Isaca CISM Practice Test 33
Question 320
A fintech discovers that its production API has an unpatched weakness but compensating controls restrict exploitability. After reviewing the situation, the management objective is to track exposure through remediation. Which response MOST directly addresses it?
- Require tested compensating controls with an approved expiry and patch date
- Validate reachability, authentication barriers and business impact of exploitation
- Record the service owner as risk owner with security providing challenge
- Monitor patch progress, attack indicators and the effectiveness of the compensating control
Explanation
Correct Answer
D:Tracking reveals when the temporary risk worsens. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Temporary measures need limits and ownership. That action primarily serves the different objective to choose an interim response if code remediation is delayed. It is not the step that directly satisfies the stated need to track exposure through remediation.
B:A severity score alone does not measure realized business risk. That action primarily serves the different objective to establish how exposed the weakness is in context. It is not the step that directly satisfies the stated need to track exposure through remediation.
C:Operations owns the risk from its service. That action primarily serves the different objective to assign accountability for the vulnerability decision. It is not the step that directly satisfies the stated need to track exposure through remediation.
Question 321
A bank estimates fraud exposure for a new mobile payment feature with incomplete loss data. For the next governance decision, the team must choose a treatment threshold. Which choice BEST provides that outcome?
- Use documented loss ranges, assumptions and sensitivity scenarios instead of one false-precision number
- Compare plausible loss outcomes with approved risk tolerance and control cost
- Assess fraud loss, regulatory exposure and customer trust against business objectives
- Present ranges and evidence quality alongside the risk rating
Explanation
Correct Answer
B:Treatment should reflect risk appetite. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Uncertainty must remain visible to decision makers. That action primarily serves the different objective to select an analysis appropriate to uncertain loss estimates. It is not the step that directly satisfies the stated need to choose a treatment threshold.
C:Impact spans more than direct monetary theft. That action primarily serves the different objective to identify the consequences that matter to the business. It is not the step that directly satisfies the stated need to choose a treatment threshold.
D:A point score can conceal weak supporting data. That action primarily serves the different objective to communicate confidence in the assessment. It is not the step that directly satisfies the stated need to choose a treatment threshold.
Question 322
A manufacturer reports high cyber risk in its industrial control network, but its IT department claims ownership of the exposure. The security program has been tasked specifically to record the basis for acceptance or treatment. Which approach should be selected?
- Assign accountable plant engineering and IT control owners with clear interfaces
- Assign the plant business executive as risk owner and security as adviser
- Escalate decisions above local tolerance through the enterprise risk authority
- Document current exposure, options, decision authority and review date in the risk register
Explanation
Correct Answer
D:Traceable decisions support oversight. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Risk ownership and control execution are distinct. That action primarily serves the different objective to establish who implements the selected security controls. It is not the step that directly satisfies the stated need to record the basis for acceptance or treatment.
B:Business executives own operational impact. That action primarily serves the different objective to determine who can accept the production shutdown consequence. It is not the step that directly satisfies the stated need to record the basis for acceptance or treatment.
C:Plant managers cannot accept exposures beyond delegated appetite. That action primarily serves the different objective to resolve conflicting risk responses across plants. It is not the step that directly satisfies the stated need to record the basis for acceptance or treatment.
Question 323
A cloud retailer cannot immediately remove a legacy authentication dependency in a critical order system. A security manager has a defined assignment: show a path to eliminate the dependency. Which action BEST fulfills that specific assignment?
- Reduce reachable attack paths and impose stronger compensating authentication monitoring
- Fund a migration plan with tested cutover and rollback gates
- Seek acceptance from the authorized business risk executive
- Require time-limited risk treatment with approved controls and milestones
Explanation
Correct Answer
B:Structural remediation addresses the source of risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Compensating controls reduce exposure while modernization proceeds. That action primarily serves the different objective to select a defensible near-term mitigation. It is not the step that directly satisfies the stated need to show a path to eliminate the dependency.
C:A security engineer cannot accept enterprise revenue consequences. That action primarily serves the different objective to decide who may accept the remaining customer-order risk. It is not the step that directly satisfies the stated need to show a path to eliminate the dependency.
D:Temporary acceptance must have an end condition. That action primarily serves the different objective to avoid leaving an unbounded vulnerability exception. It is not the step that directly satisfies the stated need to show a path to eliminate the dependency.
Question 324
An online marketplace plans to stop storing cardholder data by switching to a payment service provider. The migration is signed off, but no independent scan has yet established whether local caches retain cardholder data. The accountable executive now asks the team to verify that the response was executed. What should the security manager recommend?
- Accept the vendor-migration signoff as evidence that no card data remains in local caches or backups
- Validate data-flow diagrams and storage scans show removal of card data
- Retain a marketplace business owner for payment-service risk
- Assess provider outages, integration attacks and contractual dependence
Explanation
Correct Answer
B:Architecture intent must match actual processing. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:An approved migration plan does not demonstrate completed removal. Actual data flows and retained storage must be verified through controlled scanning and mapping.
C:Delegation of processing does not transfer all accountability. That action primarily serves the different objective to allocate accountability for the new dependency. It is not the step that directly satisfies the stated need to verify that the response was executed.
D:Risk is changed rather than completely erased. That action primarily serves the different objective to identify the remaining risk after outsourcing. It is not the step that directly satisfies the stated need to verify that the response was executed.
Question 325
A shipping company is deciding whether to buy cyber insurance for cargo booking disruption. After reviewing the situation, the management objective is to assign responsibility for the transfer decision. Which response MOST directly addresses it?
- Compare covered loss scenarios, exclusions, deductibles and response conditions
- Maintain controls and tested continuity plans alongside coverage
- Compare financial impact scenarios and retained risk against appetite
- Secure approval from finance and the cargo booking risk owner
Explanation
Correct Answer
D:Risk financing must have accountable sponsors. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Risk transfer depends on contract wording. That action primarily serves the different objective to identify which losses can actually be transferred. It is not the step that directly satisfies the stated need to assign responsibility for the transfer decision.
B:Insurance cannot restore shipping systems. That action primarily serves the different objective to avoid assuming insurance fixes operational recovery. It is not the step that directly satisfies the stated need to assign responsibility for the transfer decision.
C:Coverage is an economic risk decision. That action primarily serves the different objective to choose a coverage level based on exposure. It is not the step that directly satisfies the stated need to assign responsibility for the transfer decision.
Question 326
An industrial company receives 200 critical-looking vulnerability alerts affecting different production networks. For the next governance decision, the team must report overdue high-exposure weaknesses. Which choice BEST provides that outcome?
- Validate findings with asset owners and non-disruptive evidence
- Coordinate compensating protection and maintenance windows with operations
- Use reachable attack paths, asset criticality and operational impact to rank findings
- Aggregate material residual exposure and accountable remediation owners for leadership
Explanation
Correct Answer
D:Management needs business impact and delays. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:False positives can waste remediation effort. That action primarily serves the different objective to confirm the alerts represent real deficiencies. It is not the step that directly satisfies the stated need to report overdue high-exposure weaknesses.
B:Safety and availability constrain remediation. That action primarily serves the different objective to select mitigation without threatening factory safety. It is not the step that directly satisfies the stated need to report overdue high-exposure weaknesses.
C:A high score on an isolated asset may be lower priority. That action primarily serves the different objective to prioritize risk beyond a technical severity label. It is not the step that directly satisfies the stated need to report overdue high-exposure weaknesses.
Question 327
A services firm wants cyber threat intelligence to influence executive risk decisions rather than produce unread bulletins. The firm already filters threat alerts by critical service, but executives cannot tell whether the alerts prompt faster risk decisions. The security program has been tasked specifically to track whether intelligence improves response. Which approach should be selected?
- Measure time from relevant warning to verified risk treatment
- Correlate external threat information with internal assets and telemetry
- Trigger targeted control checks and risk-owner decisions for affected services
- Report how many intelligence topics mention core services without checking whether warnings drove timely treatment
Explanation
Correct Answer
A:Decision latency is a meaningful outcome. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:External reports alone do not prove exposure. That action primarily serves the different objective to assess whether an indicator applies locally. It is not the step that directly satisfies the stated need to track whether intelligence improves response.
C:Action follows relevance assessment. That action primarily serves the different objective to act on intelligence suggesting near-term exploitation. It is not the step that directly satisfies the stated need to track whether intelligence improves response.
D:Selecting relevant topics defines the collection scope, not whether the intelligence improved decision speed or treatment. Use warning-to-verified-treatment outcomes to assess value.
Question 328
A government office compares risks to citizen identity records and an internal test website. A security manager has a defined assignment: escalate a risk above agreed tolerance. Which action BEST fulfills that specific assignment?
- Document qualitative ranges and the evidence supporting each rating
- Present the affected service and treatment options to the authorized executive
- Use consistent impact and likelihood scales tied to public-service objectives
- Include identity harm and statutory duties for citizen records rather than only infrastructure cost
Explanation
Correct Answer
B:Exceeding appetite requires decision authority. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Confidence matters to risk decisions. That action primarily serves the different objective to show uncertainty in probability estimates. It is not the step that directly satisfies the stated need to escalate a risk above agreed tolerance.
C:Inconsistent scales undermine prioritization. That action primarily serves the different objective to choose comparable assessment criteria. It is not the step that directly satisfies the stated need to escalate a risk above agreed tolerance.
D:Sensitivity changes consequence. That action primarily serves the different objective to identify asset-specific impact. It is not the step that directly satisfies the stated need to escalate a risk above agreed tolerance.
Question 329
A company relies on monthly heat maps, but executives cannot tell whether accepted risks are deteriorating. The accountable executive now asks the team to validate the risk data quality. What should the security manager recommend?
- Use control failures, threat activity and critical overdue exceptions linked to each top risk
- Present exposure trends, uncertainty, treatment status and accountable owners
- Reconcile indicators with source systems and investigate inconsistent reporting
- Set risk tolerance breaches and escalation levels approved by risk owners
Explanation
Correct Answer
C:Bad data creates misleading trends. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Forward-looking signals are more useful than a colored square. That action primarily serves the different objective to select indicators that reveal worsening exposure. It is not the step that directly satisfies the stated need to validate the risk data quality.
B:Leadership needs actionable risk context. That action primarily serves the different objective to report risk without losing context. It is not the step that directly satisfies the stated need to validate the risk data quality.
D:Thresholds connect monitoring to decisions. That action primarily serves the different objective to define thresholds for executive action. It is not the step that directly satisfies the stated need to validate the risk data quality.
Question 330
A franchise organization lets branch managers accept local cyber risks without written limits. After reviewing the situation, the management objective is to check that accepted risks stay acceptable. Which response MOST directly addresses it?
- Define acceptance limits and escalation rules approved by enterprise governance
- Assign named accountable business owners for cross-branch services
- Review residual risk periodically and when circumstances change
- Maintain risk decisions with reason, expiry and compensating controls
Explanation
Correct Answer
C:Acceptance is not a one-off event. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Delegation needs boundaries. That action primarily serves the different objective to establish delegated risk authority. It is not the step that directly satisfies the stated need to check that accepted risks stay acceptable.
B:Shared platforms require enterprise-wide ownership. That action primarily serves the different objective to identify risk owners for shared customer systems. It is not the step that directly satisfies the stated need to check that accepted risks stay acceptable.
D:An audit trail supports timely challenge. That action primarily serves the different objective to prevent undocumented permanent exceptions. It is not the step that directly satisfies the stated need to check that accepted risks stay acceptable.
