Isaca CISM Practice Test 31
Question 300
A government data center has backups but no plan to reconstruct application dependencies after a major outage. The accountable executive now asks the team to prepare detailed technical restoration procedures. What should the security manager recommend?
- Use BIA findings to define RTO/RPO for affected services
- Assign fixes, fund missing capacity and retest failed dependencies
- Map identities, databases, networks and application dependencies
- Document repeatable runbooks with named owners and prerequisites
Explanation
Correct Answer
D:Recovery must be executable. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Technical targets need business justification. That action primarily serves the different objective to set business-approved recovery targets. It is not the step that directly satisfies the stated need to prepare detailed technical restoration procedures.
B:Gaps require verified remediation. That action primarily serves the different objective to close observed recovery gaps. It is not the step that directly satisfies the stated need to prepare detailed technical restoration procedures.
C:Recovery order affects service usability. That action primarily serves the different objective to establish the sequence needed for recovery. It is not the step that directly satisfies the stated need to prepare detailed technical restoration procedures.
Question 301
A multinational retailer has acquired regional chains whose store leaders use different security approval practices. For the next governance decision, the team must make new security requirements usable by store employees. Which choice BEST provides that outcome?
- Publish a responsibility matrix approved by regional executives and the enterprise risk committee
- Translate the approved controls into local operating procedures and role-specific training
- Present a business case linking prioritized security changes to store uptime and loss exposure
- Interview regional leaders and map actual exception practices before designing the integration
Explanation
Correct Answer
B:Operational procedures translate policy into repeatable behavior. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Named owners prevent local exceptions from becoming ungoverned decisions. That action primarily serves the different objective to define accountable security decision-makers across the acquired chains. It is not the step that directly satisfies the stated need to make new security requirements usable by store employees.
C:A business-aligned case explains why controls matter to revenue operations. That action primarily serves the different objective to gain support for security integration without ignoring retail operations. It is not the step that directly satisfies the stated need to make new security requirements usable by store employees.
D:Observed decision behavior reveals gaps that a generic global policy cannot show. That action primarily serves the different objective to identify which local behaviors weaken the common control model. It is not the step that directly satisfies the stated need to make new security requirements usable by store employees.
Question 302
A healthcare provider is opening clinics in jurisdictions with differing privacy, retention and breach-notification duties. The security program has been tasked specifically to make evidence available for regulator inquiries. Which approach should be selected?
- Map each obligation to a control owner and retained compliance evidence
- Name compliance owners and a review cadence for each jurisdiction
- Create a jurisdiction-by-data-type obligations register reviewed with legal counsel
- Ask legal counsel to document controlling requirements and the permissible treatment for each data flow
Explanation
Correct Answer
A:Traceability demonstrates how requirements are fulfilled. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Without owners legal changes may never reach the control framework. That action primarily serves the different objective to assign responsibility for tracking changing patient-data rules. It is not the step that directly satisfies the stated need to make evidence available for regulator inquiries.
C:Documented requirements prevent a global default from violating a local obligation. That action primarily serves the different objective to identify obligations before deciding on one global retention setting. It is not the step that directly satisfies the stated need to make evidence available for regulator inquiries.
D:Legal interpretation must precede a conflicting operating rule. That action primarily serves the different objective to resolve an apparent conflict between contract and local law. It is not the step that directly satisfies the stated need to make evidence available for regulator inquiries.
Question 303
A logistics company has separate security, IT operations and business risk committees that keep overruling one another. A security manager has a defined assignment: inform the board without sending every technical defect. Which action BEST fulfills that specific assignment?
- Define business risk owner authority and escalation thresholds in a governance charter
- Establish a single approved decision hierarchy and cross-committee referral path
- Assign the security committee oversight of risk while process owners implement controls
- Roll up exposures, tolerance breaches and accountable owners into decision-ready reporting
Explanation
Correct Answer
D:The board needs risk decisions rather than raw alert counts. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Business accountability cannot be replaced by an IT-only vote. That action primarily serves the different objective to clarify who can authorize acceptance of delivery-platform risk. It is not the step that directly satisfies the stated need to inform the board without sending every technical defect.
B:A clear hierarchy resolves overlapping mandates. That action primarily serves the different objective to prevent conflicting policy decisions among committees. It is not the step that directly satisfies the stated need to inform the board without sending every technical defect.
C:Independent oversight avoids self-approval of effectiveness. That action primarily serves the different objective to separate security oversight from operational execution. It is not the step that directly satisfies the stated need to inform the board without sending every technical defect.
Question 304
An insurer's board wants a cyber strategy for its transition from branch offices to online customer services. The accountable executive now asks the team to translate strategy into accountable organizational execution. What should the security manager recommend?
- Derive security outcomes from the online service roadmap and business risk appetite
- Present expected business benefits, risk exposure and alternative investment options
- Assign owners, milestones and financing for approved security initiatives
- Prioritize initiatives by risk reduction, dependencies and business delivery dates
Explanation
Correct Answer
C:Accountability and resources turn a strategy into delivery. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Strategy must support business objectives rather than tool preferences. That action primarily serves the different objective to connect the cyber strategy to the digital business strategy. It is not the step that directly satisfies the stated need to translate strategy into accountable organizational execution.
B:Executives approve defensible business tradeoffs, not an uncosted technology list. That action primarily serves the different objective to gain authorization for security strategy investments. It is not the step that directly satisfies the stated need to translate strategy into accountable organizational execution.
D:A sequenced roadmap makes limited resources actionable. That action primarily serves the different objective to choose an ordered plan when funds cannot cover every initiative. It is not the step that directly satisfies the stated need to translate strategy into accountable organizational execution.
Question 305
A payments firm is adopting a common security framework across independently managed subsidiaries. After reviewing the situation, the management objective is to demonstrate framework adoption to directors. Which response MOST directly addresses it?
- Require authorized business risk owners to approve documented deviations
- Map framework objectives to business risks, obligations and existing control capabilities
- Publish an enterprise control taxonomy and agreed definitions for reporting
- Report target control outcomes and independently assessed coverage gaps
Explanation
Correct Answer
D:Adoption is shown through results rather than the number of policies distributed. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Exception decisions remain accountable to the risk-taking business. That action primarily serves the different objective to allocate decision rights for framework exceptions. It is not the step that directly satisfies the stated need to demonstrate framework adoption to directors.
B:Tailoring preserves relevance to enterprise conditions. That action primarily serves the different objective to select a governance framework without blindly inheriting every control. It is not the step that directly satisfies the stated need to demonstrate framework adoption to directors.
C:Common terms make cross-subsidiary evidence comparable. That action primarily serves the different objective to establish consistency when subsidiaries use different terminology. It is not the step that directly satisfies the stated need to demonstrate framework adoption to directors.
Question 306
A university has too little capital to execute all proposed security initiatives before the academic year. For the next governance decision, the team must address a projected staffing shortfall during implementation. Which choice BEST provides that outcome?
- Use capacity planning to identify needed skills and sequence hiring or outsourced support
- Use risk reduction, educational-service impact and dependencies to rank proposals
- Attach approved owners, milestones and measurable results to each funded initiative
- Develop a business case with alternatives, cost, residual risk and expected benefits
Explanation
Correct Answer
A:People and capabilities are part of the program budget. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Business consequences establish funding priority. That action primarily serves the different objective to determine which proposals deserve funding priority. It is not the step that directly satisfies the stated need to address a projected staffing shortfall during implementation.
C:Accountable plans prevent untracked spending. That action primarily serves the different objective to avoid funding a program with no accountable outcomes. It is not the step that directly satisfies the stated need to address a projected staffing shortfall during implementation.
D:Tradeoff evidence supports a prudent board decision. That action primarily serves the different objective to defend a proposed network security investment. It is not the step that directly satisfies the stated need to address a projected staffing shortfall during implementation.
Question 307
An industrial manufacturer is moving from a command-driven security culture to a cross-functional safety culture. The security program has been tasked specifically to measure whether the culture change is taking hold. Which approach should be selected?
- Include plant operations and safety representatives in security governance decisions
- Translate security policy into plant-specific instructions with visible leadership sponsorship
- Track unsafe exception trends and the closure of worker-reported security issues
- Use interviews and workflow observations to identify pressure points before revising controls
Explanation
Correct Answer
C:Behavior and response evidence provide stronger signals than attendance counts. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Ownership grows when controls reflect actual plant tasks. That action primarily serves the different objective to obtain worker participation in security design. It is not the step that directly satisfies the stated need to measure whether the culture change is taking hold.
B:Local procedures need practical management backing. That action primarily serves the different objective to make requirements credible to shift supervisors. It is not the step that directly satisfies the stated need to measure whether the culture change is taking hold.
D:Unsafe workarounds can be caused by workflow conflicts. That action primarily serves the different objective to understand why workers bypass the new cyber procedures. It is not the step that directly satisfies the stated need to measure whether the culture change is taking hold.
Question 308
A global e-commerce company outsources payment processing while remaining accountable for customer information. A security manager has a defined assignment: respond to processor use of an undisclosed fourth party. Which action BEST fulfills that specific assignment?
- Review independent assurance evidence and unresolved findings against contracted controls
- Include measurable security, audit, incident notice and subcontractor provisions in the contract
- Invoke contract review and assess downstream data access before permitting the new subcontractor
- Map statutory and contractual accountability to the company and processor with legal review
Explanation
Correct Answer
C:Additional providers can change legal and cyber exposure. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Continuous oversight is necessary after onboarding. That action primarily serves the different objective to verify performance after the processing contract begins. It is not the step that directly satisfies the stated need to respond to processor use of an undisclosed fourth party.
B:Contract rights support oversight and remediation. That action primarily serves the different objective to make the processor's control commitments enforceable. It is not the step that directly satisfies the stated need to respond to processor use of an undisclosed fourth party.
D:Outsourcing performance does not erase the organization's compliance duties. That action primarily serves the different objective to determine which compliance responsibilities cannot be delegated. It is not the step that directly satisfies the stated need to respond to processor use of an undisclosed fourth party.
Question 309
An energy company has created a new CISO role, but line executives assume it owns every cyber risk. The accountable executive now asks the team to approve a cross-functional policy with competing demands. What should the security manager recommend?
- Route the policy through defined executive governance and legal consultation
- Document that business process owners accept their risks while the CISO advises and monitors
- Approve a governance charter linking the CISO, risk committee and board
- Separate implementation responsibility from independent control assurance
Explanation
Correct Answer
A:Enterprise policy needs authority beyond one technology department. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:The security function facilitates risk governance but cannot own all business decisions. That action primarily serves the different objective to explain ownership of business information risk. It is not the step that directly satisfies the stated need to approve a cross-functional policy with competing demands.
C:Governance must provide access to decision makers. That action primarily serves the different objective to give the CISO a formal escalation path. It is not the step that directly satisfies the stated need to approve a cross-functional policy with competing demands.
D:A self-review may conceal failures. That action primarily serves the different objective to prevent controls from being judged only by their designers. It is not the step that directly satisfies the stated need to approve a cross-functional policy with competing demands.
Question 310
A bank wants to expand into embedded finance partnerships and expose customer APIs to third parties. After reviewing the situation, the management objective is to assign accountability across bank and partners. Which response MOST directly addresses it?
- Define service and data risk ownership with explicit partner handoffs
- Build an architecture-driven security roadmap with business launch gates
- Compare risk and business impact of alternative API protection approaches
- Identify partner/API risk scenarios and link them to business growth objectives
Explanation
Correct Answer
A:Interfaces between organizations create ownership gaps. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Dependencies avoid releasing an ungoverned interface. That action primarily serves the different objective to prioritize controls that are dependencies for partner launch. It is not the step that directly satisfies the stated need to assign accountability across bank and partners.
C:Decision makers need options framed in business consequences. That action primarily serves the different objective to present options for security investment to the board. It is not the step that directly satisfies the stated need to assign accountability across bank and partners.
D:Security strategy must account for new revenue channels. That action primarily serves the different objective to incorporate ecosystem dependence into the security strategy. It is not the step that directly satisfies the stated need to assign accountability across bank and partners.
