Isaca CISM Practice Test 7
Question 60
A hospital tracks security controls by purchase date and vendor name but cannot prove effectiveness. The security program has been tasked specifically to define the expected outcome of each control. Which approach should be selected?
- Link failed tests to residual impact, remediation dates and accountable owners
- Test whether controls function repeatedly in the production context
- Document the risk scenario and measurable preventive or detective result
- Retest the failed condition and record independent closure evidence
Explanation
Correct Answer
C:Control intent must be explicit. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Management needs impact and ownership. That action primarily serves the different objective to report ineffective controls to risk owners. It is not the step that directly satisfies the stated need to define the expected outcome of each control.
B:A good design may be badly operated. That action primarily serves the different objective to distinguish operating from design effectiveness. It is not the step that directly satisfies the stated need to define the expected outcome of each control.
D:Implementation claims are not sufficient. That action primarily serves the different objective to verify correction of an identified weakness. It is not the step that directly satisfies the stated need to define the expected outcome of each control.
Question 61
A security operations department reports thousands of alerts to senior leadership with no risk prioritization. A security manager has a defined assignment: identify business decisions the report should support. Which action BEST fulfills that specific assignment?
- Reconcile incident and asset records and explain uncertainty
- Evaluate whether reports led to timely treatment and improve measures
- Consult risk owners about required decisions and risk thresholds
- Show options, residual exposure, owner and deadline for material gaps
Explanation
Correct Answer
C:Reporting should serve its audience. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Poor data quality undermines confidence. That action primarily serves the different objective to verify reported information is reliable. It is not the step that directly satisfies the stated need to identify business decisions the report should support.
B:A report is useful when it changes decisions. That action primarily serves the different objective to refine the reporting program from feedback. It is not the step that directly satisfies the stated need to identify business decisions the report should support.
D:Executives need clear decisions. That action primarily serves the different objective to present actionable escalation choices. It is not the step that directly satisfies the stated need to identify business decisions the report should support.
Question 62
A critical infrastructure company has no agreed metrics for its identity control modernization program. The accountable executive now asks the team to select measures based on intended risk outcomes. What should the security manager recommend?
- Reassess what access pathways must be included in the metric
- Escalate material access gaps and accountable remediation owners
- Define privileged account coverage and verified unauthorized-access prevention targets
- Report both enrollment rates and test evidence of controlled access
Explanation
Correct Answer
C:Metrics should match risk objectives. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Changed architecture can invalidate the denominator. That action primarily serves the different objective to revise the measure after identity architecture changes. It is not the step that directly satisfies the stated need to select measures based on intended risk outcomes.
B:Management needs actionable exceptions. That action primarily serves the different objective to inform executives of unfavorable trends. It is not the step that directly satisfies the stated need to select measures based on intended risk outcomes.
D:Enrollment does not prove prevention. That action primarily serves the different objective to distinguish delivery outputs from effectiveness. It is not the step that directly satisfies the stated need to select measures based on intended risk outcomes.
Question 63
A bank is implementing a zero-trust access program for remote contractors. After reviewing the situation, the management objective is to identify which access paths require protection. Which response MOST directly addresses it?
- Map contractor identities, devices and target applications
- Test legitimate workflows and prohibited lateral paths before scaling
- Automate entitlement removal using contract lifecycle triggers
- Review contractor expiry, access logs and policy exceptions
Explanation
Correct Answer
A:Access design needs the real workflow. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Usability and enforcement both matter. That action primarily serves the different objective to pilot the access controls with representative users. It is not the step that directly satisfies the stated need to identify which access paths require protection.
C:Lifecycle integration prevents lingering accounts. That action primarily serves the different objective to revoke access after contract completion. It is not the step that directly satisfies the stated need to identify which access paths require protection.
D:Trust decisions need periodic reassessment. That action primarily serves the different objective to verify continuous access governance. It is not the step that directly satisfies the stated need to identify which access paths require protection.
Question 64
A global retailer is launching a security communications program during a company reorganization. For the next governance decision, the team must identify audiences and decisions they need to make. Which choice BEST provides that outcome?
- Publish role-specific instructions in relevant languages and channels
- Map executives, store operations, suppliers and technical teams to specific messages
- Test whether workers correctly act on critical security notices
- Revise unclear instructions and retest with affected audiences
Explanation
Correct Answer
B:One message cannot serve all audiences. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Comprehension is needed for adoption. That action primarily serves the different objective to translate enterprise policy into usable guidance. It is not the step that directly satisfies the stated need to identify audiences and decisions they need to make.
C:Message delivery does not prove understanding. That action primarily serves the different objective to evaluate communications effectiveness. It is not the step that directly satisfies the stated need to identify audiences and decisions they need to make.
D:Feedback should change the program. That action primarily serves the different objective to update communication after staff feedback. It is not the step that directly satisfies the stated need to identify audiences and decisions they need to make.
Question 65
A government cloud migration introduces new identity and data trust boundaries not covered by the security architecture. The security program has been tasked specifically to identify architecture assumptions that must be updated. Which approach should be selected?
- Check actual trust paths and privileged access against the approved reference
- Use incident and assessment findings to improve architecture standards
- Map new identity federation and data paths against the enterprise threat model
- Require documented design risk acceptance before authorizing exceptions
Explanation
Correct Answer
C:New trust boundaries change exposure. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A diagram alone is insufficient. That action primarily serves the different objective to test conformance after deployment. It is not the step that directly satisfies the stated need to identify architecture assumptions that must be updated.
B:Architecture must evolve with experience. That action primarily serves the different objective to adjust the reference for ongoing modernization. It is not the step that directly satisfies the stated need to identify architecture assumptions that must be updated.
D:Bypasses must remain governed. That action primarily serves the different objective to review proposed deviations to the pattern. It is not the step that directly satisfies the stated need to identify architecture assumptions that must be updated.
Question 66
A large university has deployed centralized logging but discovers critical research servers do not forward events. A security manager has a defined assignment: identify which services create high-value detection evidence. Which action BEST fulfills that specific assignment?
- Review logging retention and access restrictions with legal and privacy owners
- Run controlled scenarios using actual retained logs and timelines
- Map critical research workloads to required security event types
- Monitor telemetry heartbeat and expected event volumes by asset
Explanation
Correct Answer
C:Coverage should follow assets and risks. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Monitoring data also has governance duties. That action primarily serves the different objective to respond when data-retention laws change. It is not the step that directly satisfies the stated need to identify which services create high-value detection evidence.
B:Collection alone does not prove usability. That action primarily serves the different objective to test investigators' ability to reconstruct incidents. It is not the step that directly satisfies the stated need to identify which services create high-value detection evidence.
D:Silent gaps undermine detection. That action primarily serves the different objective to detect collection gaps early. It is not the step that directly satisfies the stated need to identify which services create high-value detection evidence.
Question 67
A financial firm moves email threat filtering to a managed security service. The firm has not signed the managed-filtering contract, and its current procurement draft does not specify whether the provider may act on alerts or access protected email data without internal authorization. The accountable executive now asks the team to specify expected outcomes and service boundaries. What should the security manager recommend?
- Document detection scope, response authority, data access and escalation timing
- Review fourth-party access, assurance and contract obligations
- Define escalation paths, evidence formats and accountability handoffs
- Track missed detections, actionable alert timing and response quality
Explanation
Correct Answer
A:Outsourcing needs precise boundaries. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Provider changes can change the firm's risk. That action primarily serves the different objective to reassess after the provider changes its analysis subcontractor. It is not the step that directly satisfies the stated need to specify expected outcomes and service boundaries.
C:Alerts without ownership can be lost. That action primarily serves the different objective to integrate provider alerts into internal decisions. It is not the step that directly satisfies the stated need to specify expected outcomes and service boundaries.
D:Service-level compliance should reflect outcomes. That action primarily serves the different objective to measure service performance after go-live. It is not the step that directly satisfies the stated need to specify expected outcomes and service boundaries.
Question 68
A retail firm has standard operating procedures for patching, but teams say the policy gives no decision thresholds. After reviewing the situation, the management objective is to establish the enterprise's patch risk policy. Which response MOST directly addresses it?
- Define mandatory risk-based remediation objectives approved by management
- Record business approval, compensating controls and expiry dates
- Introduce emergency escalation criteria based on exposure and impact
- Sample patch records and validate deployed versions on critical systems
Explanation
Correct Answer
A:Policy should state required outcomes. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:A waiver must be governed. That action primarily serves the different objective to manage exemptions for unsupported applications. It is not the step that directly satisfies the stated need to establish the enterprise's patch risk policy.
C:Risk changes justify policy review. That action primarily serves the different objective to revise rules when actively exploited vulnerabilities surge. It is not the step that directly satisfies the stated need to establish the enterprise's patch risk policy.
D:A checklist is not technical evidence. That action primarily serves the different objective to test whether procedures are followed. It is not the step that directly satisfies the stated need to establish the enterprise's patch risk policy.
Question 69
A cloud software startup reports high test coverage but repeated access-control vulnerabilities reach production. For the next governance decision, the team must identify why existing tests miss authorization flaws. Which choice BEST provides that outcome?
- Track similar auth defects and unauthorized-access signals by service
- Review negative authorization cases across tenant and user boundaries
- Retest the previously exploitable authorization paths in a staging environment
- Tie confirmed findings to product owners and release deadlines
Explanation
Correct Answer
B:Code coverage does not prove security cases. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Repeated patterns reveal a systematic weakness. That action primarily serves the different objective to monitor post-release recurrence. It is not the step that directly satisfies the stated need to identify why existing tests miss authorization flaws.
C:A reviewed patch may still fail. That action primarily serves the different objective to verify fixes without trusting code review alone. It is not the step that directly satisfies the stated need to identify why existing tests miss authorization flaws.
D:Findings need accountable action. That action primarily serves the different objective to assign responsibility for remediation. It is not the step that directly satisfies the stated need to identify why existing tests miss authorization flaws.
Question 70
An e-commerce company's board wants proof its security investment is reducing account takeover risk. The security program has been tasked specifically to establish an outcome-focused metric. Which approach should be selected?
- Reconcile fraud reports, detection changes and help desk outcomes
- Measure confirmed takeover incidence and effective account recovery trends
- Present residual risk, control gaps and planned investments in business terms
- Update event definitions and data collection to include new authentication paths
Explanation
Correct Answer
B:Spending is an input rather than the goal. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Changes in measurement can mimic improvement. That action primarily serves the different objective to validate that declines are not reporting artifacts. It is not the step that directly satisfies the stated need to establish an outcome-focused metric.
C:The board governs exposure not tooling details. That action primarily serves the different objective to report remaining exposure to the board. It is not the step that directly satisfies the stated need to establish an outcome-focused metric.
D:Metrics need stable meaning across architecture changes. That action primarily serves the different objective to adapt the metric after new login methods are introduced. It is not the step that directly satisfies the stated need to establish an outcome-focused metric.
