Isaca CISM Practice Test 48
Question 470
An e-commerce company's board wants proof its security investment is reducing account takeover risk. For the next governance decision, the team must adapt the metric after new login methods are introduced. Which choice BEST provides that outcome?
- Present residual risk, control gaps and planned investments in business terms
- Update event definitions and data collection to include new authentication paths
- Reconcile fraud reports, detection changes and help desk outcomes
- Normalize events against active users and transaction volume
Explanation
Correct Answer
B:Metrics need stable meaning across architecture changes. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:The board governs exposure not tooling details. That action primarily serves the different objective to report remaining exposure to the board. It is not the step that directly satisfies the stated need to adapt the metric after new login methods are introduced.
C:Changes in measurement can mimic improvement. That action primarily serves the different objective to validate that declines are not reporting artifacts. It is not the step that directly satisfies the stated need to adapt the metric after new login methods are introduced.
D:Raw counts may mislead when business grows. That action primarily serves the different objective to account for growth in customer accounts. It is not the step that directly satisfies the stated need to adapt the metric after new login methods are introduced.
Question 471
An insurer is adopting confidential computing for sensitive actuarial models. The security program has been tasked specifically to monitor whether the architecture stays effective. Which approach should be selected?
- Review contractual exit, patching and emergency support arrangements
- Verify attestation decisions and rejected untrusted workloads in a controlled environment
- Define attestation, key release, identity and monitoring requirements for the design
- Track attestation failures, platform updates and exception decisions
Explanation
Correct Answer
D:Protection can degrade with configuration drift. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:New technology can introduce concentration risk. That action primarily serves the different objective to manage dependencies on a specialized platform vendor. It is not the step that directly satisfies the stated need to monitor whether the architecture stays effective.
B:Vendor claims do not replace evidence. That action primarily serves the different objective to test that protected execution works as intended. It is not the step that directly satisfies the stated need to monitor whether the architecture stays effective.
C:Confidential computation still requires governance. That action primarily serves the different objective to integrate security architecture with operating controls. It is not the step that directly satisfies the stated need to monitor whether the architecture stays effective.
Question 472
A regional hospital has a ransomware playbook but has never exercised it with clinical leaders. A security manager has a defined assignment: use lessons to improve operational readiness. Which action BEST fulfills that specific assignment?
- Retest previously failed decision points and record approved corrections
- Establish a joint incident command structure with clinical and security leadership
- Update playbook steps, training and decision thresholds based on observed weaknesses
- Record unresolved escalation, isolation and care-continuity choices from the exercise
Explanation
Correct Answer
C:Exercises should drive measurable improvement. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Closing an action item requires evidence. That action primarily serves the different objective to verify remediation of exercise findings. It is not the step that directly satisfies the stated need to use lessons to improve operational readiness.
B:Response authority cannot be improvised in a crisis. That action primarily serves the different objective to clarify who directs clinical and cyber response. It is not the step that directly satisfies the stated need to use lessons to improve operational readiness.
D:Gaps should become actionable findings. That action primarily serves the different objective to identify missing decisions in the playbook. It is not the step that directly satisfies the stated need to use lessons to improve operational readiness.
Question 473
A manufacturer receives alerts suggesting malware on an isolated engineering workstation. The engineering workstation remains quarantined after investigation, and plant operations now requests formal return-to-service clearance. The accountable executive now asks the team to confirm safe closure of the event. What should the security manager recommend?
- Use classification and escalation thresholds to activate the appropriate response team
- Preserve the original alert and memory capture, then close the incident without verifying a safe workstation state
- Validate clean state, monitoring and root cause before releasing the workstation
- Isolate affected paths through approved safety-aware containment
Explanation
Correct Answer
C:Removing an alert does not prove eradication. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Notifications should follow the incident criteria. That action primarily serves the different objective to decide who should be notified internally. It is not the step that directly satisfies the stated need to confirm safe closure of the event.
B:Evidence collection preserves investigative facts but does not establish eradication or safe return to production. Clean state, appropriate monitoring and root-cause checks must precede closure.
D:Containment must balance security and operational safety. That action primarily serves the different objective to limit possible spread without halting the factory. It is not the step that directly satisfies the stated need to confirm safe closure of the event.
Question 474
A bank discovers signs that a privileged administrator account was used outside approved working hours. After reviewing the situation, the management objective is to reduce future privileged account misuse. Which response MOST directly addresses it?
- Review session controls and strengthen just-in-time privileges after root-cause analysis
- Assess systems touched, potential data exposure and verified misuse against classification criteria
- Secure authentication records and privileged action history with chain of custody
- Revoke risky sessions and rotate credentials under the authorized response plan
Explanation
Correct Answer
A:Prevention should address the exploited path. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Severity depends on business consequence. That action primarily serves the different objective to decide whether the event triggers higher-severity escalation. It is not the step that directly satisfies the stated need to reduce future privileged account misuse.
C:Investigators need intact records. That action primarily serves the different objective to preserve investigative material. It is not the step that directly satisfies the stated need to reduce future privileged account misuse.
D:Credential containment can limit further access. That action primarily serves the different objective to prevent ongoing misuse of the suspected credential. It is not the step that directly satisfies the stated need to reduce future privileged account misuse.
Question 475
A national retailer receives conflicting severity ratings for similar security events in different stores. For the next governance decision, the team must adjust thresholds after a near-miss. Which choice BEST provides that outcome?
- Sample incident records and compare severity decisions with policy
- Review evidence and change criteria through formal response governance
- Use the agreed severity criteria and current business impacts for triage
- Name an incident commander with documented decision and review authority
Explanation
Correct Answer
B:Lessons can expose inadequate thresholds. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A document alone does not prove consistent classification. That action primarily serves the different objective to check whether stores use the classification correctly. It is not the step that directly satisfies the stated need to adjust thresholds after a near-miss.
C:Resources should follow verified harm. That action primarily serves the different objective to prioritize response resources during a widespread campaign. It is not the step that directly satisfies the stated need to adjust thresholds after a near-miss.
D:Severity changes require accountable judgment. That action primarily serves the different objective to clarify who is authorized to change incident severity. It is not the step that directly satisfies the stated need to adjust thresholds after a near-miss.
Question 476
An airline needs to plan recovery of reservation and baggage systems after a regional data-center loss. The security program has been tasked specifically to validate the recovery approach. Which approach should be selected?
- Evaluate alternatives against the approved objectives and cost constraints
- Document identity, networks, suppliers and upstream data needed by the services
- Exercise the service dependencies and measure actual restoration against objectives
- Set business-approved recovery time and point objectives for each service
Explanation
Correct Answer
C:Architecture claims need operating proof. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Technical recovery should meet business targets. That action primarily serves the different objective to choose appropriate recovery architecture. It is not the step that directly satisfies the stated need to validate the recovery approach.
B:A recovered application may still be unusable. That action primarily serves the different objective to map dependencies that could block recovery. It is not the step that directly satisfies the stated need to validate the recovery approach.
D:Recovery requirements must follow process impact. That action primarily serves the different objective to determine acceptable downtime and data loss. It is not the step that directly satisfies the stated need to validate the recovery approach.
Question 477
A bank's continuity team has repaired earlier restoration failures and needs to verify that its online-banking recovery process now meets the agreed targets. A security manager has a defined assignment: revalidate after remediation. Which action BEST fulfills that specific assignment?
- Compare actual recovery time and recoverable data against approved RTO and RPO
- Test application, data, identity and network restoration in a controlled environment
- Repeat the failed restoration conditions and capture completion evidence
- Escalate the shortfall and fund changes with accountable owners
Explanation
Correct Answer
C:Repeat the earlier failure scenario using the repaired processes, confirm that applications and dependencies restore, and retain measured recovery and transaction evidence against agreed targets. This verifies the remedy rather than assuming the new runbook is sufficient.
Incorrect Answers
A:Comparing measured recovery time and recoverable data with approved RTO and RPO is essential evaluation, but that comparison requires an actual repeat restoration test and its evidence.
B:A broad end-to-end recovery exercise is useful, but repeating the exact conditions that previously failed most directly tests whether the repairs addressed the observed defect.
D:Escalating shortfalls and allocating funding is necessary if the retest fails, but it does not establish whether the post-remediation recovery process now works.
Question 478
A food distributor has a business continuity plan for warehouse outages but not disruption of cloud scheduling. The accountable executive now asks the team to improve the plan following a failed exercise. What should the security manager recommend?
- Define who declares disruption and starts alternate procedures
- Exercise dispatch personnel and vendor handoffs during a simulation
- Correct dependency, communications and staffing gaps and retest
- Develop a tested manual or secondary scheduling process with defined capacity limits
Explanation
Correct Answer
C:Exercise evidence should drive revisions. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Delayed decisions can extend downtime. That action primarily serves the different objective to assign activation authority. It is not the step that directly satisfies the stated need to improve the plan following a failed exercise.
B:A plan unread by staff is ineffective. That action primarily serves the different objective to train staff on the alternate workflow. It is not the step that directly satisfies the stated need to improve the plan following a failed exercise.
D:Workarounds must support essential activities. That action primarily serves the different objective to select an alternative workflow for scheduling outages. It is not the step that directly satisfies the stated need to improve the plan following a failed exercise.
Question 479
A university has copied data to a second region but disaster recovery tests fail because identity services are unavailable. After reviewing the situation, the management objective is to correct the plan after testing reveals gaps. Which response MOST directly addresses it?
- Document the ordered restoration of core dependencies before applications
- Update runbooks, owner actions and architecture, then retest
- Time the integrated service test and compare to approved recovery objectives
- Design tested identity, DNS and network recovery dependencies
Explanation
Correct Answer
B:Repeated test failures need structural correction. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Correct sequencing prevents circular failures. That action primarily serves the different objective to define recovery sequencing. It is not the step that directly satisfies the stated need to correct the plan after testing reveals gaps.
C:DR must meet business commitments. That action primarily serves the different objective to measure actual recovery against commitments. It is not the step that directly satisfies the stated need to correct the plan after testing reveals gaps.
D:A complete service requires supporting systems. That action primarily serves the different objective to add missing recovery components. It is not the step that directly satisfies the stated need to correct the plan after testing reveals gaps.
Question 480
A software vendor's incident response plan has a generic contact list but unclear decision authority during a breach. The company has outsourced an incident-response function and changed its on-call approval chain since the plan was last reviewed. For the next governance decision, the team must maintain the response plan as the firm changes. Which choice BEST provides that outcome?
- Keep the old incident triggers and update only the telephone contact list despite a newly outsourced response function
- Review the plan after organizational and supplier changes
- Run an exercise with out-of-hours contact and approval paths
- Document containment options, approvals and dependencies by scenario
Explanation
Correct Answer
B:Roles and contacts can quickly become obsolete. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Activation thresholds are important but simply retaining old criteria and updating telephone numbers fails to review new supplier roles, dependencies and authority. The whole response plan must be maintained after changes.
C:Contacts may fail under realistic conditions. That action primarily serves the different objective to test communication during simulated escalation. It is not the step that directly satisfies the stated need to maintain the response plan as the firm changes.
D:Teams need executable decisions. That action primarily serves the different objective to create decision-ready action playbooks. It is not the step that directly satisfies the stated need to maintain the response plan as the firm changes.
