Isaca CISM Practice Test 6
Question 50
A sales organization suffered credential theft after repeated social engineering calls to its help desk. The security program has been tasked specifically to identify behavior gaps in service desk authentication. Which approach should be selected?
- Implement dual approval and recorded verification for sensitive recovery requests
- Review actual identity-proofing calls and escalation decisions
- Update training and procedural controls for the new contact channel
- Test sampled reset requests and track unauthorized exceptions
Explanation
Correct Answer
B:Real-world patterns reveal weaknesses. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Preventive workflow limits social engineering. That action primarily serves the different objective to prevent overrides of high-risk identity resets. It is not the step that directly satisfies the stated need to identify behavior gaps in service desk authentication.
C:Threat changes should alter practice. That action primarily serves the different objective to respond when attackers switch to collaboration chat. It is not the step that directly satisfies the stated need to identify behavior gaps in service desk authentication.
D:Proof of behavior matters more than course attendance. That action primarily serves the different objective to measure effectiveness after training changes. It is not the step that directly satisfies the stated need to identify behavior gaps in service desk authentication.
Question 51
An insurance firm finds archived customer records without usable ownership or retention tags. A security manager has a defined assignment: reconstruct the inventory before bulk deletion. Which action BEST fulfills that specific assignment?
- Enforce retention and authorized deletion using recorded approvals
- Map repositories, records, owners and legal hold requirements
- Have business owners approve disposition and access decisions
- Review deletion logs, hold exceptions and sampled archive records
Explanation
Correct Answer
B:Deleting unknown records may violate obligations. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Lifecycle obligations need operating controls. That action primarily serves the different objective to implement lifecycle controls consistently. It is not the step that directly satisfies the stated need to reconstruct the inventory before bulk deletion.
C:IT custody does not establish data ownership. That action primarily serves the different objective to assign accountable data stewards. It is not the step that directly satisfies the stated need to reconstruct the inventory before bulk deletion.
D:Evidence must support claimed retention compliance. That action primarily serves the different objective to verify disposition without exposing sensitive data. It is not the step that directly satisfies the stated need to reconstruct the inventory before bulk deletion.
Question 52
An analytics platform gives administrators permanent privileged access to production datasets. The accountable executive now asks the team to reduce standing privilege. What should the security manager recommend?
- Reconcile entitlements with the new role and promptly revoke unneeded privileges
- Collect actionable privileged activity logs with independent monitoring
- Introduce just-in-time elevated roles with approval and expiry
- Review sampled grants and test expiry against the approved role model
Explanation
Correct Answer
C:Temporary privilege reduces persistent exposure. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Access must follow job responsibility. That action primarily serves the different objective to respond to an administrator changing departments. It is not the step that directly satisfies the stated need to reduce standing privilege.
B:Visibility is needed to identify abuse. That action primarily serves the different objective to detect misuse of privileged sessions. It is not the step that directly satisfies the stated need to reduce standing privilege.
D:Documentation cannot replace enforcement. That action primarily serves the different objective to validate that access is appropriately restricted. It is not the step that directly satisfies the stated need to reduce standing privilege.
Question 53
A health insurer deploys a machine learning claims service and needs security controls integrated before release. After reviewing the situation, the management objective is to identify risks to training and inference workflows. Which response MOST directly addresses it?
- Exercise unauthorized inference access and inspect audit events
- Threat-model sensitive data use, model access and third-party dependencies
- Use controlled model promotion with accountable approval and version history
- Review drift, sensitive-output reports and supplier changes with risk owners
Explanation
Correct Answer
B:AI workflows introduce data and model risks. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Positive test evidence validates enforcement. That action primarily serves the different objective to test whether security controls work. It is not the step that directly satisfies the stated need to identify risks to training and inference workflows.
C:Model updates can alter risk unexpectedly. That action primarily serves the different objective to prevent unreviewed model changes. It is not the step that directly satisfies the stated need to identify risks to training and inference workflows.
D:Operational conditions may change after approval. That action primarily serves the different objective to monitor post-deployment model risk. It is not the step that directly satisfies the stated need to identify risks to training and inference workflows.
Question 54
A nonprofit runs yearly penetration testing but does not repair repeated high-severity findings. For the next governance decision, the team must prioritize actionable remediation. Which choice BEST provides that outcome?
- Rank confirmed exploitable findings by donor-system exposure and impact
- Retest affected attack paths and retain validation evidence
- Escalate repeat findings and root causes to the responsible executives
- Update threat scenarios to include newly deployed services and data flows
Explanation
Correct Answer
A:Testing value comes from risk reduction. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:A closed ticket is not a verified fix. That action primarily serves the different objective to verify corrections rather than trust ticket closure. It is not the step that directly satisfies the stated need to prioritize actionable remediation.
C:Persistent patterns may need structural investment. That action primarily serves the different objective to report recurring control failure to governance. It is not the step that directly satisfies the stated need to prioritize actionable remediation.
D:Test plans must reflect real architecture. That action primarily serves the different objective to improve testing scope for new platforms. It is not the step that directly satisfies the stated need to prioritize actionable remediation.
Question 55
A multinational's data loss prevention program blocks harmless collaboration but misses confidential file exports. The security program has been tasked specifically to clarify protected information and valid workflows. Which approach should be selected?
- Review classification and authorized sharing patterns with data owners
- Reassess data egress coverage and extend approved monitoring and controls
- Run monitored policy simulations and tune false positives before blocking
- Measure confirmed leakage events and bypass paths by channel
Explanation
Correct Answer
A:Rules need business context. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:New channels can evade old rules. That action primarily serves the different objective to respond when employees use a new file-transfer service. It is not the step that directly satisfies the stated need to clarify protected information and valid workflows.
C:Testing reduces user disruption. That action primarily serves the different objective to pilot enforcement without disrupting work. It is not the step that directly satisfies the stated need to clarify protected information and valid workflows.
D:Alert count alone is not protection. That action primarily serves the different objective to evaluate actual DLP control coverage. It is not the step that directly satisfies the stated need to clarify protected information and valid workflows.
Question 56
A large university is moving endpoints to a centralized security management platform. A security manager has a defined assignment: understand unsupported devices and workloads. Which action BEST fulfills that specific assignment?
- Pilot in representative departments and use staged deployment controls
- Inventory operating systems, critical applications and management constraints
- Document exceptions with compensating controls and review dates
- Measure policy compliance and tested detection across device groups
Explanation
Correct Answer
B:Device diversity affects control rollout. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Research workloads may have compatibility needs. That action primarily serves the different objective to deploy safely across research departments. It is not the step that directly satisfies the stated need to understand unsupported devices and workloads.
C:Exceptions need deliberate risk acceptance. That action primarily serves the different objective to handle endpoints that cannot support a mandatory setting. It is not the step that directly satisfies the stated need to understand unsupported devices and workloads.
D:An enrolled device is not necessarily protected. That action primarily serves the different objective to validate endpoint protection consistently. It is not the step that directly satisfies the stated need to understand unsupported devices and workloads.
Question 57
An enterprise uses multiple public clouds and wants consistent access controls without forcing identical implementations. The accountable executive now asks the team to define cross-cloud security outcomes. What should the security manager recommend?
- Set common identity, logging and data-protection control objectives
- Monitor baseline deviations and assess service feature releases
- Review privilege paths and logging evidence for each implementation
- Translate the common outcomes into approved configurations in each cloud
Explanation
Correct Answer
A:Outcomes can be comparable across platforms. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Cloud control behavior changes over time. That action primarily serves the different objective to detect control drift after provider changes. It is not the step that directly satisfies the stated need to define cross-cloud security outcomes.
C:Similar policy names may yield different rights. That action primarily serves the different objective to test effective access across clouds. It is not the step that directly satisfies the stated need to define cross-cloud security outcomes.
D:Uniform intent may need different technical controls. That action primarily serves the different objective to implement platform-native baselines. It is not the step that directly satisfies the stated need to define cross-cloud security outcomes.
Question 58
A transport company manages thousands of certificates for vehicle APIs and fears accidental expiry. After reviewing the situation, the management objective is to establish an accurate credential inventory. Which response MOST directly addresses it?
- Alert on certificate age, failed handshakes and unexpected key use
- Track certificate owners, dependencies and expiration dates
- Use overlapping trust and staged replacement with partner validation
- Exercise renewal and rollback on representative service paths
Explanation
Correct Answer
B:Unknown credentials create outage risks. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Early warning supports prevention. That action primarily serves the different objective to monitor for impending expiration and unusual use. It is not the step that directly satisfies the stated need to establish an accurate credential inventory.
C:Cutover can fail if clients are not prepared. That action primarily serves the different objective to implement safe rotation without service interruption. It is not the step that directly satisfies the stated need to establish an accurate credential inventory.
D:A runbook alone may contain errors. That action primarily serves the different objective to test rotation before a major deadline. It is not the step that directly satisfies the stated need to establish an accurate credential inventory.
Question 59
A national retailer plans secure coding practices for a rapidly growing delivery application. For the next governance decision, the team must integrate security into product planning. Which choice BEST provides that outcome?
- Pause release or obtain authorized risk treatment based on business impact
- Require threat modeling and risk acceptance criteria for significant features
- Use source/dependency analysis and targeted dynamic testing in the pipeline
- Track confirmed recurring weaknesses and time to remediate by team
Explanation
Correct Answer
B:Early decisions affect architecture. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Deadlines do not eliminate product risk. That action primarily serves the different objective to handle a critical flaw found before launch. It is not the step that directly satisfies the stated need to integrate security into product planning.
C:Different tests find different weaknesses. That action primarily serves the different objective to automate a suitable mix of tests. It is not the step that directly satisfies the stated need to integrate security into product planning.
D:Outcomes reveal process maturity. That action primarily serves the different objective to measure whether security engineering is improving. It is not the step that directly satisfies the stated need to integrate security into product planning.
Question 60
A hospital tracks security controls by purchase date and vendor name but cannot prove effectiveness. The security program has been tasked specifically to define the expected outcome of each control. Which approach should be selected?
- Link failed tests to residual impact, remediation dates and accountable owners
- Test whether controls function repeatedly in the production context
- Document the risk scenario and measurable preventive or detective result
- Retest the failed condition and record independent closure evidence
Explanation
Correct Answer
C:Control intent must be explicit. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Management needs impact and ownership. That action primarily serves the different objective to report ineffective controls to risk owners. It is not the step that directly satisfies the stated need to define the expected outcome of each control.
B:A good design may be badly operated. That action primarily serves the different objective to distinguish operating from design effectiveness. It is not the step that directly satisfies the stated need to define the expected outcome of each control.
D:Implementation claims are not sufficient. That action primarily serves the different objective to verify correction of an identified weakness. It is not the step that directly satisfies the stated need to define the expected outcome of each control.
