Isaca CISM Practice Test 5
Question 40
A hospital's data inventory excludes confidential imaging archives managed by a research partner. The security program has been tasked specifically to identify all information assets in the patient workflow. Which approach should be selected?
- Define contractually required safeguards derived from the classification
- Map data sets, locations, owners and external processing relationships
- Integrate discovery and owner review into the data lifecycle
- Reassess permitted use, retention and access with the asset owner
Explanation
Correct Answer
B:Incomplete inventories hide sensitive information. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Outside custody does not eliminate handling obligations. That action primarily serves the different objective to ensure the partner applies correct handling protections. It is not the step that directly satisfies the stated need to identify all information assets in the patient workflow.
C:Periodic discovery limits inventory drift. That action primarily serves the different objective to detect newly created unclassified datasets. It is not the step that directly satisfies the stated need to identify all information assets in the patient workflow.
D:Information sensitivity changes with purpose. That action primarily serves the different objective to verify classification remains correct after research scope changes. It is not the step that directly satisfies the stated need to identify all information assets in the patient workflow.
Question 41
A telecommunications firm cannot identify who owns encryption of call records stored across cloud platforms. A security manager has a defined assignment: define ownership for the records and storage controls. Which action BEST fulfills that specific assignment?
- Assign the service owner to data risk and platform teams to control execution
- Separate key ownership, privileged access and independent logging
- Use the classification and threat model to approve encryption and key handling requirements
- Review encryption configurations and key-access evidence across all copies
Explanation
Correct Answer
A:Data accountability and technical operation differ. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Key access can undermine encryption. That action primarily serves the different objective to prevent unmanaged key administrators. It is not the step that directly satisfies the stated need to define ownership for the records and storage controls.
C:Controls must match risk and use constraints. That action primarily serves the different objective to select an encryption approach appropriate to information sensitivity. It is not the step that directly satisfies the stated need to define ownership for the records and storage controls.
D:A policy does not prove every replica is protected. That action primarily serves the different objective to evaluate whether data protection operates as intended. It is not the step that directly satisfies the stated need to define ownership for the records and storage controls.
Question 42
A nonprofit is aligning its security program with a standard framework for donor confidence. The accountable executive now asks the team to choose a framework without treating it as a complete risk analysis. What should the security manager recommend?
- Obtain test evidence for selected controls and documented exceptions
- Rank findings by business exposure rather than control numbering
- Reassess control applicability for changed technology and partners
- Map relevant framework outcomes to donor-data and mission risks
Explanation
Correct Answer
D:Framework adoption must be tailored to context. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Self-declaration alone is weak assurance. That action primarily serves the different objective to validate claims of conformity. It is not the step that directly satisfies the stated need to choose a framework without treating it as a complete risk analysis.
B:Not every missing control has equal impact. That action primarily serves the different objective to prioritize gaps identified by a framework assessment. It is not the step that directly satisfies the stated need to choose a framework without treating it as a complete risk analysis.
C:Framework scope should follow service changes. That action primarily serves the different objective to refresh the framework mapping after new cloud services. It is not the step that directly satisfies the stated need to choose a framework without treating it as a complete risk analysis.
Question 43
A manufacturing group has security policy documents with inconsistent terminology and obsolete operating steps. After reviewing the situation, the management objective is to separate mandatory policy intent from detailed instructions. Which response MOST directly addresses it?
- Require documented risk acceptance with compensating controls and expiry
- Establish a hierarchy of policy, standards, procedures and advisory guidelines
- Distribute role-specific instructions through normal operational channels
- Observe operations and compare evidence with required standards
Explanation
Correct Answer
B:Different document types serve different authority levels. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:An exception should remain controlled. That action primarily serves the different objective to manage exceptions for a machine that cannot support the standard. It is not the step that directly satisfies the stated need to separate mandatory policy intent from detailed instructions.
C:Awareness depends on accessible guidance. That action primarily serves the different objective to communicate mandatory requirements to workers. It is not the step that directly satisfies the stated need to separate mandatory policy intent from detailed instructions.
D:Publication alone does not show compliance. That action primarily serves the different objective to confirm control procedures are followed. It is not the step that directly satisfies the stated need to separate mandatory policy intent from detailed instructions.
Question 44
A software provider must reduce unauthorized production database changes without delaying legitimate releases. For the next governance decision, the team must select controls based on the production change risk. Which choice BEST provides that outcome?
- Require independent approval and least-privilege access for sensitive deployment actions
- Attempt a controlled unauthorized release and verify blocking and logging
- Alert on direct privileged writes outside approved deployment workflows
- Use emergency change authority with retrospective independent review
Explanation
Correct Answer
A:Segregation reduces self-approved changes. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Technical enforcement should be demonstrated. That action primarily serves the different objective to test effectiveness of the change control. It is not the step that directly satisfies the stated need to select controls based on the production change risk.
C:Operational signals reveal control failures. That action primarily serves the different objective to monitor changes that bypass approved release paths. It is not the step that directly satisfies the stated need to select controls based on the production change risk.
D:Emergency processes need accountability. That action primarily serves the different objective to handle an emergency fix under a defined exception. It is not the step that directly satisfies the stated need to select controls based on the production change risk.
Question 45
A retail group is deploying network access controls across stores that use many third-party maintenance devices. The security program has been tasked specifically to map actual dependencies before control rollout. Which approach should be selected?
- Pilot policies in representative stores with rollback and monitoring
- Inventory device paths and critical service communications
- Require an access review and update the approved segmentation baseline
- Test blocked cross-zone paths and required allowed services
Explanation
Correct Answer
B:Unknown flows can cause operational outages. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Controlled rollout reduces disruption. That action primarily serves the different objective to phase the control implementation safely. It is not the step that directly satisfies the stated need to map actual dependencies before control rollout.
C:New devices should not inherit broad access. That action primarily serves the different objective to respond when new maintenance devices need access. It is not the step that directly satisfies the stated need to map actual dependencies before control rollout.
D:Configuration alone cannot prove segmentation. That action primarily serves the different objective to verify the network controls enforce the design. It is not the step that directly satisfies the stated need to map actual dependencies before control rollout.
Question 46
A payment processor has installed a web application firewall but still sees injection attempts reaching applications. A security manager has a defined assignment: establish whether the control is effective. Which action BEST fulfills that specific assignment?
- Retest the previously successful attack paths under normal traffic conditions
- Record test methods, observed bypasses and control owner responses
- Use authorized attack simulations and application telemetry to test blocking
- Rank fixes by reachable exposure and payment-processing impact
Explanation
Correct Answer
C:A deployed firewall is not proof of protection. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Closure requires demonstrated improvement. That action primarily serves the different objective to verify improvements after tuning. It is not the step that directly satisfies the stated need to establish whether the control is effective.
B:Reproducible results support accountability. That action primarily serves the different objective to preserve evidence for governance decisions. It is not the step that directly satisfies the stated need to establish whether the control is effective.
D:Business risk should drive urgency. That action primarily serves the different objective to prioritize remediation for exploitable gaps. It is not the step that directly satisfies the stated need to establish whether the control is effective.
Question 47
A utilities firm conducts annual cyber training but plant operators still approve suspicious remote access requests. The accountable executive now asks the team to identify which roles need specialized training. What should the security manager recommend?
- Map operational technology access decisions to plant job responsibilities
- Provide job aids and supervisor checks at access approval points
- Analyze root causes and rework targeted lessons before retesting
- Test operator decisions in controlled drills and review errors
Explanation
Correct Answer
A:Generic material may miss role-specific risks. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Workflow reinforcement supports retention. That action primarily serves the different objective to reinforce the behavior in everyday work. It is not the step that directly satisfies the stated need to identify which roles need specialized training.
C:Measured gaps should shape program content. That action primarily serves the different objective to adjust training after repeated drill failures. It is not the step that directly satisfies the stated need to identify which roles need specialized training.
D:Completion does not prove competence. That action primarily serves the different objective to evaluate learning beyond course completion. It is not the step that directly satisfies the stated need to identify which roles need specialized training.
Question 48
A logistics firm moves its vehicle-tracking platform to a managed SaaS provider. The SaaS contract is not yet signed, and the vendor's generic assurance report omits the firm's vehicle-data interfaces. After reviewing the situation, the management objective is to assess the supplier before contracting. Which response MOST directly addresses it?
- Test access to exportable data and an alternate service transition path
- Review security controls, data flows, financial stability and service dependencies
- Accept the provider's most recent assurance report without mapping which vehicle-tracking dependencies and data flows are in scope
- Require approval and impact assessment under supplier governance terms
Explanation
Correct Answer
B:Onboarding should be risk based. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Exit readiness limits lock-in exposure. That action primarily serves the different objective to plan an orderly exit if the supplier fails. It is not the step that directly satisfies the stated need to assess the supplier before contracting.
C:A generic assurance report may omit the specific service's subcontractors and data interfaces. Precontract supplier assessment should consider controls, flows, resilience and commercial dependencies.
D:Fourth-party changes can alter risk. That action primarily serves the different objective to manage a proposed subprocessor change. It is not the step that directly satisfies the stated need to assess the supplier before contracting.
Question 49
A bank's cloud vendor depends on another company for physical data-center operations. For the next governance decision, the team must identify material fourth-party dependencies. Which choice BEST provides that outcome?
- Escalate through the prime supplier and assess alternative service arrangements
- Evaluate correlated outages and recovery dependence across providers
- Ensure the prime vendor contract imposes timely subcontractor notice and escalation
- Map the provider's critical subcontractors and which controls they operate
Explanation
Correct Answer
D:Invisible dependencies can concentrate risk. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:The enterprise retains responsibility for service continuity. That action primarily serves the different objective to address a critical subcontractor's control failure. It is not the step that directly satisfies the stated need to identify material fourth-party dependencies.
B:Multiple brands can share one failure domain. That action primarily serves the different objective to monitor concentration risk from common facilities. It is not the step that directly satisfies the stated need to identify material fourth-party dependencies.
C:Accountability must flow through the chain. That action primarily serves the different objective to make incident notification duties reach downstream providers. It is not the step that directly satisfies the stated need to identify material fourth-party dependencies.
Question 50
A sales organization suffered credential theft after repeated social engineering calls to its help desk. The security program has been tasked specifically to identify behavior gaps in service desk authentication. Which approach should be selected?
- Implement dual approval and recorded verification for sensitive recovery requests
- Review actual identity-proofing calls and escalation decisions
- Update training and procedural controls for the new contact channel
- Test sampled reset requests and track unauthorized exceptions
Explanation
Correct Answer
B:Real-world patterns reveal weaknesses. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Preventive workflow limits social engineering. That action primarily serves the different objective to prevent overrides of high-risk identity resets. It is not the step that directly satisfies the stated need to identify behavior gaps in service desk authentication.
C:Threat changes should alter practice. That action primarily serves the different objective to respond when attackers switch to collaboration chat. It is not the step that directly satisfies the stated need to identify behavior gaps in service desk authentication.
D:Proof of behavior matters more than course attendance. That action primarily serves the different objective to measure effectiveness after training changes. It is not the step that directly satisfies the stated need to identify behavior gaps in service desk authentication.
