Isaca CISM Practice Test 37
Question 360
A hospital tracks security controls by purchase date and vendor name but cannot prove effectiveness. After reviewing the situation, the management objective is to report ineffective controls to risk owners. Which response MOST directly addresses it?
- Document the risk scenario and measurable preventive or detective result
- Link failed tests to residual impact, remediation dates and accountable owners
- Use configuration inspection, operation sampling and controlled security tests
- Test whether controls function repeatedly in the production context
Explanation
Correct Answer
B:Management needs impact and ownership. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Control intent must be explicit. That action primarily serves the different objective to define the expected outcome of each control. It is not the step that directly satisfies the stated need to report ineffective controls to risk owners.
C:Multiple evidence types improve assurance. That action primarily serves the different objective to select independent validation methods. It is not the step that directly satisfies the stated need to report ineffective controls to risk owners.
D:A good design may be badly operated. That action primarily serves the different objective to distinguish operating from design effectiveness. It is not the step that directly satisfies the stated need to report ineffective controls to risk owners.
Question 361
A security operations department reports thousands of alerts to senior leadership with no risk prioritization. For the next governance decision, the team must verify reported information is reliable. Which choice BEST provides that outcome?
- Reconcile incident and asset records and explain uncertainty
- Consult risk owners about required decisions and risk thresholds
- Connect confirmed incidents and control failures to impacted services
- Show options, residual exposure, owner and deadline for material gaps
Explanation
Correct Answer
A:Poor data quality undermines confidence. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Reporting should serve its audience. That action primarily serves the different objective to identify business decisions the report should support. It is not the step that directly satisfies the stated need to verify reported information is reliable.
C:Alert volume alone is ambiguous. That action primarily serves the different objective to translate operational data into meaningful risk measures. It is not the step that directly satisfies the stated need to verify reported information is reliable.
D:Executives need clear decisions. That action primarily serves the different objective to present actionable escalation choices. It is not the step that directly satisfies the stated need to verify reported information is reliable.
Question 362
A critical infrastructure company has no agreed metrics for its identity control modernization program. The security program has been tasked specifically to inform executives of unfavorable trends. Which approach should be selected?
- Report both enrollment rates and test evidence of controlled access
- Escalate material access gaps and accountable remediation owners
- Inventory accounts, existing controls and known exceptions before reporting progress
- Define privileged account coverage and verified unauthorized-access prevention targets
Explanation
Correct Answer
B:Management needs actionable exceptions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Enrollment does not prove prevention. That action primarily serves the different objective to distinguish delivery outputs from effectiveness. It is not the step that directly satisfies the stated need to inform executives of unfavorable trends.
C:A baseline enables comparison. That action primarily serves the different objective to create a reliable measurement baseline. It is not the step that directly satisfies the stated need to inform executives of unfavorable trends.
D:Metrics should match risk objectives. That action primarily serves the different objective to select measures based on intended risk outcomes. It is not the step that directly satisfies the stated need to inform executives of unfavorable trends.
Question 363
A bank is implementing a zero-trust access program for remote contractors. A security manager has a defined assignment: verify continuous access governance. Which action BEST fulfills that specific assignment?
- Review contractor expiry, access logs and policy exceptions
- Require verified identity, device assurance and per-application authorization
- Test legitimate workflows and prohibited lateral paths before scaling
- Map contractor identities, devices and target applications
Explanation
Correct Answer
A:Trust decisions need periodic reassessment. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Broad network access is unnecessary. That action primarily serves the different objective to choose least-privilege access design. It is not the step that directly satisfies the stated need to verify continuous access governance.
C:Usability and enforcement both matter. That action primarily serves the different objective to pilot the access controls with representative users. It is not the step that directly satisfies the stated need to verify continuous access governance.
D:Access design needs the real workflow. That action primarily serves the different objective to identify which access paths require protection. It is not the step that directly satisfies the stated need to verify continuous access governance.
Question 364
A global retailer is launching a security communications program during a company reorganization. The accountable executive now asks the team to evaluate communications effectiveness. What should the security manager recommend?
- Map executives, store operations, suppliers and technical teams to specific messages
- Publish role-specific instructions in relevant languages and channels
- Assign approved spokespersons, update cadence and escalation routes
- Test whether workers correctly act on critical security notices
Explanation
Correct Answer
D:Message delivery does not prove understanding. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:One message cannot serve all audiences. That action primarily serves the different objective to identify audiences and decisions they need to make. It is not the step that directly satisfies the stated need to evaluate communications effectiveness.
B:Comprehension is needed for adoption. That action primarily serves the different objective to translate enterprise policy into usable guidance. It is not the step that directly satisfies the stated need to evaluate communications effectiveness.
C:Conflicting messages undermine response. That action primarily serves the different objective to establish trusted communication ownership. It is not the step that directly satisfies the stated need to evaluate communications effectiveness.
Question 365
A government cloud migration introduces new identity and data trust boundaries not covered by the security architecture. After reviewing the situation, the management objective is to test conformance after deployment. Which response MOST directly addresses it?
- Require documented design risk acceptance before authorizing exceptions
- Check actual trust paths and privileged access against the approved reference
- Define identity isolation, logging and encryption reference designs for the new platform
- Map new identity federation and data paths against the enterprise threat model
Explanation
Correct Answer
B:A diagram alone is insufficient. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Bypasses must remain governed. That action primarily serves the different objective to review proposed deviations to the pattern. It is not the step that directly satisfies the stated need to test conformance after deployment.
C:Patterns support consistent decisions. That action primarily serves the different objective to select a reusable secure architecture pattern. It is not the step that directly satisfies the stated need to test conformance after deployment.
D:New trust boundaries change exposure. That action primarily serves the different objective to identify architecture assumptions that must be updated. It is not the step that directly satisfies the stated need to test conformance after deployment.
Question 366
A large university has deployed centralized logging but discovers critical research servers do not forward events. For the next governance decision, the team must test investigators' ability to reconstruct incidents. Which choice BEST provides that outcome?
- Run controlled scenarios using actual retained logs and timelines
- Monitor telemetry heartbeat and expected event volumes by asset
- Map critical research workloads to required security event types
- Standardize authenticated forwarding, time synchronization and protected retention
Explanation
Correct Answer
A:Collection alone does not prove usability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Silent gaps undermine detection. That action primarily serves the different objective to detect collection gaps early. It is not the step that directly satisfies the stated need to test investigators' ability to reconstruct incidents.
C:Coverage should follow assets and risks. That action primarily serves the different objective to identify which services create high-value detection evidence. It is not the step that directly satisfies the stated need to test investigators' ability to reconstruct incidents.
D:Logs must be accurate and available. That action primarily serves the different objective to implement dependable log collection. It is not the step that directly satisfies the stated need to test investigators' ability to reconstruct incidents.
Question 367
A financial firm moves email threat filtering to a managed security service. The managed-filtering provider has operated under an agreed detection and escalation scope for two quarters. The board now needs outcome measures demonstrating whether the service actually performed. The security program has been tasked specifically to measure service performance after go-live. Which approach should be selected?
- Document detection scope, response authority, data access and escalation timing
- Review capability tests, assurance and resilience against the firm's requirements
- Define escalation paths, evidence formats and accountability handoffs
- Track missed detections, actionable alert timing and response quality
Explanation
Correct Answer
D:Service-level compliance should reflect outcomes. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Outsourcing needs precise boundaries. That action primarily serves the different objective to specify expected outcomes and service boundaries. It is not the step that directly satisfies the stated need to measure service performance after go-live.
B:Price is not sufficient evidence. That action primarily serves the different objective to evaluate the provider before selection. It is not the step that directly satisfies the stated need to measure service performance after go-live.
C:Alerts without ownership can be lost. That action primarily serves the different objective to integrate provider alerts into internal decisions. It is not the step that directly satisfies the stated need to measure service performance after go-live.
Question 368
A retail firm has standard operating procedures for patching, but teams say the policy gives no decision thresholds. A security manager has a defined assignment: test whether procedures are followed. Which action BEST fulfills that specific assignment?
- Sample patch records and validate deployed versions on critical systems
- Define mandatory risk-based remediation objectives approved by management
- Record business approval, compensating controls and expiry dates
- Specify testing, change windows, rollback and escalation steps
Explanation
Correct Answer
A:A checklist is not technical evidence. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Policy should state required outcomes. That action primarily serves the different objective to establish the enterprise's patch risk policy. It is not the step that directly satisfies the stated need to test whether procedures are followed.
C:A waiver must be governed. That action primarily serves the different objective to manage exemptions for unsupported applications. It is not the step that directly satisfies the stated need to test whether procedures are followed.
D:Procedures implement policy. That action primarily serves the different objective to write executable patch procedures for each platform. It is not the step that directly satisfies the stated need to test whether procedures are followed.
Question 369
A cloud software startup reports high test coverage but repeated access-control vulnerabilities reach production. The accountable executive now asks the team to verify fixes without trusting code review alone. What should the security manager recommend?
- Retest the previously exploitable authorization paths in a staging environment
- Add abuse-path and privilege-boundary tests to the release pipeline
- Review negative authorization cases across tenant and user boundaries
- Tie confirmed findings to product owners and release deadlines
Explanation
Correct Answer
A:A reviewed patch may still fail. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Security tests must exercise expected denial. That action primarily serves the different objective to update the test strategy. It is not the step that directly satisfies the stated need to verify fixes without trusting code review alone.
C:Code coverage does not prove security cases. That action primarily serves the different objective to identify why existing tests miss authorization flaws. It is not the step that directly satisfies the stated need to verify fixes without trusting code review alone.
D:Findings need accountable action. That action primarily serves the different objective to assign responsibility for remediation. It is not the step that directly satisfies the stated need to verify fixes without trusting code review alone.
Question 370
An e-commerce company's board wants proof its security investment is reducing account takeover risk. After reviewing the situation, the management objective is to report remaining exposure to the board. Which response MOST directly addresses it?
- Normalize events against active users and transaction volume
- Reconcile fraud reports, detection changes and help desk outcomes
- Present residual risk, control gaps and planned investments in business terms
- Measure confirmed takeover incidence and effective account recovery trends
Explanation
Correct Answer
C:The board governs exposure not tooling details. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Raw counts may mislead when business grows. That action primarily serves the different objective to account for growth in customer accounts. It is not the step that directly satisfies the stated need to report remaining exposure to the board.
B:Changes in measurement can mimic improvement. That action primarily serves the different objective to validate that declines are not reporting artifacts. It is not the step that directly satisfies the stated need to report remaining exposure to the board.
D:Spending is an input rather than the goal. That action primarily serves the different objective to establish an outcome-focused metric. It is not the step that directly satisfies the stated need to report remaining exposure to the board.
