support later review. That action primarily serves the different objective to preserve relevant records without altering them. It is not the step that directly satisfies the stated need to contain potential continued misuse.
D:Root cause may be systemic. That action primarily serves the different objective to address control weaknesses revealed by the case. It is not the step that directly satisfies the stated need to contain potential continued misuse.
Question 287
A cloud service owner's API keys appear in a public software repository. For the next governance decision, the team must inspect activity performed with the credentials. Which choice BEST provides that outcome?
- Rotate or revoke exposed secrets and invalidate affected sessions where supported
- Review cloud audit and resource change events linked to the keys
- Introduce secret scanning and safer credential injection into development workflows
- Validate affected secrets and assess access logs through approved incident procedures
Explanation
Correct Answer
B:Credential exposure can cause downstream changes. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Revocation limits exploitation. That action primarily serves the different objective to prevent further use of compromised keys. It is not the step that directly satisfies the stated need to inspect activity performed with the credentials.
C:Prevention should address the cause. That action primarily serves the different objective to prevent similar disclosures. It is not the step that directly satisfies the stated need to inspect activity performed with the credentials.
D:Scope determines urgency. That action primarily serves the different objective to establish whether keys remain active and exposed. It is not the step that directly satisfies the stated need to inspect activity performed with the credentials.
Question 288
An organization discovers a malicious update was distributed through a trusted software supplier. The security program has been tasked specifically to preserve evidence of the malicious release. Which approach should be selected?
- Review supplier assurance, contracts and correlated exposures
- Map installed versions, deployment history and critical workloads
- Pause affected deployments and restrict known malicious components with change approval
- Capture signed packages, hashes, update logs and supplier notices
Explanation
Correct Answer
D:Supply-chain findings require provenance. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A trusted channel can fail again. That action primarily serves the different objective to reassess supply-chain risk after containment. It is not the step that directly satisfies the stated need to preserve evidence of the malicious release.
B:Supply-chain impact follows actual deployment. That action primarily serves the different objective to identify potentially affected systems. It is not the step that directly satisfies the stated need to preserve evidence of the malicious release.
C:Containment limits spread. That action primarily serves the different objective to contain the compromised update pathway. It is not the step that directly satisfies the stated need to preserve evidence of the malicious release.
Question 289
An online bank experiences a distributed denial-of-service attack during its busiest payment period. A security manager has a defined assignment: coordinate with customer-facing teams. Which action BEST fulfills that specific assignment?
- Engage approved traffic mitigation and provider capacity procedures
- Use network telemetry, user behavior and service impact to classify the event
- Update provider contracts, runbooks and peak-load exercises from observed conditions
- Provide verified service status and escalation through the incident communications plan
Explanation
Correct Answer
D:Customers need reliable information. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:DDoS response should preserve legitimate access. That action primarily serves the different objective to activate a proportionate availability response. It is not the step that directly satisfies the stated need to coordinate with customer-facing teams.
B:Volume alone does not prove attack. That action primarily serves the different objective to establish whether traffic is malicious or a demand spike. It is not the step that directly satisfies the stated need to coordinate with customer-facing teams.
C:Resilience improves through testing. That action primarily serves the different objective to improve readiness for repeat attacks. It is not the step that directly satisfies the stated need to coordinate with customer-facing teams.
Question 290
A hospital detects unauthorized changes to medication inventory records but systems remain online. The accountable executive now asks the team to determine whether patient safety is threatened. What should the security manager recommend?
- Coordinate clinical assessment of affected medication decisions
- Address the exploited authorization path and monitor sensitive record changes
- Restrict suspect identities and privileged change paths under incident authority
- Reconcile affected transactions with trusted audit and source records
Explanation
Correct Answer
A:Business impact can extend beyond IT. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Root-cause treatment closes the weakness. That action primarily serves the different objective to prevent recurrence. It is not the step that directly satisfies the stated need to determine whether patient safety is threatened.
C:Targeted containment protects records. That action primarily serves the different objective to contain continued unauthorized modification. It is not the step that directly satisfies the stated need to determine whether patient safety is threatened.
D:Integrity failure can persist without downtime. That action primarily serves the different objective to confirm which records may be untrustworthy. It is not the step that directly satisfies the stated need to determine whether patient safety is threatened.
