Isaca CISM Practice Test 50
Question 490
A hospital detects unauthorized changes to medication inventory records but systems remain online. For the next governance decision, the team must prevent recurrence. Which choice BEST provides that outcome?
- Address the exploited authorization path and monitor sensitive record changes
- Restrict suspect identities and privileged change paths under incident authority
- Reconcile approved source data and verify corrections with clinical owners
- Coordinate clinical assessment of affected medication decisions
Explanation
Correct Answer
A:Root-cause treatment closes the weakness. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Targeted containment protects records. That action primarily serves the different objective to contain continued unauthorized modification. It is not the step that directly satisfies the stated need to prevent recurrence.
C:Rollback without validation may propagate errors. That action primarily serves the different objective to restore trusted data carefully. It is not the step that directly satisfies the stated need to prevent recurrence.
D:Business impact can extend beyond IT. That action primarily serves the different objective to determine whether patient safety is threatened. It is not the step that directly satisfies the stated need to prevent recurrence.
Question 491
A logistics firm restored a ransomware-affected server from backup but has not established that its data is trustworthy. The security program has been tasked specifically to improve the recovery procedure. Which approach should be selected?
- Capture actual downtime and data loss against agreed RTO/RPO
- Incorporate incident lessons into backup, testing and validation steps
- Follow approved priorities for logistics routing and customer updates
- Confirm eradication and access control remediation before reconnecting
Explanation
Correct Answer
B:Future readiness needs feedback. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Service restoration should be evaluated. That action primarily serves the different objective to measure whether objectives were met. It is not the step that directly satisfies the stated need to improve the recovery procedure.
C:Recovery sequence matters. That action primarily serves the different objective to restore service in business dependency order. It is not the step that directly satisfies the stated need to improve the recovery procedure.
D:Reconnection may reintroduce compromise. That action primarily serves the different objective to ensure the intrusion path is closed. It is not the step that directly satisfies the stated need to improve the recovery procedure.
Question 492
A security team closes an incident when malware is removed but never examines why privileged access was granted. A security manager has a defined assignment: inform governance of residual exposure. Which action BEST fulfills that specific assignment?
- Conduct a structured cross-functional post-incident review
- Retest the originally exploited pathway and monitoring gaps
- Report material weaknesses and treatment commitments to risk authorities
- Turn findings into prioritized, funded changes and due dates
Explanation
Correct Answer
C:Executive oversight needs consequences. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Improvement requires candid evidence. That action primarily serves the different objective to record what went well and poorly during response. It is not the step that directly satisfies the stated need to inform governance of residual exposure.
B:Closure should reflect outcomes. That action primarily serves the different objective to verify corrective actions reduce risk. It is not the step that directly satisfies the stated need to inform governance of residual exposure.
D:Lessons need accountable execution. That action primarily serves the different objective to assign corrective measures with owners. It is not the step that directly satisfies the stated need to inform governance of residual exposure.
Question 493
A logistics company tests incident communications only in daylight hours though a major outage occurred overnight. The accountable executive now asks the team to maintain readiness after staff turnover. What should the security manager recommend?
- Create backups for critical decision roles and verified alternate channels
- Record unreachable owners and delayed vendor acknowledgments
- Repeat the failed callout sequence and measure response against target
- Trigger contact-list updates and brief drills when roles change
Explanation
Correct Answer
D:Readiness records age quickly. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Single points of failure delay response. That action primarily serves the different objective to repair the contact and authority model. It is not the step that directly satisfies the stated need to maintain readiness after staff turnover.
B:Exercise gaps require specifics. That action primarily serves the different objective to identify failed contact dependencies. It is not the step that directly satisfies the stated need to maintain readiness after staff turnover.
C:Changes require retesting. That action primarily serves the different objective to verify remediation of communication gaps. It is not the step that directly satisfies the stated need to maintain readiness after staff turnover.
Question 494
A multinational organization activates incident response simultaneously in multiple countries but has no unified incident commander. After reviewing the situation, the management objective is to review cross-region decision delays. Which response MOST directly addresses it?
- Assign local legal leads to the global response team and map jurisdiction triggers
- Maintain a common status record and approved communication cadence
- Use business impact and command authority to resolve cross-border tradeoffs
- Include coordination failures in post-incident improvements
Explanation
Correct Answer
D:Governance must learn from the event. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Response needs local compliance expertise. That action primarily serves the different objective to coordinate national legal and privacy requirements. It is not the step that directly satisfies the stated need to review cross-region decision delays.
B:Shared facts prevent fragmented decisions. That action primarily serves the different objective to share accurate incident state across regions. It is not the step that directly satisfies the stated need to review cross-region decision delays.
C:Containment can have global consequences. That action primarily serves the different objective to manage conflicting containment requests. It is not the step that directly satisfies the stated need to review cross-region decision delays.
Question 495
A university's security center labels every phishing report as a high-severity incident. For the next governance decision, the team must refine procedures after repeated false positives. Which choice BEST provides that outcome?
- Update analyst guidance and retrain teams on classification examples
- Sample incident records and compare ratings with defined criteria
- Triage indicators, exposure and critical service impact under approved rules
- Invoke the threshold for affected identities and access risk
Explanation
Correct Answer
A:Clear criteria improve consistency. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Classification quality can be tested. That action primarily serves the different objective to measure misclassification trends. It is not the step that directly satisfies the stated need to refine procedures after repeated false positives.
C:Resource allocation depends on severity. That action primarily serves the different objective to prioritize investigative effort. It is not the step that directly satisfies the stated need to refine procedures after repeated false positives.
D:Escalation should be evidence based. That action primarily serves the different objective to escalate a confirmed compromise of faculty accounts. It is not the step that directly satisfies the stated need to refine procedures after repeated false positives.
Question 496
A fintech must update executives while investigators still disagree over whether customer data was exposed. The security program has been tasked specifically to correct previous status when evidence changes. Which approach should be selected?
- Link affected services, data categories and operational losses to evidence
- Have legal counsel determine triggering facts and deadlines for applicable laws
- Publish an authorized update explaining material factual changes
- Present risk-based response options and consequences to the incident authority
Explanation
Correct Answer
C:Communications must stay accurate. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Impact statements need support. That action primarily serves the different objective to document the current incident impact. It is not the step that directly satisfies the stated need to correct previous status when evidence changes.
B:Notification is not solely a technical judgment. That action primarily serves the different objective to coordinate any legal notifications. It is not the step that directly satisfies the stated need to correct previous status when evidence changes.
D:Leaders can act despite uncertainty. That action primarily serves the different objective to seek timely decisions without speculation. It is not the step that directly satisfies the stated need to correct previous status when evidence changes.
Question 497
A public utility has isolated an affected control-system host after a breach, and the team must verify it is clean before full restoration. A security manager has a defined assignment: complete the incident record. Which action BEST fulfills that specific assignment?
- Document recovery evidence, residual exposure and lessons for governance
- Coordinate controlled restoration with engineering and safety teams
- Test operational control and communications end to end before handback
- Increase detection and log review for recurrence indicators
Explanation
Correct Answer
A:A closeout supports accountability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Recovery must protect physical operations. That action primarily serves the different objective to sequence recovery around safety needs. It is not the step that directly satisfies the stated need to complete the incident record.
C:Network availability does not guarantee process safety. That action primarily serves the different objective to validate dependent business processes. It is not the step that directly satisfies the stated need to complete the incident record.
D:Recovery needs heightened assurance. That action primarily serves the different objective to monitor the recovered environment closely. It is not the step that directly satisfies the stated need to complete the incident record.
Question 498
A bank suspects a cyberattack on an interbank settlement gateway with extremely limited tolerated downtime. The accountable executive now asks the team to review strategic dependencies after stabilization. What should the security manager recommend?
- Review network and transaction telemetry against known indicators
- Use preapproved forensic collection compatible with required continuity
- Escalate to approved crisis and settlement risk decision makers
- Assess architecture resilience and alternate settlement routes with business owners
Explanation
Correct Answer
D:Systemic dependencies can warrant redesign. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A firewall change is not proof of containment. That action primarily serves the different objective to verify that targeted containment blocks the attack path. It is not the step that directly satisfies the stated need to review strategic dependencies after stabilization.
B:Evidence needs must be balanced with operational risk. That action primarily serves the different objective to preserve volatile evidence while maintaining safety. It is not the step that directly satisfies the stated need to review strategic dependencies after stabilization.
C:Security engineers cannot unilaterally accept systemic effects. That action primarily serves the different objective to invoke the right business authority for high-impact action. It is not the step that directly satisfies the stated need to review strategic dependencies after stabilization.
Question 499
A manufacturing group relies on one outsourced cloud identity service for business continuity across every plant. After reviewing the situation, the management objective is to review provider concentration exposure. Which response MOST directly addresses it?
- Set tightly controlled emergency access with post-use monitoring
- Exercise the dependency failure and verify operational targets
- Assess contract resilience, alternate providers and residual shared risk
- Design and test approved identity fallback or alternate access arrangements
Explanation
Correct Answer
C:One service can affect all plants. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Availability exceptions need oversight. That action primarily serves the different objective to ensure fallback does not create excessive privileges. It is not the step that directly satisfies the stated need to review provider concentration exposure.
B:A plan may fail at scale. That action primarily serves the different objective to test a cloud identity outage across plants. It is not the step that directly satisfies the stated need to review provider concentration exposure.
D:Continuity needs an executable alternative. That action primarily serves the different objective to define a workable continuity approach. It is not the step that directly satisfies the stated need to review provider concentration exposure.
Question 500
A government data center has backups but no plan to reconstruct application dependencies after a major outage. For the next governance decision, the team must close observed recovery gaps. Which choice BEST provides that outcome?
- Document repeatable runbooks with named owners and prerequisites
- Use BIA findings to define RTO/RPO for affected services
- Assign fixes, fund missing capacity and retest failed dependencies
- Exercise full-service restoration and validate business transactions
Explanation
Correct Answer
C:Gaps require verified remediation. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Recovery must be executable. That action primarily serves the different objective to prepare detailed technical restoration procedures. It is not the step that directly satisfies the stated need to close observed recovery gaps.
B:Technical targets need business justification. That action primarily serves the different objective to set business-approved recovery targets. It is not the step that directly satisfies the stated need to close observed recovery gaps.
D:Backup existence does not prove recoverability. That action primarily serves the different objective to verify recoverability in a realistic environment. It is not the step that directly satisfies the stated need to close observed recovery gaps.
