Isaca CISM Practice Test 3
Question 20
A fintech discovers that its production API has an unpatched weakness but compensating controls restrict exploitability. The security program has been tasked specifically to establish how exposed the weakness is in context. Which approach should be selected?
- Verify the fixed API and retire exceptions only after retesting
- Require tested compensating controls with an approved expiry and patch date
- Validate reachability, authentication barriers and business impact of exploitation
- Monitor patch progress, attack indicators and the effectiveness of the compensating control
Explanation
Correct Answer
C:A severity score alone does not measure realized business risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A change ticket is not evidence the weakness was resolved. That action primarily serves the different objective to close the issue appropriately. It is not the step that directly satisfies the stated need to establish how exposed the weakness is in context.
B:Temporary measures need limits and ownership. That action primarily serves the different objective to choose an interim response if code remediation is delayed. It is not the step that directly satisfies the stated need to establish how exposed the weakness is in context.
D:Tracking reveals when the temporary risk worsens. That action primarily serves the different objective to track exposure through remediation. It is not the step that directly satisfies the stated need to establish how exposed the weakness is in context.
Question 21
A bank estimates fraud exposure for a new mobile payment feature with incomplete loss data. A security manager has a defined assignment: select an analysis appropriate to uncertain loss estimates. Which action BEST fulfills that specific assignment?
- Present ranges and evidence quality alongside the risk rating
- Compare plausible loss outcomes with approved risk tolerance and control cost
- Use documented loss ranges, assumptions and sensitivity scenarios instead of one false-precision number
- Update loss assumptions using actual fraud and control performance evidence
Explanation
Correct Answer
C:Uncertainty must remain visible to decision makers. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A point score can conceal weak supporting data. That action primarily serves the different objective to communicate confidence in the assessment. It is not the step that directly satisfies the stated need to select an analysis appropriate to uncertain loss estimates.
B:Treatment should reflect risk appetite. That action primarily serves the different objective to choose a treatment threshold. It is not the step that directly satisfies the stated need to select an analysis appropriate to uncertain loss estimates.
D:New evidence can change the prior decision. That action primarily serves the different objective to reassess after initial transaction data becomes available. It is not the step that directly satisfies the stated need to select an analysis appropriate to uncertain loss estimates.
Question 22
A manufacturer reports high cyber risk in its industrial control network, but its IT department claims ownership of the exposure. The accountable executive now asks the team to determine who can accept the production shutdown consequence. What should the security manager recommend?
- Report control health and operating exceptions to plant risk owners
- Escalate decisions above local tolerance through the enterprise risk authority
- Assign the plant business executive as risk owner and security as adviser
- Document current exposure, options, decision authority and review date in the risk register
Explanation
Correct Answer
C:Business executives own operational impact. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:An accepted risk requires ongoing observation. That action primarily serves the different objective to validate that residual risk is being monitored. It is not the step that directly satisfies the stated need to determine who can accept the production shutdown consequence.
B:Plant managers cannot accept exposures beyond delegated appetite. That action primarily serves the different objective to resolve conflicting risk responses across plants. It is not the step that directly satisfies the stated need to determine who can accept the production shutdown consequence.
D:Traceable decisions support oversight. That action primarily serves the different objective to record the basis for acceptance or treatment. It is not the step that directly satisfies the stated need to determine who can accept the production shutdown consequence.
Question 23
A cloud retailer cannot immediately remove a legacy authentication dependency in a critical order system. After reviewing the situation, the management objective is to avoid leaving an unbounded vulnerability exception. Which response MOST directly addresses it?
- Reassess residual exposure against fresh threat evidence before the exception expires
- Require time-limited risk treatment with approved controls and milestones
- Fund a migration plan with tested cutover and rollback gates
- Seek acceptance from the authorized business risk executive
Explanation
Correct Answer
B:Temporary acceptance must have an end condition. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Approval cannot be treated as permanent. That action primarily serves the different objective to determine whether acceptance should be renewed. It is not the step that directly satisfies the stated need to avoid leaving an unbounded vulnerability exception.
C:Structural remediation addresses the source of risk. That action primarily serves the different objective to show a path to eliminate the dependency. It is not the step that directly satisfies the stated need to avoid leaving an unbounded vulnerability exception.
D:A security engineer cannot accept enterprise revenue consequences. That action primarily serves the different objective to decide who may accept the remaining customer-order risk. It is not the step that directly satisfies the stated need to avoid leaving an unbounded vulnerability exception.
Question 24
An online marketplace plans to stop storing cardholder data by switching to a payment service provider. The business still collects card information through a legacy checkout workflow despite its proposed outsourcing plan. For the next governance decision, the team must choose a risk response that removes the original exposure. Which choice BEST provides that outcome?
- Review fallback arrangements and residual exposure with procurement and the risk owner
- Accept a future-state storage diagram as proof the marketplace has already stopped local card-data collection
- Retain a marketplace business owner for payment-service risk
- Eliminate local card-data processing and token handling where technically feasible
Explanation
Correct Answer
D:Removing an activity can avoid a related category of risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Third-party deterioration can change treatment adequacy. That action primarily serves the different objective to respond when the provider's risk profile deteriorates. It is not the step that directly satisfies the stated need to choose a risk response that removes the original exposure.
B:A future-state diagram only states the intended design and does not remove the processing activity. The risk-avoidance decision must first eliminate the local storage and processing paths.
C:Delegation of processing does not transfer all accountability. That action primarily serves the different objective to allocate accountability for the new dependency. It is not the step that directly satisfies the stated need to choose a risk response that removes the original exposure.
Question 25
A shipping company is deciding whether to buy cyber insurance for cargo booking disruption. The insurer's proposal claims broad disruption coverage, but the business has not yet distinguished contractually insured loss types from exclusions, deductibles and incident-response conditions. The security program has been tasked specifically to identify which losses can actually be transferred. Which approach should be selected?
- Review policy changes, incident conditions and residual exposures at renewal
- Secure approval from finance and the cargo booking risk owner
- Compare covered loss scenarios, exclusions, deductibles and response conditions
- Compare financial impact scenarios and retained risk against appetite
Explanation
Correct Answer
C:Risk transfer depends on contract wording. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Coverage and threats can change. That action primarily serves the different objective to check whether the risk response remains viable. It is not the step that directly satisfies the stated need to identify which losses can actually be transferred.
B:Risk financing must have accountable sponsors. That action primarily serves the different objective to assign responsibility for the transfer decision. It is not the step that directly satisfies the stated need to identify which losses can actually be transferred.
D:Coverage is an economic risk decision. That action primarily serves the different objective to choose a coverage level based on exposure. It is not the step that directly satisfies the stated need to identify which losses can actually be transferred.
Question 26
An industrial company receives 200 critical-looking vulnerability alerts affecting different production networks. A security manager has a defined assignment: prioritize risk beyond a technical severity label. Which action BEST fulfills that specific assignment?
- Coordinate compensating protection and maintenance windows with operations
- Use reachable attack paths, asset criticality and operational impact to rank findings
- Aggregate material residual exposure and accountable remediation owners for leadership
- Retest corrected conditions under approved plant change controls
Explanation
Correct Answer
B:A high score on an isolated asset may be lower priority. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Safety and availability constrain remediation. That action primarily serves the different objective to select mitigation without threatening factory safety. It is not the step that directly satisfies the stated need to prioritize risk beyond a technical severity label.
C:Management needs business impact and delays. That action primarily serves the different objective to report overdue high-exposure weaknesses. It is not the step that directly satisfies the stated need to prioritize risk beyond a technical severity label.
D:Closing alerts without validating fixes is inadequate. That action primarily serves the different objective to verify remedial work was effective. It is not the step that directly satisfies the stated need to prioritize risk beyond a technical severity label.
Question 27
A services firm wants cyber threat intelligence to influence executive risk decisions rather than produce unread bulletins. Executive dashboards currently list threat bulletins but do not connect them to vulnerable business services. The accountable executive now asks the team to define intelligence requirements for management. What should the security manager recommend?
- Count how many threat-intelligence bulletins executives received last month as the definition of intelligence requirements
- Select threats tied to critical services and likely business impacts
- Reprioritize sources and analytic use cases using emerging exposure evidence
- Trigger targeted control checks and risk-owner decisions for affected services
Explanation
Correct Answer
B:Collection should answer business risk questions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Bulletin volume does not define which threat questions leaders need answered. Management intelligence requirements should follow critical business services and potential loss, not publication counts.
C:Intelligence requirements should evolve. That action primarily serves the different objective to adjust collection when threats shift. It is not the step that directly satisfies the stated need to define intelligence requirements for management.
D:Action follows relevance assessment. That action primarily serves the different objective to act on intelligence suggesting near-term exploitation. It is not the step that directly satisfies the stated need to define intelligence requirements for management.
Question 28
A government office compares risks to citizen identity records and an internal test website. After reviewing the situation, the management objective is to choose comparable assessment criteria. Which response MOST directly addresses it?
- Use consistent impact and likelihood scales tied to public-service objectives
- Document qualitative ranges and the evidence supporting each rating
- Present the affected service and treatment options to the authorized executive
- Reassess on material process, threat or control changes
Explanation
Correct Answer
A:Inconsistent scales undermine prioritization. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Confidence matters to risk decisions. That action primarily serves the different objective to show uncertainty in probability estimates. It is not the step that directly satisfies the stated need to choose comparable assessment criteria.
C:Exceeding appetite requires decision authority. That action primarily serves the different objective to escalate a risk above agreed tolerance. It is not the step that directly satisfies the stated need to choose comparable assessment criteria.
D:Risk assessments are not one-time artifacts. That action primarily serves the different objective to monitor whether the ranking changes. It is not the step that directly satisfies the stated need to choose comparable assessment criteria.
Question 29
A company relies on monthly heat maps, but executives cannot tell whether accepted risks are deteriorating. For the next governance decision, the team must select indicators that reveal worsening exposure. Which choice BEST provides that outcome?
- Reconcile indicators with source systems and investigate inconsistent reporting
- Add product-specific exposure measures and owners before scaling usage
- Use control failures, threat activity and critical overdue exceptions linked to each top risk
- Present exposure trends, uncertainty, treatment status and accountable owners
Explanation
Correct Answer
C:Forward-looking signals are more useful than a colored square. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Bad data creates misleading trends. That action primarily serves the different objective to validate the risk data quality. It is not the step that directly satisfies the stated need to select indicators that reveal worsening exposure.
B:New activities create new monitoring needs. That action primarily serves the different objective to refresh monitoring as a new product launches. It is not the step that directly satisfies the stated need to select indicators that reveal worsening exposure.
D:Leadership needs actionable risk context. That action primarily serves the different objective to report risk without losing context. It is not the step that directly satisfies the stated need to select indicators that reveal worsening exposure.
Question 30
A franchise organization lets branch managers accept local cyber risks without written limits. The security program has been tasked specifically to establish delegated risk authority. Which approach should be selected?
- Review residual risk periodically and when circumstances change
- Define acceptance limits and escalation rules approved by enterprise governance
- Maintain risk decisions with reason, expiry and compensating controls
- Escalate it to the enterprise risk committee before relying on the exception
Explanation
Correct Answer
B:Delegation needs boundaries. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Acceptance is not a one-off event. That action primarily serves the different objective to check that accepted risks stay acceptable. It is not the step that directly satisfies the stated need to establish delegated risk authority.
C:An audit trail supports timely challenge. That action primarily serves the different objective to prevent undocumented permanent exceptions. It is not the step that directly satisfies the stated need to establish delegated risk authority.
D:Unauthorized decisions do not establish formal acceptance. That action primarily serves the different objective to address a branch accepting risk above its limit. It is not the step that directly satisfies the stated need to establish delegated risk authority.
