Isaca CISM Practice Test 41
Question 400
A government data center has backups but no plan to reconstruct application dependencies after a major outage. After reviewing the situation, the management objective is to verify recoverability in a realistic environment. Which response MOST directly addresses it?
- Exercise full-service restoration and validate business transactions
- Use BIA findings to define RTO/RPO for affected services
- Document repeatable runbooks with named owners and prerequisites
- Map identities, databases, networks and application dependencies
Explanation
Correct Answer
A:Backup existence does not prove recoverability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Technical targets need business justification. That action primarily serves the different objective to set business-approved recovery targets. It is not the step that directly satisfies the stated need to verify recoverability in a realistic environment.
C:Recovery must be executable. That action primarily serves the different objective to prepare detailed technical restoration procedures. It is not the step that directly satisfies the stated need to verify recoverability in a realistic environment.
D:Recovery order affects service usability. That action primarily serves the different objective to establish the sequence needed for recovery. It is not the step that directly satisfies the stated need to verify recoverability in a realistic environment.
Question 401
A multinational retailer has acquired regional chains whose store leaders use different security approval practices. The security program has been tasked specifically to evaluate whether store practices are converging toward the target. Which approach should be selected?
- Review exception frequency and completion of control milestones by region
- Publish a responsibility matrix approved by regional executives and the enterprise risk committee
- Present a business case linking prioritized security changes to store uptime and loss exposure
- Translate the approved controls into local operating procedures and role-specific training
Explanation
Correct Answer
A:Regional evidence shows whether the governance rollout works. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Named owners prevent local exceptions from becoming ungoverned decisions. That action primarily serves the different objective to define accountable security decision-makers across the acquired chains. It is not the step that directly satisfies the stated need to evaluate whether store practices are converging toward the target.
C:A business-aligned case explains why controls matter to revenue operations. That action primarily serves the different objective to gain support for security integration without ignoring retail operations. It is not the step that directly satisfies the stated need to evaluate whether store practices are converging toward the target.
D:Operational procedures translate policy into repeatable behavior. That action primarily serves the different objective to make new security requirements usable by store employees. It is not the step that directly satisfies the stated need to evaluate whether store practices are converging toward the target.
Question 402
A healthcare provider is opening clinics in jurisdictions with differing privacy, retention and breach-notification duties. A security manager has a defined assignment: handle a proposed clinic expansion into a new jurisdiction. Which action BEST fulfills that specific assignment?
- Map each obligation to a control owner and retained compliance evidence
- Ask legal counsel to document controlling requirements and the permissible treatment for each data flow
- Trigger a privacy and security requirements review before patient records are collected
- Name compliance owners and a review cadence for each jurisdiction
Explanation
Correct Answer
C:Early assessment avoids retrofitting controls after processing begins. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Traceability demonstrates how requirements are fulfilled. That action primarily serves the different objective to make evidence available for regulator inquiries. It is not the step that directly satisfies the stated need to handle a proposed clinic expansion into a new jurisdiction.
B:Legal interpretation must precede a conflicting operating rule. That action primarily serves the different objective to resolve an apparent conflict between contract and local law. It is not the step that directly satisfies the stated need to handle a proposed clinic expansion into a new jurisdiction.
D:Without owners legal changes may never reach the control framework. That action primarily serves the different objective to assign responsibility for tracking changing patient-data rules. It is not the step that directly satisfies the stated need to handle a proposed clinic expansion into a new jurisdiction.
Question 403
A logistics company has separate security, IT operations and business risk committees that keep overruling one another. The accountable executive now asks the team to settle a disputed exception that exceeds delegated authority. What should the security manager recommend?
- Roll up exposures, tolerance breaches and accountable owners into decision-ready reporting
- Escalate the documented residual risk to the designated senior risk authority
- Assign the security committee oversight of risk while process owners implement controls
- Establish a single approved decision hierarchy and cross-committee referral path
Explanation
Correct Answer
B:A local project lead cannot approve exposures above the established delegation. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:The board needs risk decisions rather than raw alert counts. That action primarily serves the different objective to inform the board without sending every technical defect. It is not the step that directly satisfies the stated need to settle a disputed exception that exceeds delegated authority.
C:Independent oversight avoids self-approval of effectiveness. That action primarily serves the different objective to separate security oversight from operational execution. It is not the step that directly satisfies the stated need to settle a disputed exception that exceeds delegated authority.
D:A clear hierarchy resolves overlapping mandates. That action primarily serves the different objective to prevent conflicting policy decisions among committees. It is not the step that directly satisfies the stated need to settle a disputed exception that exceeds delegated authority.
Question 404
An insurer's board wants a cyber strategy for its transition from branch offices to online customer services. After reviewing the situation, the management objective is to refresh the strategy after major online platform changes. Which response MOST directly addresses it?
- Prioritize initiatives by risk reduction, dependencies and business delivery dates
- Reassess the security strategy against the revised business plan and threat landscape
- Present expected business benefits, risk exposure and alternative investment options
- Assign owners, milestones and financing for approved security initiatives
Explanation
Correct Answer
B:A change in business direction can invalidate old assumptions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A sequenced roadmap makes limited resources actionable. That action primarily serves the different objective to choose an ordered plan when funds cannot cover every initiative. It is not the step that directly satisfies the stated need to refresh the strategy after major online platform changes.
C:Executives approve defensible business tradeoffs, not an uncosted technology list. That action primarily serves the different objective to gain authorization for security strategy investments. It is not the step that directly satisfies the stated need to refresh the strategy after major online platform changes.
D:Accountability and resources turn a strategy into delivery. That action primarily serves the different objective to translate strategy into accountable organizational execution. It is not the step that directly satisfies the stated need to refresh the strategy after major online platform changes.
Question 405
A payments firm is adopting a common security framework across independently managed subsidiaries. For the next governance decision, the team must revisit the framework after a major acquisition. Which choice BEST provides that outcome?
- Require authorized business risk owners to approve documented deviations
- Publish an enterprise control taxonomy and agreed definitions for reporting
- Perform a gap assessment of the acquired control model before extending mandatory requirements
- Report target control outcomes and independently assessed coverage gaps
Explanation
Correct Answer
C:Integration needs evidence of compatibility and unresolved risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Exception decisions remain accountable to the risk-taking business. That action primarily serves the different objective to allocate decision rights for framework exceptions. It is not the step that directly satisfies the stated need to revisit the framework after a major acquisition.
B:Common terms make cross-subsidiary evidence comparable. That action primarily serves the different objective to establish consistency when subsidiaries use different terminology. It is not the step that directly satisfies the stated need to revisit the framework after a major acquisition.
D:Adoption is shown through results rather than the number of policies distributed. That action primarily serves the different objective to demonstrate framework adoption to directors. It is not the step that directly satisfies the stated need to revisit the framework after a major acquisition.
Question 406
A university has too little capital to execute all proposed security initiatives before the academic year. The security program has been tasked specifically to respond when an approved project's cost rises materially. Which approach should be selected?
- Bring a revised scope and investment justification to the appropriate sponsor
- Use capacity planning to identify needed skills and sequence hiring or outsourced support
- Attach approved owners, milestones and measurable results to each funded initiative
- Develop a business case with alternatives, cost, residual risk and expected benefits
Explanation
Correct Answer
A:Material budget changes need a renewed decision. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:People and capabilities are part of the program budget. That action primarily serves the different objective to address a projected staffing shortfall during implementation. It is not the step that directly satisfies the stated need to respond when an approved project's cost rises materially.
C:Accountable plans prevent untracked spending. That action primarily serves the different objective to avoid funding a program with no accountable outcomes. It is not the step that directly satisfies the stated need to respond when an approved project's cost rises materially.
D:Tradeoff evidence supports a prudent board decision. That action primarily serves the different objective to defend a proposed network security investment. It is not the step that directly satisfies the stated need to respond when an approved project's cost rises materially.
Question 407
An industrial manufacturer is moving from a command-driven security culture to a cross-functional safety culture. A security manager has a defined assignment: respond to a supervisor who informally waives a critical control. Which action BEST fulfills that specific assignment?
- Translate security policy into plant-specific instructions with visible leadership sponsorship
- Include plant operations and safety representatives in security governance decisions
- Enforce the documented exception and risk-acceptance escalation route
- Track unsafe exception trends and the closure of worker-reported security issues
Explanation
Correct Answer
C:A supervisor cannot silently bypass enterprise risk authority. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Local procedures need practical management backing. That action primarily serves the different objective to make requirements credible to shift supervisors. It is not the step that directly satisfies the stated need to respond to a supervisor who informally waives a critical control.
B:Ownership grows when controls reflect actual plant tasks. That action primarily serves the different objective to obtain worker participation in security design. It is not the step that directly satisfies the stated need to respond to a supervisor who informally waives a critical control.
D:Behavior and response evidence provide stronger signals than attendance counts. That action primarily serves the different objective to measure whether the culture change is taking hold. It is not the step that directly satisfies the stated need to respond to a supervisor who informally waives a critical control.
Question 408
A global e-commerce company outsources payment processing while remaining accountable for customer information. The accountable executive now asks the team to support customers requesting audit evidence. What should the security manager recommend?
- Invoke contract review and assess downstream data access before permitting the new subcontractor
- Review independent assurance evidence and unresolved findings against contracted controls
- Maintain a traceable record of processor assurance and organizational compensating controls
- Include measurable security, audit, incident notice and subcontractor provisions in the contract
Explanation
Correct Answer
C:Evidence must show which party operates each required safeguard. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Additional providers can change legal and cyber exposure. That action primarily serves the different objective to respond to processor use of an undisclosed fourth party. It is not the step that directly satisfies the stated need to support customers requesting audit evidence.
B:Continuous oversight is necessary after onboarding. That action primarily serves the different objective to verify performance after the processing contract begins. It is not the step that directly satisfies the stated need to support customers requesting audit evidence.
D:Contract rights support oversight and remediation. That action primarily serves the different objective to make the processor's control commitments enforceable. It is not the step that directly satisfies the stated need to support customers requesting audit evidence.
Question 409
An energy company has created a new CISO role, but line executives assume it owns every cyber risk. After reviewing the situation, the management objective is to judge whether responsibilities are actually understood. Which response MOST directly addresses it?
- Separate implementation responsibility from independent control assurance
- Test risk-owner decisions in real cases and report unresolved role conflicts
- Route the policy through defined executive governance and legal consultation
- Approve a governance charter linking the CISO, risk committee and board
Explanation
Correct Answer
B:An organization chart alone does not prove accountable practice. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A self-review may conceal failures. That action primarily serves the different objective to prevent controls from being judged only by their designers. It is not the step that directly satisfies the stated need to judge whether responsibilities are actually understood.
C:Enterprise policy needs authority beyond one technology department. That action primarily serves the different objective to approve a cross-functional policy with competing demands. It is not the step that directly satisfies the stated need to judge whether responsibilities are actually understood.
D:Governance must provide access to decision makers. That action primarily serves the different objective to give the CISO a formal escalation path. It is not the step that directly satisfies the stated need to judge whether responsibilities are actually understood.
Question 410
A bank wants to expand into embedded finance partnerships and expose customer APIs to third parties. For the next governance decision, the team must check strategic assumptions after partnership expansion. Which choice BEST provides that outcome?
- Compare risk and business impact of alternative API protection approaches
- Build an architecture-driven security roadmap with business launch gates
- Define service and data risk ownership with explicit partner handoffs
- Revisit risk appetite, contract obligations and capacity forecasts for the enlarged ecosystem
Explanation
Correct Answer
D:Growth may outstrip previously accepted exposure. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Decision makers need options framed in business consequences. That action primarily serves the different objective to present options for security investment to the board. It is not the step that directly satisfies the stated need to check strategic assumptions after partnership expansion.
B:Dependencies avoid releasing an ungoverned interface. That action primarily serves the different objective to prioritize controls that are dependencies for partner launch. It is not the step that directly satisfies the stated need to check strategic assumptions after partnership expansion.
C:Interfaces between organizations create ownership gaps. That action primarily serves the different objective to assign accountability across bank and partners. It is not the step that directly satisfies the stated need to check strategic assumptions after partnership expansion.
