100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 160
A new vulnerability is reported in a minor lab server and a critical internet-facing transaction gateway. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Refresh asset records through onboarding, procurement, and decommissioning events
- Monitor downstream provider changes and risk indicators during contract operation
- Update the model after near-misses, insurance studies, or site changes
- Reprioritize when exploitation evidence or asset criticality changes
Explanation
Correct Answer
D:A static severity list can become misleading quickly.
Incorrect Answers
A:Periodic inventory sweeps alone miss rapid changes. It may help maintain using asset ownership to support risk assessment, whereas the stated continuing risk concerns prioritizing vulnerabilities by enterprise exposure.
B:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns prioritizing vulnerabilities by enterprise exposure.
C:New data should refine the estimate. It may help maintain representing uncertainty in risk estimates, whereas the stated continuing risk concerns prioritizing vulnerabilities by enterprise exposure.
Question 161
An executive proposes buying cyber insurance to replace all monitoring and recovery controls. Which management approach best satisfies the primary requirement?
- Retain the current risk rating until a meaningful recovery test provides evidence of treatment effectiveness
- Evaluate liability, accountability, and residual exposure before treating outsourcing as risk transfer
- Set group-level risk appetite boundaries while allowing controlled local tolerances
- Treat insurance as partial financial risk transfer while retaining preventive and recovery responsibilities
Explanation
Correct Answer
D:Insurance does not prevent incidents or transfer operational accountability.
Incorrect Answers
A:A planned exercise is not proof of restored service. However, it does not make the decision needed for understanding the limitations of risk transfer in this scenario.
B:Contracting out processing rarely eliminates regulatory or reputational consequences. However, it does not make the decision needed for understanding the limitations of risk transfer in this scenario.
C:Decentralization cannot permit unacceptable aggregated exposure. However, it does not make the decision needed for understanding the limitations of risk transfer in this scenario.
Question 162
An executive proposes buying cyber insurance to replace all monitoring and recovery controls. Which concrete action would best operationalize the needed approach?
- Track dated milestones, evidence requirements, and interim protections with the accountable owner
- Record the accepting owner, residual exposure, controls, expiry date, and review trigger
- Review policy coverage, exclusions, deductibles, and control obligations with the risk owner
- Review key administration, logging, access restrictions, contractual obligations, and recovery responsibility
Explanation
Correct Answer
C:Residual operational loss may remain even when some costs are insured.
Incorrect Answers
A:A management plan must remain measurable. That could support requiring treatment verification before risk closure, but it does not implement the requested understanding the limitations of risk transfer.
B:Conditions make the decision enforceable and reviewable. That could support making risk acceptance a managed decision, but it does not implement the requested understanding the limitations of risk transfer.
D:Key custody details determine practical exposure. That could support evaluating key custody as a third-party risk, but it does not implement the requested understanding the limitations of risk transfer.
Question 163
An executive proposes buying cyber insurance to replace all monitoring and recovery controls. Which evidence best demonstrates the intended business and security outcome?
- Choose a nontechnical failure scenario and verify it appears in the consolidated risk assessment
- Test a proposed regional acceptance that exceeds group tolerance and confirm escalation
- Use a tabletop or red-team exercise to test key decision and detection assumptions
- Test a realistic outage scenario against the policy and continuity requirements
Explanation
Correct Answer
D:The review reveals uninsured consequences and recovery gaps.
Incorrect Answers
A:A representative test validates coverage beyond scanning. This provides evidence for recognizing limits of evidence and assessment coverage, not proof of understanding the limitations of risk transfer.
B:A boundary test shows hierarchy is respected. This provides evidence for ensuring subsidiary tolerances remain within enterprise appetite, not proof of understanding the limitations of risk transfer.
C:Controlled evidence informs risk estimates without claiming certainty. This provides evidence for evaluating emerging threats under uncertainty, not proof of understanding the limitations of risk transfer.
Question 164
An executive proposes buying cyber insurance to replace all monitoring and recovery controls. Which recurring management review most directly addresses future drift?
- Monitor downstream provider changes and risk indicators during contract operation
- Reassess coverage after business growth and threat changes
- Escalate missed patch milestones and reassess emerging exploitation evidence
- Update the model after near-misses, insurance studies, or site changes
Explanation
Correct Answer
B:Insurance limits and exclusions can become inadequate.
Incorrect Answers
A:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns understanding the limitations of risk transfer.
C:Temporary plans need firm review triggers. It may help maintain handling temporary risk within operational constraints, whereas the stated continuing risk concerns understanding the limitations of risk transfer.
D:New data should refine the estimate. It may help maintain representing uncertainty in risk estimates, whereas the stated continuing risk concerns understanding the limitations of risk transfer.
Question 165
A cloud service contract holds a provider responsible for platform security, but customers configure identity permissions. Which decision should the information security manager prioritize?
- Complement automated findings with business process, supplier, identity, and architecture risk analysis
- Assess threat pathways and business impact before selecting the control portfolio
- Assess net residual business risk and service consequences before approving the control
- Assess customer-owned identity and data controls separately from provider platform obligations
Explanation
Correct Answer
D:Vendor security claims do not remove customer configuration risk.
Incorrect Answers
A:Vulnerability tools expose only part of enterprise information risk. However, it does not make the decision needed for allocating shared-responsibility risk accurately in this scenario.
B:A collection of popular controls may miss the largest risks. However, it does not make the decision needed for allocating shared-responsibility risk accurately in this scenario.
C:Effective treatment must address both security exposure and operational harm. However, it does not make the decision needed for allocating shared-responsibility risk accurately in this scenario.
Question 166
A cloud service contract holds a provider responsible for platform security, but customers configure identity permissions. During implementation, which action most directly executes the necessary response?
- Document assumptions, plausible loss bands, frequency, and critical dependencies
- Map responsibilities and supporting evidence for each critical shared cloud control
- Separate current-state and target-state risk assessments with evidence and milestones
- Compare findings, remediation evidence, contract criticality, and compensating controls
Explanation
Correct Answer
B:A control matrix avoids assuming the provider operates everything.
Incorrect Answers
A:Transparent estimates let owners judge confidence. That could support representing uncertainty in risk estimates, but it does not implement the requested allocating shared-responsibility risk accurately.
C:Two views prevent premature risk reduction claims. That could support distinguishing planned controls from effective controls, but it does not implement the requested allocating shared-responsibility risk accurately.
D:A reconciled evidence record supports an honest rating. That could support reconciling conflicting third-party risk evidence, but it does not implement the requested allocating shared-responsibility risk accurately.
Question 167
A cloud service contract holds a provider responsible for platform security, but customers configure identity permissions. What would provide the strongest practical verification of this requirement?
- Test a misconfigured customer role against the contractual responsibility map
- Use a tabletop or red-team exercise to test key decision and detection assumptions
- Validate compensating controls against unauthorized access attempts and confirm approval authority
- Compare business impact and reduced exposure against the risk owner's agreed decision criteria
Explanation
Correct Answer
A:Ownership clarity informs effective treatment.
Incorrect Answers
B:Controlled evidence informs risk estimates without claiming certainty. This provides evidence for evaluating emerging threats under uncertainty, not proof of allocating shared-responsibility risk accurately.
C:Evidence is needed before accepting an exception. This provides evidence for evaluating compensating controls for a documented exception, not proof of allocating shared-responsibility risk accurately.
D:The final choice should reflect enterprise value. This provides evidence for balancing security response and business impacts, not proof of allocating shared-responsibility risk accurately.
Question 168
A cloud service contract holds a provider responsible for platform security, but customers configure identity permissions. Which follow-up is most relevant as the environment changes?
- Review responsibility changes after adopting new cloud services or features
- Monitor downstream provider changes and risk indicators during contract operation
- Update the model after near-misses, insurance studies, or site changes
- Reevaluate treatment economics when threat likelihood or control cost changes
Explanation
Correct Answer
A:The division can differ across cloud products.
Incorrect Answers
B:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns allocating shared-responsibility risk accurately.
C:New data should refine the estimate. It may help maintain representing uncertainty in risk estimates, whereas the stated continuing risk concerns allocating shared-responsibility risk accurately.
D:A once-rational response may cease to be proportionate. It may help maintain applying a cost-aware risk treatment process, whereas the stated continuing risk concerns allocating shared-responsibility risk accurately.
Question 169
A critical supplier has a clean questionnaire but refuses any evidence about subcontractor access. Which management decision most directly addresses the stated business need?
- Rate current residual risk using implemented and operating controls, not planned purchases
- Evaluate liability, accountability, and residual exposure before treating outsourcing as risk transfer
- Establish an owner-led information asset inventory and classification process as a risk-assessment foundation
- Escalate the evidence gap as residual third-party risk to the accountable service owner
Explanation
Correct Answer
D:Questionnaire completion is not proof of subcontractor control.
Incorrect Answers
A:A future capability cannot yet reduce present exposure. However, it does not make the decision needed for assessing fourth-party and supply-chain concentration risk in this scenario.
B:Contracting out processing rarely eliminates regulatory or reputational consequences. However, it does not make the decision needed for assessing fourth-party and supply-chain concentration risk in this scenario.
C:Unknown data and systems prevent complete exposure assessment. However, it does not make the decision needed for assessing fourth-party and supply-chain concentration risk in this scenario.
Question 170
A critical supplier has a clean questionnaire but refuses any evidence about subcontractor access. Which implementation step best translates the requirement into an operating control?
- Map critical contracts to underlying cloud, telecom, and processing dependencies
- Request proportionate assurance or contractual rights over material downstream processing
- Assign business data owners and map processing locations, integrations, and classifications
- Review key administration, logging, access restrictions, contractual obligations, and recovery responsibility
Explanation
Correct Answer
B:Controls must follow critical information beyond the first provider.
Incorrect Answers
A:Dependency relationships reveal hidden common points. That could support capturing aggregate supplier concentration, but it does not implement the requested assessing fourth-party and supply-chain concentration risk.
C:A current map supports targeted controls and impact analysis. That could support using asset ownership to support risk assessment, but it does not implement the requested assessing fourth-party and supply-chain concentration risk.
D:Key custody details determine practical exposure. That could support evaluating key custody as a third-party risk, but it does not implement the requested assessing fourth-party and supply-chain concentration risk.
Certified Information Security Manager (CISM) Practice Tests
