Isaca CISM Practice Test 34
Question 330
A franchise organization lets branch managers accept local cyber risks without written limits. After reviewing the situation, the management objective is to check that accepted risks stay acceptable. Which response MOST directly addresses it?
- Define acceptance limits and escalation rules approved by enterprise governance
- Assign named accountable business owners for cross-branch services
- Review residual risk periodically and when circumstances change
- Maintain risk decisions with reason, expiry and compensating controls
Explanation
Correct Answer
C:Acceptance is not a one-off event. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Delegation needs boundaries. That action primarily serves the different objective to establish delegated risk authority. It is not the step that directly satisfies the stated need to check that accepted risks stay acceptable.
B:Shared platforms require enterprise-wide ownership. That action primarily serves the different objective to identify risk owners for shared customer systems. It is not the step that directly satisfies the stated need to check that accepted risks stay acceptable.
D:An audit trail supports timely challenge. That action primarily serves the different objective to prevent undocumented permanent exceptions. It is not the step that directly satisfies the stated need to check that accepted risks stay acceptable.
Question 331
A healthcare supplier introduces an AI summarization service handling sensitive medical notes. For the next governance decision, the team must ensure accountability for model risk. Which choice BEST provides that outcome?
- Require safeguards for authorized access, data minimization and monitoring before rollout
- Map prompts, outputs, provider access and retention paths
- Assign a business service owner and specialist control owners
- Model data leakage, prompt abuse, vendor handling and incorrect-output scenarios
Explanation
Correct Answer
C:Vendor technology cannot replace internal risk ownership. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Controls should reflect sensitive clinical data. That action primarily serves the different objective to choose a treatment appropriate to risk tolerance. It is not the step that directly satisfies the stated need to ensure accountability for model risk.
B:Data-flow mapping exposes security and privacy obligations. That action primarily serves the different objective to identify relevant information assets and flows. It is not the step that directly satisfies the stated need to ensure accountability for model risk.
D:AI service risks differ from conventional infrastructure. That action primarily serves the different objective to discover threats specific to this new dependency. It is not the step that directly satisfies the stated need to ensure accountability for model risk.
Question 332
An e-commerce firm estimates its cyber risk using a single average annual loss number despite highly variable holiday traffic. The security program has been tasked specifically to present financial and nonfinancial consequences. Which approach should be selected?
- Document assumptions and confidence limits on frequency and financial severity
- Compare extreme-loss scenarios with tolerance and response costs
- Include trust, contractual commitments and recovery time in the risk report
- Model plausible peak-season loss scenarios and sensitivity to demand
Explanation
Correct Answer
C:Business impact is broader than invoices. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Uncertain estimates should not masquerade as facts. That action primarily serves the different objective to separate uncertainty from controllable risk. It is not the step that directly satisfies the stated need to present financial and nonfinancial consequences.
B:Peak conditions may drive treatment. That action primarily serves the different objective to select risk treatment against seasonal appetite. It is not the step that directly satisfies the stated need to present financial and nonfinancial consequences.
D:The mean can hide tail impacts. That action primarily serves the different objective to represent severe but infrequent exposure. It is not the step that directly satisfies the stated need to present financial and nonfinancial consequences.
Question 333
A utilities operator has many risk exceptions but no way to know which are approaching expiration. A security manager has a defined assignment: evaluate exception-management effectiveness. Which action BEST fulfills that specific assignment?
- Sort by materiality, upcoming expiry and changes in threat conditions
- Track owners, approval dates, expiry, compensating controls and affected systems
- Measure overdue reviews and exceptions without verified safeguards
- Notify the risk owner and invoke the defined tolerance escalation process
Explanation
Correct Answer
C:Process quality can be measured. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Review effort should focus on greatest risk. That action primarily serves the different objective to prioritize review of exceptional exposures. It is not the step that directly satisfies the stated need to evaluate exception-management effectiveness.
B:Structured records support governance. That action primarily serves the different objective to maintain a usable exception inventory. It is not the step that directly satisfies the stated need to evaluate exception-management effectiveness.
D:A failed compensating control changes residual risk. That action primarily serves the different objective to escalate an exception whose safeguard stopped operating. It is not the step that directly satisfies the stated need to evaluate exception-management effectiveness.
Question 334
A transportation platform has a partner integration whose legacy protocol cannot support the new encryption standard. The accountable executive now asks the team to create a sustainable treatment path. What should the security manager recommend?
- Agree on a protocol migration plan with partner milestones and contractual duties
- Obtain documented acceptance from the owner of the transport business process
- Assess interception exposure, data classification and external access paths
- Restrict connectivity and add compensating transport controls with a sunset date
Explanation
Correct Answer
A:Partner dependencies require joint remediation. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:The business owns consequences of residual risk. That action primarily serves the different objective to determine who may retain the exposure temporarily. It is not the step that directly satisfies the stated need to create a sustainable treatment path.
C:Treatment depends on information sensitivity. That action primarily serves the different objective to identify the risk introduced by the legacy channel. It is not the step that directly satisfies the stated need to create a sustainable treatment path.
D:Interim controls can narrow impact. That action primarily serves the different objective to reduce exposure while a replacement is built. It is not the step that directly satisfies the stated need to create a sustainable treatment path.
Question 335
A software company discovers that privileged users can bypass the approval workflow in its production pipeline. After reviewing the situation, the management objective is to assign responsibility for remediation. Which response MOST directly addresses it?
- Check independent monitoring and approval evidence for privileged changes
- Name the release process owner and privileged access control owner
- Test the pathway from privileged actions to unauthorized releases and sensitive code
- Implement enforceable separation of approval and production deployment duties
Explanation
Correct Answer
B:Cross-functional weaknesses need explicit accountability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Dual evidence may reduce exposure while fixing access. That action primarily serves the different objective to identify effective compensating controls. It is not the step that directly satisfies the stated need to assign responsibility for remediation.
C:A control gap matters through its consequences. That action primarily serves the different objective to assess how the bypass affects business assets. It is not the step that directly satisfies the stated need to assign responsibility for remediation.
D:Preventive controls eliminate unauthorized self-approval. That action primarily serves the different objective to choose an enduring control improvement. It is not the step that directly satisfies the stated need to assign responsibility for remediation.
Question 336
A municipality finds network-connected water equipment installed by a maintenance contractor without a security review. For the next governance decision, the team must assign vendor responsibilities. Which choice BEST provides that outcome?
- Evaluate credible cyber pathways with plant engineers and safety specialists
- Inventory contractor-installed devices and map connectivity into control networks
- Restrict unneeded remote access while coordinating with plant operations
- Update maintenance contracts with authorized access and reporting requirements
Explanation
Correct Answer
D:Contractor access needs enforceable limits. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Operational risk is not only data loss. That action primarily serves the different objective to assess safety and continuity consequences. It is not the step that directly satisfies the stated need to assign vendor responsibilities.
B:Unknown devices create unassessed exposure. That action primarily serves the different objective to identify exposed operational technology assets. It is not the step that directly satisfies the stated need to assign vendor responsibilities.
C:Protection must not interrupt vital processes. That action primarily serves the different objective to choose an immediately safe exposure reduction. It is not the step that directly satisfies the stated need to assign vendor responsibilities.
Question 337
A cloud company has accepted several high risks, and new regulations impose tighter customer data handling duties. The security program has been tasked specifically to communicate required decisions to leaders. Which approach should be selected?
- Fund controls and deadlines that address the identified compliance gap
- Present legal consequences, affected services and accountable risk owners
- Reassess residual exposures against updated risk appetite and mandatory compliance
- Compare accepted exposures with the new statutory duties and enforcement dates
Explanation
Correct Answer
B:Executive decisions require explicit impact. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Obligations need concrete remediation. That action primarily serves the different objective to propose treatment for obligations not currently satisfied. It is not the step that directly satisfies the stated need to communicate required decisions to leaders.
C:Acceptance cannot override law. That action primarily serves the different objective to determine whether previous acceptance is still valid. It is not the step that directly satisfies the stated need to communicate required decisions to leaders.
D:A regulatory shift changes acceptable risk. That action primarily serves the different objective to identify which risk assumptions have changed. It is not the step that directly satisfies the stated need to communicate required decisions to leaders.
Question 338
A manufacturer is adopting a cloud-hosted production forecasting engine that shares sensitive recipes with a technology supplier. A security manager has a defined assignment: select additional treatment when residual risk exceeds appetite. Which action BEST fulfills that specific assignment?
- Require segregation, minimal data transfer and verified provider controls before rollout
- Analyze supplier access, data handling and model-output leakage pathways
- Assess audit rights, subcontractor restrictions and incident notice against the data flow
- Have the product business owner decide with legal and security advice
Explanation
Correct Answer
A:Technical and contractual controls can lower risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Critical intellectual property may be exposed outside the plant. That action primarily serves the different objective to identify material threats from sharing recipes. It is not the step that directly satisfies the stated need to select additional treatment when residual risk exceeds appetite.
C:Contract terms must reflect the actual processing. That action primarily serves the different objective to determine whether contractual controls address the risk. It is not the step that directly satisfies the stated need to select additional treatment when residual risk exceeds appetite.
D:The owner of recipe value accepts business risk. That action primarily serves the different objective to assign acceptance authority for remaining exposure. It is not the step that directly satisfies the stated need to select additional treatment when residual risk exceeds appetite.
Question 339
A regional bank is implementing the security program approved by its new digital banking strategy. The accountable executive now asks the team to resolve scarce specialist capacity. What should the security manager recommend?
- Use a workforce plan that combines training, recruitment and qualified external support
- Name owners for controls, funding, integration and reporting
- Create a funded roadmap tied to the digital platform milestones
- Build a skills and capacity assessment against prioritized security outcomes
Explanation
Correct Answer
A:Capability gaps need sustainable solutions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Clear responsibility supports execution. That action primarily serves the different objective to assign accountability for program delivery. It is not the step that directly satisfies the stated need to resolve scarce specialist capacity.
C:Program dependencies affect delivery order. That action primarily serves the different objective to sequence work with dependent projects. It is not the step that directly satisfies the stated need to resolve scarce specialist capacity.
D:Tool purchases cannot replace required people and operating capacity. That action primarily serves the different objective to estimate program resources before selecting vendors. It is not the step that directly satisfies the stated need to resolve scarce specialist capacity.
Question 340
A hospital's data inventory excludes confidential imaging archives managed by a research partner. After reviewing the situation, the management objective is to detect newly created unclassified datasets. Which response MOST directly addresses it?
- Classify patient imaging using sensitivity, clinical need and applicable duties
- Map data sets, locations, owners and external processing relationships
- Integrate discovery and owner review into the data lifecycle
- Define contractually required safeguards derived from the classification
Explanation
Correct Answer
C:Periodic discovery limits inventory drift. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Business impact and regulation guide classification. That action primarily serves the different objective to assign classification based on harm and obligations. It is not the step that directly satisfies the stated need to detect newly created unclassified datasets.
B:Incomplete inventories hide sensitive information. That action primarily serves the different objective to identify all information assets in the patient workflow. It is not the step that directly satisfies the stated need to detect newly created unclassified datasets.
D:Outside custody does not eliminate handling obligations. That action primarily serves the different objective to ensure the partner applies correct handling protections. It is not the step that directly satisfies the stated need to detect newly created unclassified datasets.
