Isaca CISM Practice Test 47
Question 460
A hospital tracks security controls by purchase date and vendor name but cannot prove effectiveness. For the next governance decision, the team must verify correction of an identified weakness. Which choice BEST provides that outcome?
- Link failed tests to residual impact, remediation dates and accountable owners
- Retest the failed condition and record independent closure evidence
- Test whether controls function repeatedly in the production context
- Use configuration inspection, operation sampling and controlled security tests
Explanation
Correct Answer
B:Implementation claims are not sufficient. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Management needs impact and ownership. That action primarily serves the different objective to report ineffective controls to risk owners. It is not the step that directly satisfies the stated need to verify correction of an identified weakness.
C:A good design may be badly operated. That action primarily serves the different objective to distinguish operating from design effectiveness. It is not the step that directly satisfies the stated need to verify correction of an identified weakness.
D:Multiple evidence types improve assurance. That action primarily serves the different objective to select independent validation methods. It is not the step that directly satisfies the stated need to verify correction of an identified weakness.
Question 461
A security operations department reports thousands of alerts to senior leadership with no risk prioritization. The security program has been tasked specifically to refine the reporting program from feedback. Which approach should be selected?
- Reconcile incident and asset records and explain uncertainty
- Evaluate whether reports led to timely treatment and improve measures
- Connect confirmed incidents and control failures to impacted services
- Show options, residual exposure, owner and deadline for material gaps
Explanation
Correct Answer
B:A report is useful when it changes decisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Poor data quality undermines confidence. That action primarily serves the different objective to verify reported information is reliable. It is not the step that directly satisfies the stated need to refine the reporting program from feedback.
C:Alert volume alone is ambiguous. That action primarily serves the different objective to translate operational data into meaningful risk measures. It is not the step that directly satisfies the stated need to refine the reporting program from feedback.
D:Executives need clear decisions. That action primarily serves the different objective to present actionable escalation choices. It is not the step that directly satisfies the stated need to refine the reporting program from feedback.
Question 462
A critical infrastructure company has no agreed metrics for its identity control modernization program. A security manager has a defined assignment: revise the measure after identity architecture changes. Which action BEST fulfills that specific assignment?
- Escalate material access gaps and accountable remediation owners
- Inventory accounts, existing controls and known exceptions before reporting progress
- Report both enrollment rates and test evidence of controlled access
- Reassess what access pathways must be included in the metric
Explanation
Correct Answer
D:Changed architecture can invalidate the denominator. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Management needs actionable exceptions. That action primarily serves the different objective to inform executives of unfavorable trends. It is not the step that directly satisfies the stated need to revise the measure after identity architecture changes.
B:A baseline enables comparison. That action primarily serves the different objective to create a reliable measurement baseline. It is not the step that directly satisfies the stated need to revise the measure after identity architecture changes.
C:Enrollment does not prove prevention. That action primarily serves the different objective to distinguish delivery outputs from effectiveness. It is not the step that directly satisfies the stated need to revise the measure after identity architecture changes.
Question 463
A bank is implementing a zero-trust access program for remote contractors. The accountable executive now asks the team to revoke access after contract completion. What should the security manager recommend?
- Automate entitlement removal using contract lifecycle triggers
- Require verified identity, device assurance and per-application authorization
- Test legitimate workflows and prohibited lateral paths before scaling
- Review contractor expiry, access logs and policy exceptions
Explanation
Correct Answer
A:Lifecycle integration prevents lingering accounts. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Broad network access is unnecessary. That action primarily serves the different objective to choose least-privilege access design. It is not the step that directly satisfies the stated need to revoke access after contract completion.
C:Usability and enforcement both matter. That action primarily serves the different objective to pilot the access controls with representative users. It is not the step that directly satisfies the stated need to revoke access after contract completion.
D:Trust decisions need periodic reassessment. That action primarily serves the different objective to verify continuous access governance. It is not the step that directly satisfies the stated need to revoke access after contract completion.
Question 464
A global retailer is launching a security communications program during a company reorganization. After reviewing the situation, the management objective is to update communication after staff feedback. Which response MOST directly addresses it?
- Assign approved spokespersons, update cadence and escalation routes
- Publish role-specific instructions in relevant languages and channels
- Test whether workers correctly act on critical security notices
- Revise unclear instructions and retest with affected audiences
Explanation
Correct Answer
D:Feedback should change the program. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Conflicting messages undermine response. That action primarily serves the different objective to establish trusted communication ownership. It is not the step that directly satisfies the stated need to update communication after staff feedback.
B:Comprehension is needed for adoption. That action primarily serves the different objective to translate enterprise policy into usable guidance. It is not the step that directly satisfies the stated need to update communication after staff feedback.
C:Message delivery does not prove understanding. That action primarily serves the different objective to evaluate communications effectiveness. It is not the step that directly satisfies the stated need to update communication after staff feedback.
Question 465
A government cloud migration introduces new identity and data trust boundaries not covered by the security architecture. For the next governance decision, the team must adjust the reference for ongoing modernization. Which choice BEST provides that outcome?
- Use incident and assessment findings to improve architecture standards
- Require documented design risk acceptance before authorizing exceptions
- Define identity isolation, logging and encryption reference designs for the new platform
- Check actual trust paths and privileged access against the approved reference
Explanation
Correct Answer
A:Architecture must evolve with experience. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Bypasses must remain governed. That action primarily serves the different objective to review proposed deviations to the pattern. It is not the step that directly satisfies the stated need to adjust the reference for ongoing modernization.
C:Patterns support consistent decisions. That action primarily serves the different objective to select a reusable secure architecture pattern. It is not the step that directly satisfies the stated need to adjust the reference for ongoing modernization.
D:A diagram alone is insufficient. That action primarily serves the different objective to test conformance after deployment. It is not the step that directly satisfies the stated need to adjust the reference for ongoing modernization.
Question 466
A large university has deployed centralized logging but discovers critical research servers do not forward events. The security program has been tasked specifically to respond when data-retention laws change. Which approach should be selected?
- Monitor telemetry heartbeat and expected event volumes by asset
- Standardize authenticated forwarding, time synchronization and protected retention
- Review logging retention and access restrictions with legal and privacy owners
- Run controlled scenarios using actual retained logs and timelines
Explanation
Correct Answer
C:Monitoring data also has governance duties. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Silent gaps undermine detection. That action primarily serves the different objective to detect collection gaps early. It is not the step that directly satisfies the stated need to respond when data-retention laws change.
B:Logs must be accurate and available. That action primarily serves the different objective to implement dependable log collection. It is not the step that directly satisfies the stated need to respond when data-retention laws change.
D:Collection alone does not prove usability. That action primarily serves the different objective to test investigators' ability to reconstruct incidents. It is not the step that directly satisfies the stated need to respond when data-retention laws change.
Question 467
A financial firm moves email threat filtering to a managed security service. A security manager has a defined assignment: reassess after the provider changes its analysis subcontractor. Which action BEST fulfills that specific assignment?
- Define escalation paths, evidence formats and accountability handoffs
- Review fourth-party access, assurance and contract obligations
- Review capability tests, assurance and resilience against the firm's requirements
- Track missed detections, actionable alert timing and response quality
Explanation
Correct Answer
B:Provider changes can change the firm's risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Alerts without ownership can be lost. That action primarily serves the different objective to integrate provider alerts into internal decisions. It is not the step that directly satisfies the stated need to reassess after the provider changes its analysis subcontractor.
C:Price is not sufficient evidence. That action primarily serves the different objective to evaluate the provider before selection. It is not the step that directly satisfies the stated need to reassess after the provider changes its analysis subcontractor.
D:Service-level compliance should reflect outcomes. That action primarily serves the different objective to measure service performance after go-live. It is not the step that directly satisfies the stated need to reassess after the provider changes its analysis subcontractor.
Question 468
A retail firm has standard operating procedures for patching, but teams say the policy gives no decision thresholds. The accountable executive now asks the team to revise rules when actively exploited vulnerabilities surge. What should the security manager recommend?
- Sample patch records and validate deployed versions on critical systems
- Record business approval, compensating controls and expiry dates
- Specify testing, change windows, rollback and escalation steps
- Introduce emergency escalation criteria based on exposure and impact
Explanation
Correct Answer
D:Risk changes justify policy review. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A checklist is not technical evidence. That action primarily serves the different objective to test whether procedures are followed. It is not the step that directly satisfies the stated need to revise rules when actively exploited vulnerabilities surge.
B:A waiver must be governed. That action primarily serves the different objective to manage exemptions for unsupported applications. It is not the step that directly satisfies the stated need to revise rules when actively exploited vulnerabilities surge.
C:Procedures implement policy. That action primarily serves the different objective to write executable patch procedures for each platform. It is not the step that directly satisfies the stated need to revise rules when actively exploited vulnerabilities surge.
Question 469
A cloud software startup reports high test coverage but repeated access-control vulnerabilities reach production. After reviewing the situation, the management objective is to monitor post-release recurrence. Which response MOST directly addresses it?
- Tie confirmed findings to product owners and release deadlines
- Retest the previously exploitable authorization paths in a staging environment
- Track similar auth defects and unauthorized-access signals by service
- Add abuse-path and privilege-boundary tests to the release pipeline
Explanation
Correct Answer
C:Repeated patterns reveal a systematic weakness. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Findings need accountable action. That action primarily serves the different objective to assign responsibility for remediation. It is not the step that directly satisfies the stated need to monitor post-release recurrence.
B:A reviewed patch may still fail. That action primarily serves the different objective to verify fixes without trusting code review alone. It is not the step that directly satisfies the stated need to monitor post-release recurrence.
D:Security tests must exercise expected denial. That action primarily serves the different objective to update the test strategy. It is not the step that directly satisfies the stated need to monitor post-release recurrence.
Question 470
An e-commerce company's board wants proof its security investment is reducing account takeover risk. For the next governance decision, the team must adapt the metric after new login methods are introduced. Which choice BEST provides that outcome?
- Present residual risk, control gaps and planned investments in business terms
- Update event definitions and data collection to include new authentication paths
- Reconcile fraud reports, detection changes and help desk outcomes
- Normalize events against active users and transaction volume
Explanation
Correct Answer
B:Metrics need stable meaning across architecture changes. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:The board governs exposure not tooling details. That action primarily serves the different objective to report remaining exposure to the board. It is not the step that directly satisfies the stated need to adapt the metric after new login methods are introduced.
C:Changes in measurement can mimic improvement. That action primarily serves the different objective to validate that declines are not reporting artifacts. It is not the step that directly satisfies the stated need to adapt the metric after new login methods are introduced.
D:Raw counts may mislead when business grows. That action primarily serves the different objective to account for growth in customer accounts. It is not the step that directly satisfies the stated need to adapt the metric after new login methods are introduced.
