Isaca CISM Practice Test 30
Question 290
A hospital detects unauthorized changes to medication inventory records but systems remain online. The accountable executive now asks the team to determine whether patient safety is threatened. What should the security manager recommend?
- Coordinate clinical assessment of affected medication decisions
- Address the exploited authorization path and monitor sensitive record changes
- Restrict suspect identities and privileged change paths under incident authority
- Reconcile affected transactions with trusted audit and source records
Explanation
Correct Answer
A:Business impact can extend beyond IT. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Root-cause treatment closes the weakness. That action primarily serves the different objective to prevent recurrence. It is not the step that directly satisfies the stated need to determine whether patient safety is threatened.
C:Targeted containment protects records. That action primarily serves the different objective to contain continued unauthorized modification. It is not the step that directly satisfies the stated need to determine whether patient safety is threatened.
D:Integrity failure can persist without downtime. That action primarily serves the different objective to confirm which records may be untrustworthy. It is not the step that directly satisfies the stated need to determine whether patient safety is threatened.
Question 291
A logistics firm restored a ransomware-affected server from backup but has not established that its data is trustworthy. After reviewing the situation, the management objective is to restore service in business dependency order. Which response MOST directly addresses it?
- Follow approved priorities for logistics routing and customer updates
- Compare trusted checkpoints and business reconciliations against restored records
- Incorporate incident lessons into backup, testing and validation steps
- Confirm eradication and access control remediation before reconnecting
Explanation
Correct Answer
A:Recovery sequence matters. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Restoration does not guarantee correctness. That action primarily serves the different objective to verify restored data integrity before reopening access. It is not the step that directly satisfies the stated need to restore service in business dependency order.
C:Future readiness needs feedback. That action primarily serves the different objective to improve the recovery procedure. It is not the step that directly satisfies the stated need to restore service in business dependency order.
D:Reconnection may reintroduce compromise. That action primarily serves the different objective to ensure the intrusion path is closed. It is not the step that directly satisfies the stated need to restore service in business dependency order.
Question 292
A security team closes an incident when malware is removed but never examines why privileged access was granted. The root cause review is complete, but no manager owns the resulting corrective measures or delivery commitments. For the next governance decision, the team must assign corrective measures with owners. Which choice BEST provides that outcome?
- Report material weaknesses and treatment commitments to risk authorities
- Turn findings into prioritized, funded changes and due dates
- Conduct a structured cross-functional post-incident review
- Issue an expanded root-cause report without assigning corrective-action owners or delivery dates
Explanation
Correct Answer
B:Lessons need accountable execution. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Executive oversight needs consequences. That action primarily serves the different objective to inform governance of residual exposure. It is not the step that directly satisfies the stated need to assign corrective measures with owners.
C:Improvement requires candid evidence. That action primarily serves the different objective to record what went well and poorly during response. It is not the step that directly satisfies the stated need to assign corrective measures with owners.
D:Causal analysis matters but an unactioned report does not meet the request to assign and fund specific corrective measures. The governance decision is to name accountable owners, prioritized changes and deadlines.
Question 293
A logistics company tests incident communications only in daylight hours though a major outage occurred overnight. The overnight drill proved a critical incident authority had no reachable deputy when the primary contact was unavailable. The security program has been tasked specifically to repair the contact and authority model. Which approach should be selected?
- Create backups for critical decision roles and verified alternate channels
- Run an unannounced authorized out-of-hours escalation exercise
- Retain the previous incident contact spreadsheet with notes about unreachable owners but no delegated alternates
- Trigger contact-list updates and brief drills when roles change
Explanation
Correct Answer
A:Single points of failure delay response. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Exercises should reflect actual incident timing. That action primarily serves the different objective to test realistic staffing and communication conditions. It is not the step that directly satisfies the stated need to repair the contact and authority model.
C:Recording an unavailable owner documents the problem but cannot restore the command chain. The accountable repair is named backups and verified alternative channels.
D:Readiness records age quickly. That action primarily serves the different objective to maintain readiness after staff turnover. It is not the step that directly satisfies the stated need to repair the contact and authority model.
Question 294
A multinational organization activates incident response simultaneously in multiple countries but has no unified incident commander. A security manager has a defined assignment: share accurate incident state across regions. Which action BEST fulfills that specific assignment?
- Assign local legal leads to the global response team and map jurisdiction triggers
- Define a lead incident commander and delegated regional responsibilities
- Maintain a common status record and approved communication cadence
- Include coordination failures in post-incident improvements
Explanation
Correct Answer
C:Shared facts prevent fragmented decisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Response needs local compliance expertise. That action primarily serves the different objective to coordinate national legal and privacy requirements. It is not the step that directly satisfies the stated need to share accurate incident state across regions.
B:One command model reduces conflicting containment. That action primarily serves the different objective to establish an incident command structure. It is not the step that directly satisfies the stated need to share accurate incident state across regions.
D:Governance must learn from the event. That action primarily serves the different objective to review cross-region decision delays. It is not the step that directly satisfies the stated need to share accurate incident state across regions.
Question 295
A university's security center labels every phishing report as a high-severity incident. Investigators have verified unauthorized use of a faculty identity that can reach sensitive university records, but escalation has not occurred. The accountable executive now asks the team to escalate a confirmed compromise of faculty accounts. What should the security manager recommend?
- Triage indicators, exposure and critical service impact under approved rules
- Invoke the threshold for affected identities and access risk
- Update analyst guidance and retrain teams on classification examples
- Commission a new incident categorization policy while the verified faculty account takeover waits in the general phishing queue
Explanation
Correct Answer
B:Escalation should be evidence based. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Resource allocation depends on severity. That action primarily serves the different objective to prioritize investigative effort. It is not the step that directly satisfies the stated need to escalate a confirmed compromise of faculty accounts.
C:Clear criteria improve consistency. That action primarily serves the different objective to refine procedures after repeated false positives. It is not the step that directly satisfies the stated need to escalate a confirmed compromise of faculty accounts.
D:Policy development can improve future triage but does not escalate this already confirmed account compromise under the current approved severity threshold. The active event needs the authorized response trigger now.
Question 296
A fintech must update executives while investigators still disagree over whether customer data was exposed. After reviewing the situation, the management objective is to seek timely decisions without speculation. Which response MOST directly addresses it?
- Link affected services, data categories and operational losses to evidence
- Publish an authorized update explaining material factual changes
- Issue a status report showing known facts, unknowns and next verification steps
- Present risk-based response options and consequences to the incident authority
Explanation
Correct Answer
D:Leaders can act despite uncertainty. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Impact statements need support. That action primarily serves the different objective to document the current incident impact. It is not the step that directly satisfies the stated need to seek timely decisions without speculation.
B:Communications must stay accurate. That action primarily serves the different objective to correct previous status when evidence changes. It is not the step that directly satisfies the stated need to seek timely decisions without speculation.
C:Transparent uncertainty avoids false claims. That action primarily serves the different objective to separate verified facts from unconfirmed hypotheses. It is not the step that directly satisfies the stated need to seek timely decisions without speculation.
Question 297
A public utility has isolated an affected control-system host after a breach, and the team must verify it is clean before full restoration. For the next governance decision, the team must monitor the recovered environment closely. Which choice BEST provides that outcome?
- Validate the environment against known indicators and required baselines
- Document recovery evidence, residual exposure and lessons for governance
- Coordinate controlled restoration with engineering and safety teams
- Increase detection and log review for recurrence indicators
Explanation
Correct Answer
D:Recovery needs heightened assurance. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:An infected host can reinfect systems. That action primarily serves the different objective to confirm eradication before declaring normal operations. It is not the step that directly satisfies the stated need to monitor the recovered environment closely.
B:A closeout supports accountability. That action primarily serves the different objective to complete the incident record. It is not the step that directly satisfies the stated need to monitor the recovered environment closely.
C:Recovery must protect physical operations. That action primarily serves the different objective to sequence recovery around safety needs. It is not the step that directly satisfies the stated need to monitor the recovered environment closely.
Question 298
A bank suspects a cyberattack on an interbank settlement gateway with extremely limited tolerated downtime. The security program has been tasked specifically to preserve volatile evidence while maintaining safety. Which approach should be selected?
- Escalate to approved crisis and settlement risk decision makers
- Assess architecture resilience and alternate settlement routes with business owners
- Coordinate selective isolation with payment operations and regulators as appropriate
- Use preapproved forensic collection compatible with required continuity
Explanation
Correct Answer
D:Evidence needs must be balanced with operational risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Security engineers cannot unilaterally accept systemic effects. That action primarily serves the different objective to invoke the right business authority for high-impact action. It is not the step that directly satisfies the stated need to preserve volatile evidence while maintaining safety.
B:Systemic dependencies can warrant redesign. That action primarily serves the different objective to review strategic dependencies after stabilization. It is not the step that directly satisfies the stated need to preserve volatile evidence while maintaining safety.
C:Broad shutdown could cause systemic impact. That action primarily serves the different objective to define a containment option that preserves critical processing. It is not the step that directly satisfies the stated need to preserve volatile evidence while maintaining safety.
Question 299
A manufacturing group relies on one outsourced cloud identity service for business continuity across every plant. A security manager has a defined assignment: ensure fallback does not create excessive privileges. Which action BEST fulfills that specific assignment?
- Assess contract resilience, alternate providers and residual shared risk
- Set tightly controlled emergency access with post-use monitoring
- Map cloud identity availability to safety, production and remote access workflows
- Design and test approved identity fallback or alternate access arrangements
Explanation
Correct Answer
B:Availability exceptions need oversight. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:One service can affect all plants. That action primarily serves the different objective to review provider concentration exposure. It is not the step that directly satisfies the stated need to ensure fallback does not create excessive privileges.
C:Shared dependencies can concentrate outage impact. That action primarily serves the different objective to identify the common dependency across plants. It is not the step that directly satisfies the stated need to ensure fallback does not create excessive privileges.
D:Continuity needs an executable alternative. That action primarily serves the different objective to define a workable continuity approach. It is not the step that directly satisfies the stated need to ensure fallback does not create excessive privileges.
Question 300
A government data center has backups but no plan to reconstruct application dependencies after a major outage. The accountable executive now asks the team to prepare detailed technical restoration procedures. What should the security manager recommend?
- Use BIA findings to define RTO/RPO for affected services
- Assign fixes, fund missing capacity and retest failed dependencies
- Map identities, databases, networks and application dependencies
- Document repeatable runbooks with named owners and prerequisites
Explanation
Correct Answer
D:Recovery must be executable. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Technical targets need business justification. That action primarily serves the different objective to set business-approved recovery targets. It is not the step that directly satisfies the stated need to prepare detailed technical restoration procedures.
B:Gaps require verified remediation. That action primarily serves the different objective to close observed recovery gaps. It is not the step that directly satisfies the stated need to prepare detailed technical restoration procedures.
C:Recovery order affects service usability. That action primarily serves the different objective to establish the sequence needed for recovery. It is not the step that directly satisfies the stated need to prepare detailed technical restoration procedures.
