100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 200
A financial institution's phishing exposure remains high despite widespread awareness training. Which follow-up is most relevant as the environment changes?
- Reassess after new attacker tactics or business communication patterns appear
- Reassess when actual industry attacks or internal signals change threat plausibility
- Escalate missed patch milestones and reassess emerging exploitation evidence
- Reassess assumptions when dependencies, geography, or recovery capabilities change
Explanation
Correct Answer
A:A static control mix can lose effectiveness.
Incorrect Answers
B:Emerging risk should respond to evidence. It may help maintain evaluating emerging threats under uncertainty, whereas the stated continuing risk concerns evaluating control effectiveness instead of activity.
C:Temporary plans need firm review triggers. It may help maintain handling temporary risk within operational constraints, whereas the stated continuing risk concerns evaluating control effectiveness instead of activity.
D:Severe-event exposures are sensitive to systemic shifts. It may help maintain considering low-frequency catastrophic impact, whereas the stated continuing risk concerns evaluating control effectiveness instead of activity.
Question 201
A vendor risk questionnaire returns a high score, but independent audits show repeated unresolved critical findings. Which management decision most directly addresses the stated business need?
- Escalate independent adverse evidence and revise the residual supplier risk assessment
- Assess net residual business risk and service consequences before approving the control
- Complement automated findings with business process, supplier, identity, and architecture risk analysis
- Establish an owner-led information asset inventory and classification process as a risk-assessment foundation
Explanation
Correct Answer
A:A favorable self-attestation must not override validated control failures.
Incorrect Answers
B:Effective treatment must address both security exposure and operational harm. However, it does not make the decision needed for reconciling conflicting third-party risk evidence in this scenario.
C:Vulnerability tools expose only part of enterprise information risk. However, it does not make the decision needed for reconciling conflicting third-party risk evidence in this scenario.
D:Unknown data and systems prevent complete exposure assessment. However, it does not make the decision needed for reconciling conflicting third-party risk evidence in this scenario.
Question 202
A vendor risk questionnaire returns a high score, but independent audits show repeated unresolved critical findings. Which implementation step best translates the requirement into an operating control?
- Combine the vulnerability intelligence with asset ownership, internet reachability, and compensating controls
- Map responsibilities and supporting evidence for each critical shared cloud control
- Separate current-state and target-state risk assessments with evidence and milestones
- Compare findings, remediation evidence, contract criticality, and compensating controls
Explanation
Correct Answer
D:A reconciled evidence record supports an honest rating.
Incorrect Answers
A:Context turns a technical finding into a business risk. That could support prioritizing vulnerabilities by enterprise exposure, but it does not implement the requested reconciling conflicting third-party risk evidence.
B:A control matrix avoids assuming the provider operates everything. That could support allocating shared-responsibility risk accurately, but it does not implement the requested reconciling conflicting third-party risk evidence.
C:Two views prevent premature risk reduction claims. That could support distinguishing planned controls from effective controls, but it does not implement the requested reconciling conflicting third-party risk evidence.
Question 203
A vendor risk questionnaire returns a high score, but independent audits show repeated unresolved critical findings. Which validation best confirms the control meets the stated need?
- Verify an unresolved high-risk finding is reflected in the owner's treatment decision
- Verify the prioritized control set demonstrably reduces the key business loss scenarios
- Verify key subcontractors and access paths are identified in the supplier risk record
- Use a tabletop or red-team exercise to test key decision and detection assumptions
Explanation
Correct Answer
A:The exception must affect management action, not just notes.
Incorrect Answers
B:The review should test treatment coverage, not purchase count. This provides evidence for selecting risk treatments from business scenarios, not proof of reconciling conflicting third-party risk evidence.
C:Visibility is necessary for informed treatment. This provides evidence for assessing fourth-party and supply-chain concentration risk, not proof of reconciling conflicting third-party risk evidence.
D:Controlled evidence informs risk estimates without claiming certainty. This provides evidence for evaluating emerging threats under uncertainty, not proof of reconciling conflicting third-party risk evidence.
Question 204
A vendor risk questionnaire returns a high score, but independent audits show repeated unresolved critical findings. What continuing control would best preserve the intended outcome?
- Review production service quality and residual threat indicators after rollout
- Track overdue vendor remediation and changed service exposure until closure
- Review local decisions and aggregated exposure at enterprise level regularly
- Review ownership after changes in service sponsorship or outsourcing
Explanation
Correct Answer
B:Provider promises need measured follow-through.
Incorrect Answers
A:Control effectiveness can shift when usage changes. It may help maintain balancing security response and business impacts, whereas the stated continuing risk concerns reconciling conflicting third-party risk evidence.
C:Distributed acceptances can collectively breach appetite. It may help maintain ensuring subsidiary tolerances remain within enterprise appetite, whereas the stated continuing risk concerns reconciling conflicting third-party risk evidence.
D:Control location and business accountability may diverge. It may help maintain identifying the correct information risk owner, whereas the stated continuing risk concerns reconciling conflicting third-party risk evidence.
Question 205
A security manager is asked to lower a risk rating after a control is purchased but not deployed. What is the MOST appropriate first management decision for this situation?
- Recalculate privacy and security impact using the new obligation and enforcement environment
- Rate current residual risk using implemented and operating controls, not planned purchases
- Escalate independent adverse evidence and revise the residual supplier risk assessment
- Evaluate liability, accountability, and residual exposure before treating outsourcing as risk transfer
Explanation
Correct Answer
B:A future capability cannot yet reduce present exposure.
Incorrect Answers
A:An unchanged control landscape can carry a different business impact. However, it does not make the decision needed for distinguishing planned controls from effective controls in this scenario.
C:A favorable self-attestation must not override validated control failures. However, it does not make the decision needed for distinguishing planned controls from effective controls in this scenario.
D:Contracting out processing rarely eliminates regulatory or reputational consequences. However, it does not make the decision needed for distinguishing planned controls from effective controls in this scenario.
Question 206
A security manager is asked to lower a risk rating after a control is purchased but not deployed. What should the manager arrange during rollout to meet this requirement?
- Compare findings, remediation evidence, contract criticality, and compensating controls
- Separate current-state and target-state risk assessments with evidence and milestones
- Pilot the mitigation with performance thresholds and evidence of attack-path reduction
- Map responsibilities and supporting evidence for each critical shared cloud control
Explanation
Correct Answer
B:Two views prevent premature risk reduction claims.
Incorrect Answers
A:A reconciled evidence record supports an honest rating. That could support reconciling conflicting third-party risk evidence, but it does not implement the requested distinguishing planned controls from effective controls.
C:A controlled test reveals tradeoffs early. That could support balancing security response and business impacts, but it does not implement the requested distinguishing planned controls from effective controls.
D:A control matrix avoids assuming the provider operates everything. That could support allocating shared-responsibility risk accurately, but it does not implement the requested distinguishing planned controls from effective controls.
Question 207
A security manager is asked to lower a risk rating after a control is purchased but not deployed. Which test most directly verifies the desired managerial outcome?
- Compare treatment rankings under optimistic and pessimistic assumptions
- Verify a sample control operates as intended before recognizing its treatment benefit
- Verify no business processing or external dependency remains in the retired operation
- Confirm owners approve the selected treatment on the basis of risk and costs
Explanation
Correct Answer
B:Operating evidence establishes whether risk was reduced.
Incorrect Answers
A:Sensitivity indicates whether the decision is robust. This provides evidence for using quantitative risk estimates responsibly, not proof of distinguishing planned controls from effective controls.
C:A completion test demonstrates actual avoidance. This provides evidence for confirming genuine risk avoidance, not proof of distinguishing planned controls from effective controls.
D:Approval requires more than a control recommendation. This provides evidence for applying a cost-aware risk treatment process, not proof of distinguishing planned controls from effective controls.
Question 208
A security manager is asked to lower a risk rating after a control is purchased but not deployed. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Revisit the rating when implementation evidence or performance changes
- Monitor downstream provider changes and risk indicators during contract operation
- Update the model after near-misses, insurance studies, or site changes
- Escalate missed patch milestones and reassess emerging exploitation evidence
Explanation
Correct Answer
A:Ratings must reflect the actual control state.
Incorrect Answers
B:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns distinguishing planned controls from effective controls.
C:New data should refine the estimate. It may help maintain representing uncertainty in risk estimates, whereas the stated continuing risk concerns distinguishing planned controls from effective controls.
D:Temporary plans need firm review triggers. It may help maintain handling temporary risk within operational constraints, whereas the stated continuing risk concerns distinguishing planned controls from effective controls.
Question 209
A hospital stores patient data across applications but lacks a current information asset inventory. Which management approach best satisfies the primary requirement?
- Establish an owner-led information asset inventory and classification process as a risk-assessment foundation
- Escalate independent adverse evidence and revise the residual supplier risk assessment
- Escalate the evidence gap as residual third-party risk to the accountable service owner
- Prioritize treatment using exploitability, asset criticality, exposure, and business impact
Explanation
Correct Answer
A:Unknown data and systems prevent complete exposure assessment.
Incorrect Answers
B:A favorable self-attestation must not override validated control failures. However, it does not make the decision needed for using asset ownership to support risk assessment in this scenario.
C:Questionnaire completion is not proof of subcontractor control. However, it does not make the decision needed for using asset ownership to support risk assessment in this scenario.
D:A severity score alone does not define the organization's priority. However, it does not make the decision needed for using asset ownership to support risk assessment in this scenario.
Question 210
A hospital stores patient data across applications but lacks a current information asset inventory. Which concrete action would best operationalize the needed approach?
- Define delegated decision limits and escalation criteria for regional risk owners
- Identify assets, threats, vulnerabilities, existing controls, and affected business processes with their owners
- Map critical contracts to underlying cloud, telecom, and processing dependencies
- Assign business data owners and map processing locations, integrations, and classifications
Explanation
Correct Answer
D:A current map supports targeted controls and impact analysis.
Incorrect Answers
A:Local autonomy needs explicit authority limits. That could support ensuring subsidiary tolerances remain within enterprise appetite, but it does not implement the requested using asset ownership to support risk assessment.
B:A documented scope grounds risk estimates in the actual service. That could support assessing material risk before a business launch, but it does not implement the requested using asset ownership to support risk assessment.
C:Dependency relationships reveal hidden common points. That could support capturing aggregate supplier concentration, but it does not implement the requested using asset ownership to support risk assessment.
Certified Information Security Manager (CISM) Practice Tests
