100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 210
A hospital stores patient data across applications but lacks a current information asset inventory. Which concrete action would best operationalize the needed approach?
- Define delegated decision limits and escalation criteria for regional risk owners
- Identify assets, threats, vulnerabilities, existing controls, and affected business processes with their owners
- Map critical contracts to underlying cloud, telecom, and processing dependencies
- Assign business data owners and map processing locations, integrations, and classifications
Explanation
Correct Answer
D:A current map supports targeted controls and impact analysis.
Incorrect Answers
A:Local autonomy needs explicit authority limits. That could support ensuring subsidiary tolerances remain within enterprise appetite, but it does not implement the requested using asset ownership to support risk assessment.
B:A documented scope grounds risk estimates in the actual service. That could support assessing material risk before a business launch, but it does not implement the requested using asset ownership to support risk assessment.
C:Dependency relationships reveal hidden common points. That could support capturing aggregate supplier concentration, but it does not implement the requested using asset ownership to support risk assessment.
Question 211
A hospital stores patient data across applications but lacks a current information asset inventory. Which evidence best demonstrates the intended business and security outcome?
- Confirm the risk register records evidence of residual rather than assumed full risk removal
- Walk through a credible attacker path and compare total business impact to appetite
- Trace one regulated dataset from source through third-party transfers with named accountability
- Ask the named owner to approve a plausible residual-loss scenario and verify authority
Explanation
Correct Answer
C:End-to-end coverage tests inventory usefulness.
Incorrect Answers
A:A control outcome, not implementation completion, changes ratings. This provides evidence for verifying residual risk after mitigation, not proof of using asset ownership to support risk assessment.
B:End-to-end scenarios reveal combined significance. This provides evidence for recognizing correlated weaknesses in risk aggregation, not proof of using asset ownership to support risk assessment.
D:Owner participation demonstrates accountability. This provides evidence for identifying the correct information risk owner, not proof of using asset ownership to support risk assessment.
Question 212
A hospital stores patient data across applications but lacks a current information asset inventory. Which recurring management review most directly addresses future drift?
- Monitor residual contractual and retention obligations after exit
- Reprioritize when exploitation evidence or asset criticality changes
- Track increasing reliance on the shared provider in procurement and renewals
- Refresh asset records through onboarding, procurement, and decommissioning events
Explanation
Correct Answer
D:Periodic inventory sweeps alone miss rapid changes.
Incorrect Answers
A:Some liabilities continue after operations end. It may help maintain confirming genuine risk avoidance, whereas the stated continuing risk concerns using asset ownership to support risk assessment.
B:A static severity list can become misleading quickly. It may help maintain prioritizing vulnerabilities by enterprise exposure, whereas the stated continuing risk concerns using asset ownership to support risk assessment.
C:Concentration can rise quietly over time. It may help maintain capturing aggregate supplier concentration, whereas the stated continuing risk concerns using asset ownership to support risk assessment.
Question 213
A business line argues that a low-probability outage does not merit consideration even though it could threaten organizational survival. Which decision should the information security manager prioritize?
- Evaluate correlated failure and concentration risk at the shared provider level
- Recalculate privacy and security impact using the new obligation and enforcement environment
- Assess threat pathways and business impact before selecting the control portfolio
- Evaluate plausible severe-impact scenarios in relation to enterprise resilience and risk appetite
Explanation
Correct Answer
D:Low frequency does not make existential impact acceptable by default.
Incorrect Answers
A:Independent product risk scores can underestimate common dependencies. However, it does not make the decision needed for considering low-frequency catastrophic impact in this scenario.
B:An unchanged control landscape can carry a different business impact. However, it does not make the decision needed for considering low-frequency catastrophic impact in this scenario.
C:A collection of popular controls may miss the largest risks. However, it does not make the decision needed for considering low-frequency catastrophic impact in this scenario.
Question 214
A business line argues that a low-probability outage does not merit consideration even though it could threaten organizational survival. During implementation, which action most directly executes the necessary response?
- Use credible worst-case business impact analysis with documented likelihood assumptions
- Link shared causes to combined business consequences and document dependency assumptions
- Document assumptions, plausible loss bands, frequency, and critical dependencies
- Map each candidate control to specific scenarios, residual impact, and implementation dependencies
Explanation
Correct Answer
A:Scenario analysis captures material tail risk.
Incorrect Answers
B:Consistent scenario modeling prevents inflated totals. That could support avoiding double counting of scenario consequences, but it does not implement the requested considering low-frequency catastrophic impact.
C:Transparent estimates let owners judge confidence. That could support representing uncertainty in risk estimates, but it does not implement the requested considering low-frequency catastrophic impact.
D:Traceability prevents arbitrary purchases. That could support selecting risk treatments from business scenarios, but it does not implement the requested considering low-frequency catastrophic impact.
Question 215
A business line argues that a low-probability outage does not merit consideration even though it could threaten organizational survival. What would provide the strongest practical verification of this requirement?
- Choose a risk and confirm the owner can articulate consequences and intended response
- Review test results and exceptions against the approved recovery requirements
- Present the decision owner with catastrophic outcomes and recovery capability evidence
- Use a tabletop or red-team exercise to test key decision and detection assumptions
Explanation
Correct Answer
C:Management should explicitly consider survivability.
Incorrect Answers
A:Business understanding validates the risk record. This provides evidence for linking risk findings to business impact, not proof of considering low-frequency catastrophic impact.
B:Observed outcomes determine actual residual exposure. This provides evidence for distinguishing test plans from demonstrated resilience, not proof of considering low-frequency catastrophic impact.
D:Controlled evidence informs risk estimates without claiming certainty. This provides evidence for evaluating emerging threats under uncertainty, not proof of considering low-frequency catastrophic impact.
Question 216
A business line argues that a low-probability outage does not merit consideration even though it could threaten organizational survival. Which follow-up is most relevant as the environment changes?
- Reassess assumptions when dependencies, geography, or recovery capabilities change
- Review threat and exposure assumptions after maintenance windows and network changes
- Review scenario taxonomy after emerging incident patterns change impact pathways
- Escalate missed patch milestones and reassess emerging exploitation evidence
Explanation
Correct Answer
A:Severe-event exposures are sensitive to systemic shifts.
Incorrect Answers
B:Previously unavailable evidence may become safely collectible. It may help maintain assessing risk when testing could interrupt operations, whereas the stated continuing risk concerns considering low-frequency catastrophic impact.
C:Model categories must follow actual enterprise risk. It may help maintain avoiding double counting of scenario consequences, whereas the stated continuing risk concerns considering low-frequency catastrophic impact.
D:Temporary plans need firm review triggers. It may help maintain handling temporary risk within operational constraints, whereas the stated continuing risk concerns considering low-frequency catastrophic impact.
Question 217
A new state privacy law increases penalties for misuse of biometric data already processed by the company. Which management decision most directly addresses the stated business need?
- Recalculate privacy and security impact using the new obligation and enforcement environment
- Assess combined phishing controls and residual business exposure using outcome evidence
- Rate current residual risk using implemented and operating controls, not planned purchases
- Approve common impact, likelihood, and escalation criteria before consolidating scores
Explanation
Correct Answer
A:An unchanged control landscape can carry a different business impact.
Incorrect Answers
B:Training completion does not prove attacks are prevented. However, it does not make the decision needed for updating risk assessments when regulatory consequences change in this scenario.
C:A future capability cannot yet reduce present exposure. However, it does not make the decision needed for updating risk assessments when regulatory consequences change in this scenario.
D:Numbers without shared definitions cannot be compared meaningfully. However, it does not make the decision needed for updating risk assessments when regulatory consequences change in this scenario.
Question 218
A new state privacy law increases penalties for misuse of biometric data already processed by the company. Which implementation step best translates the requirement into an operating control?
- Have legal and privacy teams map penalties, notification triggers, and processing scope to risk records
- Assign business data owners and map processing locations, integrations, and classifications
- Map critical contracts to underlying cloud, telecom, and processing dependencies
- Request proportionate assurance or contractual rights over material downstream processing
Explanation
Correct Answer
A:Specialist input improves consequence estimates.
Incorrect Answers
B:A current map supports targeted controls and impact analysis. That could support using asset ownership to support risk assessment, but it does not implement the requested updating risk assessments when regulatory consequences change.
C:Dependency relationships reveal hidden common points. That could support capturing aggregate supplier concentration, but it does not implement the requested updating risk assessments when regulatory consequences change.
D:Controls must follow critical information beyond the first provider. That could support assessing fourth-party and supply-chain concentration risk, but it does not implement the requested updating risk assessments when regulatory consequences change.
Question 219
A new state privacy law increases penalties for misuse of biometric data already processed by the company. Which validation best confirms the control meets the stated need?
- Verify biometric processing scenarios now reflect updated legal consequences and ownership
- Verify key subcontractors and access paths are identified in the supplier risk record
- Verify a sample control operates as intended before recognizing its treatment benefit
- Choose a risk and confirm the owner can articulate consequences and intended response
Explanation
Correct Answer
A:The register should represent current exposure.
Incorrect Answers
B:Visibility is necessary for informed treatment. This provides evidence for assessing fourth-party and supply-chain concentration risk, not proof of updating risk assessments when regulatory consequences change.
C:Operating evidence establishes whether risk was reduced. This provides evidence for distinguishing planned controls from effective controls, not proof of updating risk assessments when regulatory consequences change.
D:Business understanding validates the risk record. This provides evidence for linking risk findings to business impact, not proof of updating risk assessments when regulatory consequences change.
Question 220
A new state privacy law increases penalties for misuse of biometric data already processed by the company. What continuing control would best preserve the intended outcome?
- Monitor new interpretations and enforcement actions that may alter impact
- Monitor downstream provider changes and risk indicators during contract operation
- Monitor vendor financial, control, and legal changes affecting residual risk
- Review scenario taxonomy after emerging incident patterns change impact pathways
Explanation
Correct Answer
A:Regulatory risk can change without system modification.
Incorrect Answers
B:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns updating risk assessments when regulatory consequences change.
C:Transferred functions still require risk management. It may help maintain distinguishing operational outsourcing from risk transfer, whereas the stated continuing risk concerns updating risk assessments when regulatory consequences change.
D:Model categories must follow actual enterprise risk. It may help maintain avoiding double counting of scenario consequences, whereas the stated continuing risk concerns updating risk assessments when regulatory consequences change.
Certified Information Security Manager (CISM) Practice Tests
