Isaca CISM Practice Test 4
Question 30
A franchise organization lets branch managers accept local cyber risks without written limits. The security program has been tasked specifically to establish delegated risk authority. Which approach should be selected?
- Review residual risk periodically and when circumstances change
- Define acceptance limits and escalation rules approved by enterprise governance
- Maintain risk decisions with reason, expiry and compensating controls
- Escalate it to the enterprise risk committee before relying on the exception
Explanation
Correct Answer
B:Delegation needs boundaries. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Acceptance is not a one-off event. That action primarily serves the different objective to check that accepted risks stay acceptable. It is not the step that directly satisfies the stated need to establish delegated risk authority.
C:An audit trail supports timely challenge. That action primarily serves the different objective to prevent undocumented permanent exceptions. It is not the step that directly satisfies the stated need to establish delegated risk authority.
D:Unauthorized decisions do not establish formal acceptance. That action primarily serves the different objective to address a branch accepting risk above its limit. It is not the step that directly satisfies the stated need to establish delegated risk authority.
Question 31
A healthcare supplier introduces an AI summarization service handling sensitive medical notes. A security manager has a defined assignment: discover threats specific to this new dependency. Which action BEST fulfills that specific assignment?
- Require safeguards for authorized access, data minimization and monitoring before rollout
- Assign a business service owner and specialist control owners
- Model data leakage, prompt abuse, vendor handling and incorrect-output scenarios
- Track high-risk outputs, access exceptions and provider changes against thresholds
Explanation
Correct Answer
C:AI service risks differ from conventional infrastructure. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Controls should reflect sensitive clinical data. That action primarily serves the different objective to choose a treatment appropriate to risk tolerance. It is not the step that directly satisfies the stated need to discover threats specific to this new dependency.
B:Vendor technology cannot replace internal risk ownership. That action primarily serves the different objective to ensure accountability for model risk. It is not the step that directly satisfies the stated need to discover threats specific to this new dependency.
D:New-model risks need continuing assurance. That action primarily serves the different objective to monitor whether safeguards remain effective. It is not the step that directly satisfies the stated need to discover threats specific to this new dependency.
Question 32
An e-commerce firm estimates its cyber risk using a single average annual loss number despite highly variable holiday traffic. The existing loss model covers routine traffic only and has not modeled the extreme scenarios that can arise during peak holiday demand. The accountable executive now asks the team to represent severe but infrequent exposure. What should the security manager recommend?
- Compare extreme-loss scenarios with tolerance and response costs
- Model plausible peak-season loss scenarios and sensitivity to demand
- Include trust, contractual commitments and recovery time in the risk report
- Use actual incident, fraud and downtime evidence to revise assumptions
Explanation
Correct Answer
B:The mean can hide tail impacts. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Peak conditions may drive treatment. That action primarily serves the different objective to select risk treatment against seasonal appetite. It is not the step that directly satisfies the stated need to represent severe but infrequent exposure.
C:Business impact is broader than invoices. That action primarily serves the different objective to present financial and nonfinancial consequences. It is not the step that directly satisfies the stated need to represent severe but infrequent exposure.
D:Operational experience updates the model. That action primarily serves the different objective to recalibrate risk after a peak shopping season. It is not the step that directly satisfies the stated need to represent severe but infrequent exposure.
Question 33
A utilities operator has many risk exceptions but no way to know which are approaching expiration. After reviewing the situation, the management objective is to maintain a usable exception inventory. Which response MOST directly addresses it?
- Notify the risk owner and invoke the defined tolerance escalation process
- Measure overdue reviews and exceptions without verified safeguards
- Require new risk evidence and authorized acceptance before each renewal
- Track owners, approval dates, expiry, compensating controls and affected systems
Explanation
Correct Answer
D:Structured records support governance. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A failed compensating control changes residual risk. That action primarily serves the different objective to escalate an exception whose safeguard stopped operating. It is not the step that directly satisfies the stated need to maintain a usable exception inventory.
B:Process quality can be measured. That action primarily serves the different objective to evaluate exception-management effectiveness. It is not the step that directly satisfies the stated need to maintain a usable exception inventory.
C:Old approval does not justify indefinite exposure. That action primarily serves the different objective to prevent automatic rollovers. It is not the step that directly satisfies the stated need to maintain a usable exception inventory.
Question 34
A transportation platform has a partner integration whose legacy protocol cannot support the new encryption standard. For the next governance decision, the team must identify the risk introduced by the legacy channel. Which choice BEST provides that outcome?
- Agree on a protocol migration plan with partner milestones and contractual duties
- Obtain documented acceptance from the owner of the transport business process
- Assess interception exposure, data classification and external access paths
- Reassess severity against tolerance and authorize continuity or disconnection
Explanation
Correct Answer
C:Treatment depends on information sensitivity. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Partner dependencies require joint remediation. That action primarily serves the different objective to create a sustainable treatment path. It is not the step that directly satisfies the stated need to identify the risk introduced by the legacy channel.
B:The business owns consequences of residual risk. That action primarily serves the different objective to determine who may retain the exposure temporarily. It is not the step that directly satisfies the stated need to identify the risk introduced by the legacy channel.
D:New threat information can invalidate prior acceptance. That action primarily serves the different objective to decide whether to suspend the integration after a new exploit appears. It is not the step that directly satisfies the stated need to identify the risk introduced by the legacy channel.
Question 35
A software company discovers that privileged users can bypass the approval workflow in its production pipeline. The security program has been tasked specifically to assess how the bypass affects business assets. Which approach should be selected?
- Implement enforceable separation of approval and production deployment duties
- Test the pathway from privileged actions to unauthorized releases and sensitive code
- Perform a controlled retest of blocked self-approved releases and monitor exceptions
- Name the release process owner and privileged access control owner
Explanation
Correct Answer
B:A control gap matters through its consequences. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Preventive controls eliminate unauthorized self-approval. That action primarily serves the different objective to choose an enduring control improvement. It is not the step that directly satisfies the stated need to assess how the bypass affects business assets.
C:Policy text without effective enforcement is insufficient. That action primarily serves the different objective to validate that the exploit path is closed. It is not the step that directly satisfies the stated need to assess how the bypass affects business assets.
D:Cross-functional weaknesses need explicit accountability. That action primarily serves the different objective to assign responsibility for remediation. It is not the step that directly satisfies the stated need to assess how the bypass affects business assets.
Question 36
A municipality finds network-connected water equipment installed by a maintenance contractor without a security review. A security manager has a defined assignment: identify exposed operational technology assets. Which action BEST fulfills that specific assignment?
- Inventory contractor-installed devices and map connectivity into control networks
- Track new device connections and remote sessions against an approved baseline
- Restrict unneeded remote access while coordinating with plant operations
- Update maintenance contracts with authorized access and reporting requirements
Explanation
Correct Answer
A:Unknown devices create unassessed exposure. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Monitoring detects drift after remediation. That action primarily serves the different objective to establish ongoing risk monitoring. It is not the step that directly satisfies the stated need to identify exposed operational technology assets.
C:Protection must not interrupt vital processes. That action primarily serves the different objective to choose an immediately safe exposure reduction. It is not the step that directly satisfies the stated need to identify exposed operational technology assets.
D:Contractor access needs enforceable limits. That action primarily serves the different objective to assign vendor responsibilities. It is not the step that directly satisfies the stated need to identify exposed operational technology assets.
Question 37
A cloud company has accepted several high risks, and new regulations impose tighter customer data handling duties. The accountable executive now asks the team to identify which risk assumptions have changed. What should the security manager recommend?
- Fund controls and deadlines that address the identified compliance gap
- Compare accepted exposures with the new statutory duties and enforcement dates
- Collect independent operating evidence before closing regulatory risk items
- Present legal consequences, affected services and accountable risk owners
Explanation
Correct Answer
B:A regulatory shift changes acceptable risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Obligations need concrete remediation. That action primarily serves the different objective to propose treatment for obligations not currently satisfied. It is not the step that directly satisfies the stated need to identify which risk assumptions have changed.
C:A planned control is not an implemented control. That action primarily serves the different objective to confirm treatment obligations are fulfilled. It is not the step that directly satisfies the stated need to identify which risk assumptions have changed.
D:Executive decisions require explicit impact. That action primarily serves the different objective to communicate required decisions to leaders. It is not the step that directly satisfies the stated need to identify which risk assumptions have changed.
Question 38
A manufacturer is adopting a cloud-hosted production forecasting engine that shares sensitive recipes with a technology supplier. After reviewing the situation, the management objective is to identify material threats from sharing recipes. Which response MOST directly addresses it?
- Have the product business owner decide with legal and security advice
- Require segregation, minimal data transfer and verified provider controls before rollout
- Reassess stored data, new subprocessors and access paths after each material change
- Analyze supplier access, data handling and model-output leakage pathways
Explanation
Correct Answer
D:Critical intellectual property may be exposed outside the plant. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:The owner of recipe value accepts business risk. That action primarily serves the different objective to assign acceptance authority for remaining exposure. It is not the step that directly satisfies the stated need to identify material threats from sharing recipes.
B:Technical and contractual controls can lower risk. That action primarily serves the different objective to select additional treatment when residual risk exceeds appetite. It is not the step that directly satisfies the stated need to identify material threats from sharing recipes.
C:Service evolution can create new exposure. That action primarily serves the different objective to monitor risks after the supplier adds new AI features. It is not the step that directly satisfies the stated need to identify material threats from sharing recipes.
Question 39
A regional bank is implementing the security program approved by its new digital banking strategy. For the next governance decision, the team must estimate program resources before selecting vendors. Which choice BEST provides that outcome?
- Use a workforce plan that combines training, recruitment and qualified external support
- Name owners for controls, funding, integration and reporting
- Measure risk-reducing control performance against approved targets
- Build a skills and capacity assessment against prioritized security outcomes
Explanation
Correct Answer
D:Tool purchases cannot replace required people and operating capacity. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Capability gaps need sustainable solutions. That action primarily serves the different objective to resolve scarce specialist capacity. It is not the step that directly satisfies the stated need to estimate program resources before selecting vendors.
B:Clear responsibility supports execution. That action primarily serves the different objective to assign accountability for program delivery. It is not the step that directly satisfies the stated need to estimate program resources before selecting vendors.
C:Completed purchase orders do not demonstrate risk reduction. That action primarily serves the different objective to evaluate whether program investments deliver outcomes. It is not the step that directly satisfies the stated need to estimate program resources before selecting vendors.
Question 40
A hospital's data inventory excludes confidential imaging archives managed by a research partner. The security program has been tasked specifically to identify all information assets in the patient workflow. Which approach should be selected?
- Define contractually required safeguards derived from the classification
- Map data sets, locations, owners and external processing relationships
- Integrate discovery and owner review into the data lifecycle
- Reassess permitted use, retention and access with the asset owner
Explanation
Correct Answer
B:Incomplete inventories hide sensitive information. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Outside custody does not eliminate handling obligations. That action primarily serves the different objective to ensure the partner applies correct handling protections. It is not the step that directly satisfies the stated need to identify all information assets in the patient workflow.
C:Periodic discovery limits inventory drift. That action primarily serves the different objective to detect newly created unclassified datasets. It is not the step that directly satisfies the stated need to identify all information assets in the patient workflow.
D:Information sensitivity changes with purpose. That action primarily serves the different objective to verify classification remains correct after research scope changes. It is not the step that directly satisfies the stated need to identify all information assets in the patient workflow.
