Isaca CISM Practice Test 8
Question 70
An e-commerce company's board wants proof its security investment is reducing account takeover risk. The security program has been tasked specifically to establish an outcome-focused metric. Which approach should be selected?
- Reconcile fraud reports, detection changes and help desk outcomes
- Measure confirmed takeover incidence and effective account recovery trends
- Present residual risk, control gaps and planned investments in business terms
- Update event definitions and data collection to include new authentication paths
Explanation
Correct Answer
B:Spending is an input rather than the goal. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Changes in measurement can mimic improvement. That action primarily serves the different objective to validate that declines are not reporting artifacts. It is not the step that directly satisfies the stated need to establish an outcome-focused metric.
C:The board governs exposure not tooling details. That action primarily serves the different objective to report remaining exposure to the board. It is not the step that directly satisfies the stated need to establish an outcome-focused metric.
D:Metrics need stable meaning across architecture changes. That action primarily serves the different objective to adapt the metric after new login methods are introduced. It is not the step that directly satisfies the stated need to establish an outcome-focused metric.
Question 71
An insurer is adopting confidential computing for sensitive actuarial models. A security manager has a defined assignment: assess whether the technology addresses a defined threat. Which action BEST fulfills that specific assignment?
- Track attestation failures, platform updates and exception decisions
- Evaluate data-in-use risks and alternative protections with asset owners
- Review contractual exit, patching and emergency support arrangements
- Verify attestation decisions and rejected untrusted workloads in a controlled environment
Explanation
Correct Answer
B:Technology choice should follow a threat model. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Protection can degrade with configuration drift. That action primarily serves the different objective to monitor whether the architecture stays effective. It is not the step that directly satisfies the stated need to assess whether the technology addresses a defined threat.
C:New technology can introduce concentration risk. That action primarily serves the different objective to manage dependencies on a specialized platform vendor. It is not the step that directly satisfies the stated need to assess whether the technology addresses a defined threat.
D:Vendor claims do not replace evidence. That action primarily serves the different objective to test that protected execution works as intended. It is not the step that directly satisfies the stated need to assess whether the technology addresses a defined threat.
Question 72
A regional hospital has a ransomware playbook but has never exercised it with clinical leaders. The documented playbook has never been rehearsed with physicians, patient-safety leaders or operational decision makers. The accountable executive now asks the team to select a realistic readiness exercise. What should the security manager recommend?
- Establish a joint incident command structure with clinical and security leadership
- Update playbook steps, training and decision thresholds based on observed weaknesses
- Run only an overnight call-tree drill and treat successful contact as proof that clinical ransomware readiness was exercised
- Run a tabletop involving clinical downtime, executive decisions and response handoffs
Explanation
Correct Answer
D:Scenario discussion exposes governance gaps without endangering patients. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Response authority cannot be improvised in a crisis. That action primarily serves the different objective to clarify who directs clinical and cyber response. It is not the step that directly satisfies the stated need to select a realistic readiness exercise.
B:Exercises should drive measurable improvement. That action primarily serves the different objective to use lessons to improve operational readiness. It is not the step that directly satisfies the stated need to select a realistic readiness exercise.
C:A call-tree drill tests reachability but omits clinical downtime, executive decisions and response handoffs. The first realistic exercise should engage these stakeholders in the ransomware scenario.
Question 73
A manufacturer receives alerts suggesting malware on an isolated engineering workstation. The suspicious alert has not been corroborated and operations has asked whether formal incident classification is required. After reviewing the situation, the management objective is to determine whether the event is a security incident. Which response MOST directly addresses it?
- Return the workstation to service when antivirus alerts cease, before confirming whether the observed activity was malicious
- Use classification and escalation thresholds to activate the appropriate response team
- Isolate affected paths through approved safety-aware containment
- Correlate credible telemetry and asset impact before classifying severity
Explanation
Correct Answer
D:An alert alone is not a confirmed incident. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:The event has not been classified. Alert cessation cannot replace correlating telemetry, authorized actions and business impact to establish whether an incident occurred.
B:Notifications should follow the incident criteria. That action primarily serves the different objective to decide who should be notified internally. It is not the step that directly satisfies the stated need to determine whether the event is a security incident.
C:Containment must balance security and operational safety. That action primarily serves the different objective to limit possible spread without halting the factory. It is not the step that directly satisfies the stated need to determine whether the event is a security incident.
Question 74
A bank discovers signs that a privileged administrator account was used outside approved working hours. For the next governance decision, the team must verify suspicious activity before assuming malicious intent. Which choice BEST provides that outcome?
- Correlate privileged session logs, approvals and the operator's work record
- Secure authentication records and privileged action history with chain of custody
- Assess systems touched, potential data exposure and verified misuse against classification criteria
- Review session controls and strengthen just-in-time privileges after root-cause analysis
Explanation
Correct Answer
A:Context is required to evaluate an anomaly. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
B:Investigators need intact records. That action primarily serves the different objective to preserve investigative material. It is not the step that directly satisfies the stated need to verify suspicious activity before assuming malicious intent.
C:Severity depends on business consequence. That action primarily serves the different objective to decide whether the event triggers higher-severity escalation. It is not the step that directly satisfies the stated need to verify suspicious activity before assuming malicious intent.
D:Prevention should address the exploited path. That action primarily serves the different objective to reduce future privileged account misuse. It is not the step that directly satisfies the stated need to verify suspicious activity before assuming malicious intent.
Question 75
A national retailer receives conflicting severity ratings for similar security events in different stores. The security program has been tasked specifically to define consistent incident categorization criteria. Which approach should be selected?
- Sample incident records and compare severity decisions with policy
- Review evidence and change criteria through formal response governance
- Set business impact, affected data and service criticality thresholds
- Use the agreed severity criteria and current business impacts for triage
Explanation
Correct Answer
C:Uniform criteria support comparable escalation. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:A document alone does not prove consistent classification. That action primarily serves the different objective to check whether stores use the classification correctly. It is not the step that directly satisfies the stated need to define consistent incident categorization criteria.
B:Lessons can expose inadequate thresholds. That action primarily serves the different objective to adjust thresholds after a near-miss. It is not the step that directly satisfies the stated need to define consistent incident categorization criteria.
D:Resources should follow verified harm. That action primarily serves the different objective to prioritize response resources during a widespread campaign. It is not the step that directly satisfies the stated need to define consistent incident categorization criteria.
Question 76
An airline needs to plan recovery of reservation and baggage systems after a regional data-center loss. A security manager has a defined assignment: identify which services are business-critical. Which action BEST fulfills that specific assignment?
- Exercise the service dependencies and measure actual restoration against objectives
- Conduct a business impact analysis with booking, airport and operations owners
- Document identity, networks, suppliers and upstream data needed by the services
- Evaluate alternatives against the approved objectives and cost constraints
Explanation
Correct Answer
B:BIA ranks business consequences. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Architecture claims need operating proof. That action primarily serves the different objective to validate the recovery approach. It is not the step that directly satisfies the stated need to identify which services are business-critical.
C:A recovered application may still be unusable. That action primarily serves the different objective to map dependencies that could block recovery. It is not the step that directly satisfies the stated need to identify which services are business-critical.
D:Technical recovery should meet business targets. That action primarily serves the different objective to choose appropriate recovery architecture. It is not the step that directly satisfies the stated need to identify which services are business-critical.
Question 77
A bank's continuity plan assumes backups will restore online banking within two hours, but no full restore has been tested. The accountable executive now asks the team to identify a critical gap in readiness evidence. What should the security manager recommend?
- Compare actual recovery time and recoverable data against approved RTO and RPO
- Record the untested recovery assumption as a material continuity risk
- Escalate the shortfall and fund changes with accountable owners
- Repeat the failed restoration conditions and capture completion evidence
Explanation
Correct Answer
B:Untested targets are not validated capability. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Metrics should reflect business needs. That action primarily serves the different objective to define how test success will be measured. It is not the step that directly satisfies the stated need to identify a critical gap in readiness evidence.
C:Unmet targets create residual risk. That action primarily serves the different objective to respond when the test exceeds its recovery target. It is not the step that directly satisfies the stated need to identify a critical gap in readiness evidence.
D:Follow-up confirms effectiveness. That action primarily serves the different objective to revalidate after remediation. It is not the step that directly satisfies the stated need to identify a critical gap in readiness evidence.
Question 78
A food distributor has a business continuity plan for warehouse outages but not disruption of cloud scheduling. After reviewing the situation, the management objective is to identify missing critical dependencies. Which response MOST directly addresses it?
- Correct dependency, communications and staffing gaps and retest
- Define who declares disruption and starts alternate procedures
- Update the BIA and dependency map to include cloud scheduling and logistics partners
- Exercise dispatch personnel and vendor handoffs during a simulation
Explanation
Correct Answer
C:Continuity scope follows actual operations. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Exercise evidence should drive revisions. That action primarily serves the different objective to improve the plan following a failed exercise. It is not the step that directly satisfies the stated need to identify missing critical dependencies.
B:Delayed decisions can extend downtime. That action primarily serves the different objective to assign activation authority. It is not the step that directly satisfies the stated need to identify missing critical dependencies.
D:A plan unread by staff is ineffective. That action primarily serves the different objective to train staff on the alternate workflow. It is not the step that directly satisfies the stated need to identify missing critical dependencies.
Question 79
A university has copied data to a second region but disaster recovery tests fail because identity services are unavailable. The failed recovery drill did not establish which supporting authentication dependencies caused the outage; the design gap has not yet been diagnosed or corrected. For the next governance decision, the team must identify why the recovery design fails. Which choice BEST provides that outcome?
- Time the integrated service test and compare to approved recovery objectives
- Update runbooks, owner actions and architecture, then retest
- Analyze authentication and dependent service requirements in the recovery path
- Document the ordered restoration of core dependencies before applications
Explanation
Correct Answer
C:Data replicas alone cannot restore access. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:DR must meet business commitments. That action primarily serves the different objective to measure actual recovery against commitments. It is not the step that directly satisfies the stated need to identify why the recovery design fails.
B:Repeated test failures need structural correction. That action primarily serves the different objective to correct the plan after testing reveals gaps. It is not the step that directly satisfies the stated need to identify why the recovery design fails.
D:Correct sequencing prevents circular failures. That action primarily serves the different objective to define recovery sequencing. It is not the step that directly satisfies the stated need to identify why the recovery design fails.
Question 80
A software vendor's incident response plan has a generic contact list but unclear decision authority during a breach. The security program has been tasked specifically to define incident command responsibilities. Which approach should be selected?
- Document containment options, approvals and dependencies by scenario
- Assign incident commander, legal, operations and business decision roles
- Review the plan after organizational and supplier changes
- Run an exercise with out-of-hours contact and approval paths
Explanation
Correct Answer
B:Clear authority reduces confusion. This is the specified management outcome in the scenario; it gives the accountable team an action matched to the stated requirement.
Incorrect Answers
A:Teams need executable decisions. That action primarily serves the different objective to create decision-ready action playbooks. It is not the step that directly satisfies the stated need to define incident command responsibilities.
C:Roles and contacts can quickly become obsolete. That action primarily serves the different objective to maintain the response plan as the firm changes. It is not the step that directly satisfies the stated need to define incident command responsibilities.
D:Contacts may fail under realistic conditions. That action primarily serves the different objective to test communication during simulated escalation. It is not the step that directly satisfies the stated need to define incident command responsibilities.
