Isaca CISM Practice Test 39
Question 380
A software vendor's incident response plan has a generic contact list but unclear decision authority during a breach. After reviewing the situation, the management objective is to test communication during simulated escalation. Which response MOST directly addresses it?
- Assign incident commander, legal, operations and business decision roles
- Run an exercise with out-of-hours contact and approval paths
- Define classification triggers and callout thresholds
- Document containment options, approvals and dependencies by scenario
Explanation
Correct Answer
B:Contacts may fail under realistic conditions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Clear authority reduces confusion. That action primarily serves the different objective to define incident command responsibilities. It is not the step that directly satisfies the stated need to test communication during simulated escalation.
C:Consistent criteria prevent activation delays. That action primarily serves the different objective to specify when to activate the response plan. It is not the step that directly satisfies the stated need to test communication during simulated escalation.
D:Teams need executable decisions. That action primarily serves the different objective to create decision-ready action playbooks. It is not the step that directly satisfies the stated need to test communication during simulated escalation.
Question 381
A payments processor detects a breach that may involve customer data in several jurisdictions. For the next governance decision, the team must preserve evidence of notification decisions. Which choice BEST provides that outcome?
- Use an approved communications process that separates confirmed facts from hypotheses
- Activate named spokespeople, customer contacts and regulator response owners
- Record discovery times, legal interpretations and approvals
- Involve legal and privacy leads in classifying impacted data, locations and time triggers
Explanation
Correct Answer
C:Timelines may be reviewed later. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Inaccurate messages can create harm. That action primarily serves the different objective to avoid premature public statements. It is not the step that directly satisfies the stated need to preserve evidence of notification decisions.
B:Consistent messaging needs ownership. That action primarily serves the different objective to coordinate internal and external communications. It is not the step that directly satisfies the stated need to preserve evidence of notification decisions.
D:Notice requirements differ across duties. That action primarily serves the different objective to identify applicable notification obligations early. It is not the step that directly satisfies the stated need to preserve evidence of notification decisions.
Question 382
An insurance investigation needs evidence from a compromised laptop that may later be used in litigation. The security program has been tasked specifically to limit access to sensitive investigative data. Which approach should be selected?
- Acquire forensic images using documented methods and integrity hashes
- Record every transfer, holder, time and purpose in a chain-of-custody log
- Restrict evidence access to authorized investigators and log handling
- Coordinate memory and live-state collection before disruptive changes where safe
Explanation
Correct Answer
C:Integrity and confidentiality both matter. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Repeatable preservation supports admissibility. That action primarily serves the different objective to preserve the original evidence properly. It is not the step that directly satisfies the stated need to limit access to sensitive investigative data.
B:Custody history supports authenticity. That action primarily serves the different objective to document custody of the laptop and images. It is not the step that directly satisfies the stated need to limit access to sensitive investigative data.
D:Volatile artifacts can vanish. That action primarily serves the different objective to avoid destroying volatile evidence. It is not the step that directly satisfies the stated need to limit access to sensitive investigative data.
Question 383
A hospital detects ransomware movement across workstations but isolating some devices could delay patient care. A security manager has a defined assignment: verify isolation effectiveness. Which action BEST fulfills that specific assignment?
- Review network and endpoint telemetry for continuing movement
- Revoke compromised access and restrict lateral trust paths where feasible
- Apply approved patient-safety and security impact thresholds through incident command
- Coordinate with clinical leaders to isolate noncritical paths first and protect essential treatment
Explanation
Correct Answer
A:A command issued is not evidence of containment. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Containment includes identities. That action primarily serves the different objective to prevent further spread through shared credentials. It is not the step that directly satisfies the stated need to verify isolation effectiveness.
C:High-impact actions need authorized decisions. That action primarily serves the different objective to decide when emergency shutdown is warranted. It is not the step that directly satisfies the stated need to verify isolation effectiveness.
D:Containment must weigh immediate safety. That action primarily serves the different objective to select safe containment priorities. It is not the step that directly satisfies the stated need to verify isolation effectiveness.
Question 384
A retailer observes unusual outbound data volume from a customer analytics service. The accountable executive now asks the team to assess customer notification needs. What should the security manager recommend?
- Determine confirmed data categories, recipients and governing duties with legal counsel
- Correlate data egress records, account activity and authorized business exports
- Restrict identified risky accounts and outbound paths under incident authority
- Preserve relevant logs, data flow records and cloud control-plane events
Explanation
Correct Answer
A:Obligations depend on affected information. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Volume anomalies require context. That action primarily serves the different objective to determine whether exfiltration occurred. It is not the step that directly satisfies the stated need to assess customer notification needs.
C:Targeted containment reduces exposure. That action primarily serves the different objective to limit ongoing unauthorized transfers. It is not the step that directly satisfies the stated need to assess customer notification needs.
D:Evidence may be short-lived. That action primarily serves the different objective to protect evidence before response changes. It is not the step that directly satisfies the stated need to assess customer notification needs.
Question 385
A media company learns that its website provider suffered a breach affecting shared administration credentials. After reviewing the situation, the management objective is to assess whether business services require isolation. Which response MOST directly addresses it?
- Require provider indicators and compare with local account and service logs
- Rotate affected secrets and restrict provider access under the incident plan
- Invoke contractual incident reporting and evidence-sharing obligations
- Use asset and data impact to decide targeted containment
Explanation
Correct Answer
D:Unnecessary shutdown can worsen service disruption. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Vendor breach does not prove identical customer compromise. That action primarily serves the different objective to confirm the company's actual scope of exposure. It is not the step that directly satisfies the stated need to assess whether business services require isolation.
B:Account exposure can propagate. That action primarily serves the different objective to contain exposed shared credentials. It is not the step that directly satisfies the stated need to assess whether business services require isolation.
C:Information should follow documented agreements. That action primarily serves the different objective to obtain reliable vendor updates. It is not the step that directly satisfies the stated need to assess whether business services require isolation.
Question 386
A firm suspects an employee deliberately copied sensitive product plans before resignation. For the next governance decision, the team must determine actual scope of information exposure. Which choice BEST provides that outcome?
- Secure access logs, device evidence and approved data access records
- Restrict access proportionately under approved employment and incident procedures
- Coordinate with legal, HR and security under established investigative authority
- Correlate verified transfers, entitlements and data classifications
Explanation
Correct Answer
D:Suspicion alone does not establish loss. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Evidence handling must support later review. That action primarily serves the different objective to preserve relevant records without altering them. It is not the step that directly satisfies the stated need to determine actual scope of information exposure.
B:Containment should avoid unnecessary rights violations. That action primarily serves the different objective to contain potential continued misuse. It is not the step that directly satisfies the stated need to determine actual scope of information exposure.
C:Insider investigations require privacy safeguards. That action primarily serves the different objective to ensure investigation is authorized and proportionate. It is not the step that directly satisfies the stated need to determine actual scope of information exposure.
Question 387
A cloud service owner's API keys appear in a public software repository. The security program has been tasked specifically to determine whether customer data was accessed. Which approach should be selected?
- Analyze data-plane evidence and affected account permissions
- Validate affected secrets and assess access logs through approved incident procedures
- Rotate or revoke exposed secrets and invalidate affected sessions where supported
- Review cloud audit and resource change events linked to the keys
Explanation
Correct Answer
A:Key exposure alone is not proof of data access. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Scope determines urgency. That action primarily serves the different objective to establish whether keys remain active and exposed. It is not the step that directly satisfies the stated need to determine whether customer data was accessed.
C:Revocation limits exploitation. That action primarily serves the different objective to prevent further use of compromised keys. It is not the step that directly satisfies the stated need to determine whether customer data was accessed.
D:Credential exposure can cause downstream changes. That action primarily serves the different objective to inspect activity performed with the credentials. It is not the step that directly satisfies the stated need to determine whether customer data was accessed.
Question 388
An organization discovers a malicious update was distributed through a trusted software supplier. A security manager has a defined assignment: restore trust in the update process. Which action BEST fulfills that specific assignment?
- Capture signed packages, hashes, update logs and supplier notices
- Map installed versions, deployment history and critical workloads
- Validate known-good packages and strengthened supplier verification gates
- Pause affected deployments and restrict known malicious components with change approval
Explanation
Correct Answer
C:Recovery should address the delivery trust boundary. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Supply-chain findings require provenance. That action primarily serves the different objective to preserve evidence of the malicious release. It is not the step that directly satisfies the stated need to restore trust in the update process.
B:Supply-chain impact follows actual deployment. That action primarily serves the different objective to identify potentially affected systems. It is not the step that directly satisfies the stated need to restore trust in the update process.
D:Containment limits spread. That action primarily serves the different objective to contain the compromised update pathway. It is not the step that directly satisfies the stated need to restore trust in the update process.
Question 389
An online bank experiences a distributed denial-of-service attack during its busiest payment period. The accountable executive now asks the team to measure attack impact and mitigation outcome. What should the security manager recommend?
- Engage approved traffic mitigation and provider capacity procedures
- Track legitimate transaction completion and service latency during containment
- Provide verified service status and escalation through the incident communications plan
- Use network telemetry, user behavior and service impact to classify the event
Explanation
Correct Answer
B:Dropped traffic counts do not measure business success. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:DDoS response should preserve legitimate access. That action primarily serves the different objective to activate a proportionate availability response. It is not the step that directly satisfies the stated need to measure attack impact and mitigation outcome.
C:Customers need reliable information. That action primarily serves the different objective to coordinate with customer-facing teams. It is not the step that directly satisfies the stated need to measure attack impact and mitigation outcome.
D:Volume alone does not prove attack. That action primarily serves the different objective to establish whether traffic is malicious or a demand spike. It is not the step that directly satisfies the stated need to measure attack impact and mitigation outcome.
Question 390
A hospital detects unauthorized changes to medication inventory records but systems remain online. Investigators have identified the suspect transactions and preserved the supporting audit records. Corrections are now authorized but have not been applied or validated by clinical owners. After reviewing the situation, the management objective is to restore trusted data carefully. Which response MOST directly addresses it?
- Reconcile approved source data and verify corrections with clinical owners
- Coordinate clinical assessment of affected medication decisions
- Restrict suspect identities and privileged change paths under incident authority
- Reconcile affected transactions with trusted audit and source records
Explanation
Correct Answer
A:Rollback without validation may propagate errors. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Business impact can extend beyond IT. That action primarily serves the different objective to determine whether patient safety is threatened. It is not the step that directly satisfies the stated need to restore trusted data carefully.
C:Targeted containment protects records. That action primarily serves the different objective to contain continued unauthorized modification. It is not the step that directly satisfies the stated need to restore trusted data carefully.
D:Integrity failure can persist without downtime. That action primarily serves the different objective to confirm which records may be untrustworthy. It is not the step that directly satisfies the stated need to restore trusted data carefully.
