100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 150
A manufacturing plant faces a credible ransomware threat but cannot stop continuous production for invasive scanning. During implementation, which action most directly executes the necessary response?
- Combine the vulnerability intelligence with asset ownership, internet reachability, and compensating controls
- Use credible worst-case business impact analysis with documented likelihood assumptions
- Calibrate rating criteria using representative incidents and business outcomes
- Coordinate asset and threat analysis with plant engineering, using approved nonintrusive discovery
Explanation
Correct Answer
D:Joint analysis can reveal exposure without unsafe active probing.
Incorrect Answers
A:Context turns a technical finding into a business risk. That could support prioritizing vulnerabilities by enterprise exposure, but it does not implement the requested assessing risk when testing could interrupt operations.
B:Scenario analysis captures material tail risk. That could support considering low-frequency catastrophic impact, but it does not implement the requested assessing risk when testing could interrupt operations.
C:Examples reduce inconsistent use of scales. That could support creating consistent enterprise risk criteria, but it does not implement the requested assessing risk when testing could interrupt operations.
Question 151
A manufacturing plant faces a credible ransomware threat but cannot stop continuous production for invasive scanning. What would provide the strongest practical verification of this requirement?
- Choose a risk and confirm the owner can articulate consequences and intended response
- Confirm critical process owners agree on impact scenarios and the remaining evidence limitations
- Review the estimate with business continuity and finance owners for sensitivity to key assumptions
- Verify the prioritized control set demonstrably reduces the key business loss scenarios
Explanation
Correct Answer
B:Assumptions should be visible rather than silently treated as facts.
Incorrect Answers
A:Business understanding validates the risk record. This provides evidence for linking risk findings to business impact, not proof of assessing risk when testing could interrupt operations.
C:A sensitivity check exposes fragile conclusions. This provides evidence for representing uncertainty in risk estimates, not proof of assessing risk when testing could interrupt operations.
D:The review should test treatment coverage, not purchase count. This provides evidence for selecting risk treatments from business scenarios, not proof of assessing risk when testing could interrupt operations.
Question 152
A manufacturing plant faces a credible ransomware threat but cannot stop continuous production for invasive scanning. Which follow-up is most relevant as the environment changes?
- Monitor vendor financial, control, and legal changes affecting residual risk
- Review production service quality and residual threat indicators after rollout
- Review threat and exposure assumptions after maintenance windows and network changes
- Reassess assumptions when dependencies, geography, or recovery capabilities change
Explanation
Correct Answer
C:Previously unavailable evidence may become safely collectible.
Incorrect Answers
A:Transferred functions still require risk management. It may help maintain distinguishing operational outsourcing from risk transfer, whereas the stated continuing risk concerns assessing risk when testing could interrupt operations.
B:Control effectiveness can shift when usage changes. It may help maintain balancing security response and business impacts, whereas the stated continuing risk concerns assessing risk when testing could interrupt operations.
D:Severe-event exposures are sensitive to systemic shifts. It may help maintain considering low-frequency catastrophic impact, whereas the stated continuing risk concerns assessing risk when testing could interrupt operations.
Question 153
A bank needs to choose between two controls for a high-value transfer service with differing downtime and fraud consequences. Which management decision most directly addresses the stated business need?
- Approve common impact, likelihood, and escalation criteria before consolidating scores
- Assess net residual business risk and service consequences before approving the control
- Evaluate correlated failure and concentration risk at the shared provider level
- Evaluate residual fraud and availability risk for each option against approved risk criteria
Explanation
Correct Answer
D:A technology comparison without business impact does not justify selection.
Incorrect Answers
A:Numbers without shared definitions cannot be compared meaningfully. However, it does not make the decision needed for comparing risk treatments on business impact in this scenario.
B:Effective treatment must address both security exposure and operational harm. However, it does not make the decision needed for comparing risk treatments on business impact in this scenario.
C:Independent product risk scores can underestimate common dependencies. However, it does not make the decision needed for comparing risk treatments on business impact in this scenario.
Question 154
A bank needs to choose between two controls for a high-value transfer service with differing downtime and fraud consequences. Which implementation step best translates the requirement into an operating control?
- Estimate scenario frequency, plausible loss, control effect, and operational side effects for each option
- Map each candidate control to specific scenarios, residual impact, and implementation dependencies
- Document the selected frequency and magnitude inputs with uncertainty scenarios
- Map responsibilities and supporting evidence for each critical shared cloud control
Explanation
Correct Answer
A:Comparable assumptions clarify tradeoffs.
Incorrect Answers
B:Traceability prevents arbitrary purchases. That could support selecting risk treatments from business scenarios, but it does not implement the requested comparing risk treatments on business impact.
C:Known modeling limitations should be visible. That could support using quantitative risk estimates responsibly, but it does not implement the requested comparing risk treatments on business impact.
D:A control matrix avoids assuming the provider operates everything. That could support allocating shared-responsibility risk accurately, but it does not implement the requested comparing risk treatments on business impact.
Question 155
A bank needs to choose between two controls for a high-value transfer service with differing downtime and fraud consequences. Which validation best confirms the control meets the stated need?
- Present both residual-risk estimates and decision confidence to the service risk owner
- Choose a risk and confirm the owner can articulate consequences and intended response
- Use a tabletop or red-team exercise to test key decision and detection assumptions
- Verify the risk owner can explain why the changed likelihood affects the treatment choice
Explanation
Correct Answer
A:Accountable management should see uncertainty as well as numbers.
Incorrect Answers
B:Business understanding validates the risk record. This provides evidence for linking risk findings to business impact, not proof of comparing risk treatments on business impact.
C:Controlled evidence informs risk estimates without claiming certainty. This provides evidence for evaluating emerging threats under uncertainty, not proof of comparing risk treatments on business impact.
D:A documented decision links threat intelligence to action. This provides evidence for integrating active threat intelligence into risk treatment, not proof of comparing risk treatments on business impact.
Question 156
A bank needs to choose between two controls for a high-value transfer service with differing downtime and fraud consequences. What continuing control would best preserve the intended outcome?
- Update the risk estimate when actual fraud attempts or service outages differ from assumptions
- Reassess the service risk after major API dependencies or transaction volumes change
- Review ownership after changes in service sponsorship or outsourcing
- Reassess assumptions when dependencies, geography, or recovery capabilities change
Explanation
Correct Answer
A:Risk quantification requires calibration with evidence.
Incorrect Answers
B:Exposure can shift after the launch baseline is established. It may help maintain assessing material risk before a business launch, whereas the stated continuing risk concerns comparing risk treatments on business impact.
C:Control location and business accountability may diverge. It may help maintain identifying the correct information risk owner, whereas the stated continuing risk concerns comparing risk treatments on business impact.
D:Severe-event exposures are sensitive to systemic shifts. It may help maintain considering low-frequency catastrophic impact, whereas the stated continuing risk concerns comparing risk treatments on business impact.
Question 157
A new vulnerability is reported in a minor lab server and a critical internet-facing transaction gateway. What is the MOST appropriate first management decision for this situation?
- Prioritize treatment using exploitability, asset criticality, exposure, and business impact
- Assess threat pathways and business impact before selecting the control portfolio
- Evaluate liability, accountability, and residual exposure before treating outsourcing as risk transfer
- Establish an owner-led information asset inventory and classification process as a risk-assessment foundation
Explanation
Correct Answer
A:A severity score alone does not define the organization's priority.
Incorrect Answers
B:A collection of popular controls may miss the largest risks. However, it does not make the decision needed for prioritizing vulnerabilities by enterprise exposure in this scenario.
C:Contracting out processing rarely eliminates regulatory or reputational consequences. However, it does not make the decision needed for prioritizing vulnerabilities by enterprise exposure in this scenario.
D:Unknown data and systems prevent complete exposure assessment. However, it does not make the decision needed for prioritizing vulnerabilities by enterprise exposure in this scenario.
Question 158
A new vulnerability is reported in a minor lab server and a critical internet-facing transaction gateway. What should the manager arrange during rollout to meet this requirement?
- Compare findings, remediation evidence, contract criticality, and compensating controls
- Combine the vulnerability intelligence with asset ownership, internet reachability, and compensating controls
- Update scenario likelihood and existing defense evidence from relevant threat intelligence
- Link waivers to assessed scenarios, compensating controls, duration, and approving authority
Explanation
Correct Answer
B:Context turns a technical finding into a business risk.
Incorrect Answers
A:A reconciled evidence record supports an honest rating. That could support reconciling conflicting third-party risk evidence, but it does not implement the requested prioritizing vulnerabilities by enterprise exposure.
C:Evidence-driven estimates support reprioritization. That could support integrating active threat intelligence into risk treatment, but it does not implement the requested prioritizing vulnerabilities by enterprise exposure.
D:Explicit links protect against unauthorized risk transfer. That could support separating control waivers from approved risk decisions, but it does not implement the requested prioritizing vulnerabilities by enterprise exposure.
Question 159
A new vulnerability is reported in a minor lab server and a critical internet-facing transaction gateway. Which test most directly verifies the desired managerial outcome?
- Confirm the remediation queue protects the exposed transaction service first when warranted by evidence
- Confirm owners approve the selected treatment on the basis of risk and costs
- Present both residual-risk estimates and decision confidence to the service risk owner
- Choose a risk and confirm the owner can articulate consequences and intended response
Explanation
Correct Answer
A:Ranking should follow exposure rather than patch count.
Incorrect Answers
B:Approval requires more than a control recommendation. This provides evidence for applying a cost-aware risk treatment process, not proof of prioritizing vulnerabilities by enterprise exposure.
C:Accountable management should see uncertainty as well as numbers. This provides evidence for comparing risk treatments on business impact, not proof of prioritizing vulnerabilities by enterprise exposure.
D:Business understanding validates the risk record. This provides evidence for linking risk findings to business impact, not proof of prioritizing vulnerabilities by enterprise exposure.
Question 160
A new vulnerability is reported in a minor lab server and a critical internet-facing transaction gateway. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Refresh asset records through onboarding, procurement, and decommissioning events
- Monitor downstream provider changes and risk indicators during contract operation
- Update the model after near-misses, insurance studies, or site changes
- Reprioritize when exploitation evidence or asset criticality changes
Explanation
Correct Answer
D:A static severity list can become misleading quickly.
Incorrect Answers
A:Periodic inventory sweeps alone miss rapid changes. It may help maintain using asset ownership to support risk assessment, whereas the stated continuing risk concerns prioritizing vulnerabilities by enterprise exposure.
B:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns prioritizing vulnerabilities by enterprise exposure.
C:New data should refine the estimate. It may help maintain representing uncertainty in risk estimates, whereas the stated continuing risk concerns prioritizing vulnerabilities by enterprise exposure.
Certified Information Security Manager (CISM) Practice Tests
