Isaca CISM Practice Test 46
Question 450
A sales organization suffered credential theft after repeated social engineering calls to its help desk. For the next governance decision, the team must respond when attackers switch to collaboration chat. Which choice BEST provides that outcome?
- Update training and procedural controls for the new contact channel
- Test sampled reset requests and track unauthorized exceptions
- Train on verification procedures and supervised escalation drills
- Implement dual approval and recorded verification for sensitive recovery requests
Explanation
Correct Answer
A:Threat changes should alter practice. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Proof of behavior matters more than course attendance. That action primarily serves the different objective to measure effectiveness after training changes. It is not the step that directly satisfies the stated need to respond when attackers switch to collaboration chat.
C:Scenario practice improves response. That action primarily serves the different objective to teach staff how to challenge urgent callers safely. It is not the step that directly satisfies the stated need to respond when attackers switch to collaboration chat.
D:Preventive workflow limits social engineering. That action primarily serves the different objective to prevent overrides of high-risk identity resets. It is not the step that directly satisfies the stated need to respond when attackers switch to collaboration chat.
Question 451
An insurance firm finds archived customer records without usable ownership or retention tags. The security program has been tasked specifically to verify disposition without exposing sensitive data. Which approach should be selected?
- Review deletion logs, hold exceptions and sampled archive records
- Apply a documented sensitivity and retention taxonomy
- Enforce retention and authorized deletion using recorded approvals
- Have business owners approve disposition and access decisions
Explanation
Correct Answer
A:Evidence must support claimed retention compliance. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Different records require different handling. That action primarily serves the different objective to classify records based on business and privacy impact. It is not the step that directly satisfies the stated need to verify disposition without exposing sensitive data.
C:Lifecycle obligations need operating controls. That action primarily serves the different objective to implement lifecycle controls consistently. It is not the step that directly satisfies the stated need to verify disposition without exposing sensitive data.
D:IT custody does not establish data ownership. That action primarily serves the different objective to assign accountable data stewards. It is not the step that directly satisfies the stated need to verify disposition without exposing sensitive data.
Question 452
An analytics platform gives administrators permanent privileged access to production datasets. A security manager has a defined assignment: respond to an administrator changing departments. Which action BEST fulfills that specific assignment?
- Collect actionable privileged activity logs with independent monitoring
- Review sampled grants and test expiry against the approved role model
- Define break-glass authorization and independent post-use review
- Reconcile entitlements with the new role and promptly revoke unneeded privileges
Explanation
Correct Answer
D:Access must follow job responsibility. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Visibility is needed to identify abuse. That action primarily serves the different objective to detect misuse of privileged sessions. It is not the step that directly satisfies the stated need to respond to an administrator changing departments.
B:Documentation cannot replace enforcement. That action primarily serves the different objective to validate that access is appropriately restricted. It is not the step that directly satisfies the stated need to respond to an administrator changing departments.
C:Availability exceptions need accountability. That action primarily serves the different objective to ensure emergency data access remains possible. It is not the step that directly satisfies the stated need to respond to an administrator changing departments.
Question 453
A health insurer deploys a machine learning claims service and needs security controls integrated before release. The accountable executive now asks the team to monitor post-deployment model risk. What should the security manager recommend?
- Review drift, sensitive-output reports and supplier changes with risk owners
- Embed data minimization, access control and testing criteria into design acceptance
- Exercise unauthorized inference access and inspect audit events
- Use controlled model promotion with accountable approval and version history
Explanation
Correct Answer
A:Operational conditions may change after approval. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Security design should precede release. That action primarily serves the different objective to choose secure development requirements. It is not the step that directly satisfies the stated need to monitor post-deployment model risk.
C:Positive test evidence validates enforcement. That action primarily serves the different objective to test whether security controls work. It is not the step that directly satisfies the stated need to monitor post-deployment model risk.
D:Model updates can alter risk unexpectedly. That action primarily serves the different objective to prevent unreviewed model changes. It is not the step that directly satisfies the stated need to monitor post-deployment model risk.
Question 454
A nonprofit runs yearly penetration testing but does not repair repeated high-severity findings. After reviewing the situation, the management objective is to improve testing scope for new platforms. Which response MOST directly addresses it?
- Create accountable remediation tasks with agreed severity targets
- Retest affected attack paths and retain validation evidence
- Escalate repeat findings and root causes to the responsible executives
- Update threat scenarios to include newly deployed services and data flows
Explanation
Correct Answer
D:Test plans must reflect real architecture. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Unowned reports cannot fix risk. That action primarily serves the different objective to assign clear owners and deadlines. It is not the step that directly satisfies the stated need to improve testing scope for new platforms.
B:A closed ticket is not a verified fix. That action primarily serves the different objective to verify corrections rather than trust ticket closure. It is not the step that directly satisfies the stated need to improve testing scope for new platforms.
C:Persistent patterns may need structural investment. That action primarily serves the different objective to report recurring control failure to governance. It is not the step that directly satisfies the stated need to improve testing scope for new platforms.
Question 455
A multinational's data loss prevention program blocks harmless collaboration but misses confidential file exports. For the next governance decision, the team must respond when employees use a new file-transfer service. Which choice BEST provides that outcome?
- Run monitored policy simulations and tune false positives before blocking
- Measure confirmed leakage events and bypass paths by channel
- Map sensitivity labels and risky destinations to enforceable DLP conditions
- Reassess data egress coverage and extend approved monitoring and controls
Explanation
Correct Answer
D:New channels can evade old rules. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Testing reduces user disruption. That action primarily serves the different objective to pilot enforcement without disrupting work. It is not the step that directly satisfies the stated need to respond when employees use a new file-transfer service.
B:Alert count alone is not protection. That action primarily serves the different objective to evaluate actual DLP control coverage. It is not the step that directly satisfies the stated need to respond when employees use a new file-transfer service.
C:Risk-based rules improve targeting. That action primarily serves the different objective to select policy rules for meaningful leakage channels. It is not the step that directly satisfies the stated need to respond when employees use a new file-transfer service.
Question 456
A large university is moving endpoints to a centralized security management platform. The security program has been tasked specifically to handle endpoints that cannot support a mandatory setting. Which approach should be selected?
- Approve supported protection, hardening and telemetry settings by device class
- Pilot in representative departments and use staged deployment controls
- Measure policy compliance and tested detection across device groups
- Document exceptions with compensating controls and review dates
Explanation
Correct Answer
D:Exceptions need deliberate risk acceptance. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Baselines establish a standard. That action primarily serves the different objective to define a minimum endpoint security baseline. It is not the step that directly satisfies the stated need to handle endpoints that cannot support a mandatory setting.
B:Research workloads may have compatibility needs. That action primarily serves the different objective to deploy safely across research departments. It is not the step that directly satisfies the stated need to handle endpoints that cannot support a mandatory setting.
C:An enrolled device is not necessarily protected. That action primarily serves the different objective to validate endpoint protection consistently. It is not the step that directly satisfies the stated need to handle endpoints that cannot support a mandatory setting.
Question 457
An enterprise uses multiple public clouds and wants consistent access controls without forcing identical implementations. A security manager has a defined assignment: detect control drift after provider changes. Which action BEST fulfills that specific assignment?
- Monitor baseline deviations and assess service feature releases
- Document customer-managed and provider-managed controls per service
- Review privilege paths and logging evidence for each implementation
- Translate the common outcomes into approved configurations in each cloud
Explanation
Correct Answer
A:Cloud control behavior changes over time. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Cloud responsibility varies by service model. That action primarily serves the different objective to map each provider's responsibility boundaries. It is not the step that directly satisfies the stated need to detect control drift after provider changes.
C:Similar policy names may yield different rights. That action primarily serves the different objective to test effective access across clouds. It is not the step that directly satisfies the stated need to detect control drift after provider changes.
D:Uniform intent may need different technical controls. That action primarily serves the different objective to implement platform-native baselines. It is not the step that directly satisfies the stated need to detect control drift after provider changes.
Question 458
A transport company manages thousands of certificates for vehicle APIs and fears accidental expiry. The accountable executive now asks the team to monitor for impending expiration and unusual use. What should the security manager recommend?
- Use overlapping trust and staged replacement with partner validation
- Assign automated rotation ownership and emergency recovery procedures
- Alert on certificate age, failed handshakes and unexpected key use
- Exercise renewal and rollback on representative service paths
Explanation
Correct Answer
C:Early warning supports prevention. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Cutover can fail if clients are not prepared. That action primarily serves the different objective to implement safe rotation without service interruption. It is not the step that directly satisfies the stated need to monitor for impending expiration and unusual use.
B:Renewal needs operational accountability. That action primarily serves the different objective to define certificate renewal responsibilities. It is not the step that directly satisfies the stated need to monitor for impending expiration and unusual use.
D:A runbook alone may contain errors. That action primarily serves the different objective to test rotation before a major deadline. It is not the step that directly satisfies the stated need to monitor for impending expiration and unusual use.
Question 459
A national retailer plans secure coding practices for a rapidly growing delivery application. After reviewing the situation, the management objective is to measure whether security engineering is improving. Which response MOST directly addresses it?
- Pause release or obtain authorized risk treatment based on business impact
- Track confirmed recurring weaknesses and time to remediate by team
- Use source/dependency analysis and targeted dynamic testing in the pipeline
- Embed product security responsibilities in development and release governance
Explanation
Correct Answer
B:Outcomes reveal process maturity. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Deadlines do not eliminate product risk. That action primarily serves the different objective to handle a critical flaw found before launch. It is not the step that directly satisfies the stated need to measure whether security engineering is improving.
C:Different tests find different weaknesses. That action primarily serves the different objective to automate a suitable mix of tests. It is not the step that directly satisfies the stated need to measure whether security engineering is improving.
D:Ownership prevents late-stage gaps. That action primarily serves the different objective to assign owners of application security requirements. It is not the step that directly satisfies the stated need to measure whether security engineering is improving.
Question 460
A hospital tracks security controls by purchase date and vendor name but cannot prove effectiveness. For the next governance decision, the team must verify correction of an identified weakness. Which choice BEST provides that outcome?
- Link failed tests to residual impact, remediation dates and accountable owners
- Retest the failed condition and record independent closure evidence
- Test whether controls function repeatedly in the production context
- Use configuration inspection, operation sampling and controlled security tests
Explanation
Correct Answer
B:Implementation claims are not sufficient. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Management needs impact and ownership. That action primarily serves the different objective to report ineffective controls to risk owners. It is not the step that directly satisfies the stated need to verify correction of an identified weakness.
C:A good design may be badly operated. That action primarily serves the different objective to distinguish operating from design effectiveness. It is not the step that directly satisfies the stated need to verify correction of an identified weakness.
D:Multiple evidence types improve assurance. That action primarily serves the different objective to select independent validation methods. It is not the step that directly satisfies the stated need to verify correction of an identified weakness.
