100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 1
A multinational launches a new digital business model without a common security mandate. Which management approach best satisfies the primary requirement?
- Establish a board-endorsed security governance charter aligned with enterprise objectives
- Establish documented board review and decisions on material cyber exposure and treatment priorities
- Assess defined security governance and management capabilities against an agreed maturity model
- Define assurance objectives based on business-critical risks and decision-maker needs
Explanation
Correct Answer
A:Governance defines who makes security decisions and how those decisions support business value.
Incorrect Answers
B:Board accountability must be evidenced in decisions, not just slide presentations. However, it does not make the decision needed for aligning security decision authority to business strategy in this scenario.
C:Tools owned do not measure how reliably processes deliver outcomes. However, it does not make the decision needed for aligning security decision authority to business strategy in this scenario.
D:Certification can support assurance but does not replace risk understanding. However, it does not make the decision needed for aligning security decision authority to business strategy in this scenario.
Question 2
A multinational launches a new digital business model without a common security mandate. Which concrete action would best operationalize the needed approach?
- Secure executive sponsorship and document decision rights, escalation paths, and reporting cadence
- Prepare a risk decision brief with residual exposure, business impact, alternatives, and authority
- Approve terms of reference that define quorum, escalation, voting authority, and representation
- Document the RACI for key custody, data ownership, control operations, and risk acceptance
Explanation
Correct Answer
A:An approved charter makes accountability and authority explicit across units.
Incorrect Answers
B:Decision-makers need a defensible basis for accepting or treating risk. That could support separating security advice from business risk acceptance, but it does not implement the requested aligning security decision authority to business strategy.
C:A named forum without decision rights does not govern tradeoffs. That could support establishing cross-functional security oversight, but it does not implement the requested aligning security decision authority to business strategy.
D:A role matrix clarifies who can decide and who can implement. That could support distinguishing control operation from risk ownership, but it does not implement the requested aligning security decision authority to business strategy.
Question 3
A multinational launches a new digital business model without a common security mandate. Which evidence best demonstrates the intended business and security outcome?
- Verify executives can identify the risk owner, policy authority, and escalation route for a cross-border decision
- Verify an assurance report discloses scope exclusions and material open findings
- Test whether a departing volunteer's access exception reaches an authorized owner
- Follow one customer interaction and verify the intended data residency, access, and deletion outcomes
Explanation
Correct Answer
A:An accountability test demonstrates that the charter is usable rather than merely published.
Incorrect Answers
B:Stakeholders must understand what was and was not tested. This provides evidence for connecting control assurance to governance outcomes, not proof of aligning security decision authority to business strategy.
C:Practical checks reveal role gaps. This provides evidence for assigning sustainable security governance in a resource-constrained enterprise, not proof of aligning security decision authority to business strategy.
D:End-to-end tracing tests architectural assumptions. This provides evidence for integrating information architecture and data lifecycle governance, not proof of aligning security decision authority to business strategy.
Question 4
A multinational launches a new digital business model without a common security mandate. Which recurring management review most directly addresses future drift?
- Review role assignments when the operating model or shared service contract changes
- Review charter effectiveness after changes in business strategy, ownership, and regulatory footprint
- Reassess asset criticality as product lines, data use and ownership change
- Refresh metrics when service models or assurance coverage changes across subsidiaries
Explanation
Correct Answer
B:Governance authority must evolve with the enterprise it serves.
Incorrect Answers
A:Responsibility boundaries can shift without explicit governance. It may help maintain distinguishing control operation from risk ownership, whereas the stated continuing risk concerns aligning security decision authority to business strategy.
C:Security design priorities should follow business changes. It may help maintain defining protection priorities before architecture tooling, whereas the stated continuing risk concerns aligning security decision authority to business strategy.
D:Comparability can degrade after reorganizations. It may help maintain establishing comparable group security reporting, whereas the stated continuing risk concerns aligning security decision authority to business strategy.
Question 5
A regional subsidiary requests a security exception that could expose the group's central customer platform. Which decision should the information security manager prioritize?
- Show risk reduction and business enablement in terms of stakeholder value and risk appetite
- Let the subsidiary approve its own exception without evaluating exposure to the shared enterprise platform
- Assign residency decisions to designated accountable owners with legal and privacy review
- Escalate the exception to the designated enterprise risk owner under the approved risk appetite
Explanation
Correct Answer
D:A local business unit cannot unilaterally accept exposure borne by the wider enterprise.
Incorrect Answers
A:Executive funding needs exposure, alternatives, and business consequences. However, it does not make the decision needed for resolving subsidiary and enterprise accountability in this scenario.
B:The subsidiary cannot accept group-wide exposure on behalf of other affected business units; the enterprise-level risk owner must decide under approved appetite.
C:Jurisdictional restrictions require governed decisions rather than unilateral technical workarounds. However, it does not make the decision needed for resolving subsidiary and enterprise accountability in this scenario.
Question 6
A regional subsidiary requests a security exception that could expose the group's central customer platform. During implementation, which action most directly executes the necessary response?
- Define the prompt, output, training, and audit data lifecycles with accountable information owners
- Document the affected group assets and seek a time-bound decision from the appropriate accountable owner
- Document the RACI for key custody, data ownership, control operations, and risk acceptance
- Prepare a risk decision brief with residual exposure, business impact, alternatives, and authority
Explanation
Correct Answer
B:Decision documentation keeps local operations from bypassing central risk authority.
Incorrect Answers
A:Lifecycle diagrams reveal hidden retention and reuse risks. That could support integrating information architecture and data lifecycle governance, but it does not implement the requested resolving subsidiary and enterprise accountability.
C:A role matrix clarifies who can decide and who can implement. That could support distinguishing control operation from risk ownership, but it does not implement the requested resolving subsidiary and enterprise accountability.
D:Decision-makers need a defensible basis for accepting or treating risk. That could support separating security advice from business risk acceptance, but it does not implement the requested resolving subsidiary and enterprise accountability.
Question 7
A regional subsidiary requests a security exception that could expose the group's central customer platform. What would provide the strongest practical verification of this requirement?
- Confirm the decision record states ownership, enterprise impact, expiry date, and mitigating conditions
- Confirm a proposed transfer is blocked or escalated until all required approvals exist
- Test a critical processing obligation against the vendor evidence and record exceptions
- Confirm business stakeholders can demonstrate key decisions and evidence under the tailored processes
Explanation
Correct Answer
A:Approval without scope and conditions is not auditable risk acceptance.
Incorrect Answers
B:This tests the decision boundary rather than just storage configuration. This provides evidence for governing data residency exception authority, not proof of resolving subsidiary and enterprise accountability.
C:Actual outcome evidence is stronger than a certification label. This provides evidence for governing equivalence of external control frameworks, not proof of resolving subsidiary and enterprise accountability.
D:Working practices matter more than a completed compliance matrix. This provides evidence for selecting a governance framework appropriate to business context, not proof of resolving subsidiary and enterprise accountability.
Question 8
A regional subsidiary requests a security exception that could expose the group's central customer platform. Which follow-up is most relevant as the environment changes?
- Revisit accepted risk when threats, controls, or the organization's tolerance change
- Report accepted exposure as conditions and assumptions change
- Review temporary OT exceptions at planned safety and maintenance cycles
- Reassess cross-entity exceptions when corporate structure or shared-service dependencies change
Explanation
Correct Answer
D:Shared exposure can outlive the subsidiary decision that created it.
Incorrect Answers
A:Residual exposure is a living management decision. It may help maintain setting realistic executive expectations on residual risk, whereas the stated continuing risk concerns resolving subsidiary and enterprise accountability.
B:Risk ownership persists after a one-time acceptance. It may help maintain separating security advice from business risk acceptance, whereas the stated continuing risk concerns resolving subsidiary and enterprise accountability.
C:Unreviewed exceptions can become permanent exposure. It may help maintain aligning OT architecture controls with safety governance, whereas the stated continuing risk concerns resolving subsidiary and enterprise accountability.
Question 9
A security director inherits conflicting policies after the acquisition of several companies. Which management decision most directly addresses the stated business need?
- Establish documented board review and decisions on material cyber exposure and treatment priorities
- Develop a security strategy based on business expansion risks, capabilities, and tolerance for disruption
- Have business information owners classify critical assets and associated trust requirements
- Create an enterprise policy hierarchy that allows documented jurisdiction-specific requirements
Explanation
Correct Answer
D:Common principles can coexist with mandatory local legal and contractual obligations.
Incorrect Answers
A:Board accountability must be evidenced in decisions, not just slide presentations. However, it does not make the decision needed for harmonizing governance without erasing legal duties in this scenario.
B:Security strategy should enable growth while addressing the risks that growth creates. However, it does not make the decision needed for harmonizing governance without erasing legal duties in this scenario.
C:Architecture must protect business value and sensitive flows, not an undefined inventory. However, it does not make the decision needed for harmonizing governance without erasing legal duties in this scenario.
Question 10
A security director inherits conflicting policies after the acquisition of several companies. Which implementation step best translates the requirement into an operating control?
- Map inherited policies to enterprise requirements and record approved local deviations
- Map production trust zones, change windows, and approved compensating controls with engineering owners
- Map retrieval sources, identity propagation, data classes, and record retention obligations
- Document mapped governance processes, owners, and local compliance overlays before rollout
Explanation
Correct Answer
A:A traceable crosswalk prevents gaps during policy consolidation.
Incorrect Answers
B:An integrated design avoids unsafe generic IT control mandates. That could support aligning OT architecture controls with safety governance, but it does not implement the requested harmonizing governance without erasing legal duties.
C:A documented architecture clarifies which users and services can access each dataset. That could support governing enterprise AI access through information architecture, but it does not implement the requested harmonizing governance without erasing legal duties.
D:Tailoring clarifies how abstract framework requirements operate here. That could support selecting a governance framework appropriate to business context, but it does not implement the requested harmonizing governance without erasing legal duties.
Certified Information Security Manager (CISM) Practice Tests
