100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 220
A new state privacy law increases penalties for misuse of biometric data already processed by the company. What continuing control would best preserve the intended outcome?
- Monitor new interpretations and enforcement actions that may alter impact
- Monitor downstream provider changes and risk indicators during contract operation
- Monitor vendor financial, control, and legal changes affecting residual risk
- Review scenario taxonomy after emerging incident patterns change impact pathways
Explanation
Correct Answer
A:Regulatory risk can change without system modification.
Incorrect Answers
B:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns updating risk assessments when regulatory consequences change.
C:Transferred functions still require risk management. It may help maintain distinguishing operational outsourcing from risk transfer, whereas the stated continuing risk concerns updating risk assessments when regulatory consequences change.
D:Model categories must follow actual enterprise risk. It may help maintain avoiding double counting of scenario consequences, whereas the stated continuing risk concerns updating risk assessments when regulatory consequences change.
Question 221
A software platform uses a managed service whose outage would simultaneously interrupt many critical products. What is the MOST appropriate first management decision for this situation?
- Evaluate plausible severe-impact scenarios in relation to enterprise resilience and risk appetite
- Evaluate residual fraud and availability risk for each option against approved risk criteria
- Evaluate correlated failure and concentration risk at the shared provider level
- Evaluate liability, accountability, and residual exposure before treating outsourcing as risk transfer
Explanation
Correct Answer
C:Independent product risk scores can underestimate common dependencies.
Incorrect Answers
A:Low frequency does not make existential impact acceptable by default. However, it does not make the decision needed for assessing common-cause dependency risk in this scenario.
B:A technology comparison without business impact does not justify selection. However, it does not make the decision needed for assessing common-cause dependency risk in this scenario.
D:Contracting out processing rarely eliminates regulatory or reputational consequences. However, it does not make the decision needed for assessing common-cause dependency risk in this scenario.
Question 222
A software platform uses a managed service whose outage would simultaneously interrupt many critical products. What should the manager arrange during rollout to meet this requirement?
- Map responsibilities and supporting evidence for each critical shared cloud control
- Map the control to protected business services and record an explicit risk acceptance chain
- Document the selected frequency and magnitude inputs with uncertainty scenarios
- Map affected critical services and plausible provider outage scenarios into a consolidated assessment
Explanation
Correct Answer
D:Aggregating shared exposures reveals enterprise-wide impact.
Incorrect Answers
A:A control matrix avoids assuming the provider operates everything. That could support allocating shared-responsibility risk accurately, but it does not implement the requested assessing common-cause dependency risk.
B:Responsibility should follow the impact. That could support identifying the correct information risk owner, but it does not implement the requested assessing common-cause dependency risk.
C:Known modeling limitations should be visible. That could support using quantitative risk estimates responsibly, but it does not implement the requested assessing common-cause dependency risk.
Question 223
A software platform uses a managed service whose outage would simultaneously interrupt many critical products. Which test most directly verifies the desired managerial outcome?
- Confirm the executive owner sees cumulative business loss rather than isolated team ratings
- Present both residual-risk estimates and decision confidence to the service risk owner
- Verify the prioritized control set demonstrably reduces the key business loss scenarios
- Confirm owners approve the selected treatment on the basis of risk and costs
Explanation
Correct Answer
A:A scenario should demonstrate the concentration effect.
Incorrect Answers
B:Accountable management should see uncertainty as well as numbers. This provides evidence for comparing risk treatments on business impact, not proof of assessing common-cause dependency risk.
C:The review should test treatment coverage, not purchase count. This provides evidence for selecting risk treatments from business scenarios, not proof of assessing common-cause dependency risk.
D:Approval requires more than a control recommendation. This provides evidence for applying a cost-aware risk treatment process, not proof of assessing common-cause dependency risk.
Question 224
A software platform uses a managed service whose outage would simultaneously interrupt many critical products. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Reprioritize when exploitation evidence or asset criticality changes
- Monitor residual contractual and retention obligations after exit
- Revisit the rating when implementation evidence or performance changes
- Track provider resilience evidence and diversification or exit options over time
Explanation
Correct Answer
D:Dependency concentration can intensify with growth.
Incorrect Answers
A:A static severity list can become misleading quickly. It may help maintain prioritizing vulnerabilities by enterprise exposure, whereas the stated continuing risk concerns assessing common-cause dependency risk.
B:Some liabilities continue after operations end. It may help maintain confirming genuine risk avoidance, whereas the stated continuing risk concerns assessing common-cause dependency risk.
C:Ratings must reflect the actual control state. It may help maintain distinguishing planned controls from effective controls, whereas the stated continuing risk concerns assessing common-cause dependency risk.
Question 225
A risk manager wants to accept a vulnerability because it has a medium CVSS score despite public exploitation against a similar environment. Which management approach best satisfies the primary requirement?
- Validate that exiting the activity actually removes the associated exposure and dependencies
- Assess net residual business risk and service consequences before approving the control
- Assess threat pathways and business impact before selecting the control portfolio
- Reassess the weakness using observed exploitation, exposure, and critical service impact
Explanation
Correct Answer
D:Threat activity may outweigh a generic severity label.
Incorrect Answers
A:Risk avoidance means ceasing the risky activity, not merely renaming it. However, it does not make the decision needed for integrating active threat intelligence into risk treatment in this scenario.
B:Effective treatment must address both security exposure and operational harm. However, it does not make the decision needed for integrating active threat intelligence into risk treatment in this scenario.
C:A collection of popular controls may miss the largest risks. However, it does not make the decision needed for integrating active threat intelligence into risk treatment in this scenario.
Question 226
A risk manager wants to accept a vulnerability because it has a medium CVSS score despite public exploitation against a similar environment. Which concrete action would best operationalize the needed approach?
- Update scenario likelihood and existing defense evidence from relevant threat intelligence
- Map responsibilities and supporting evidence for each critical shared cloud control
- Separate current-state and target-state risk assessments with evidence and milestones
- Compare findings, remediation evidence, contract criticality, and compensating controls
Explanation
Correct Answer
A:Evidence-driven estimates support reprioritization.
Incorrect Answers
B:A control matrix avoids assuming the provider operates everything. That could support allocating shared-responsibility risk accurately, but it does not implement the requested integrating active threat intelligence into risk treatment.
C:Two views prevent premature risk reduction claims. That could support distinguishing planned controls from effective controls, but it does not implement the requested integrating active threat intelligence into risk treatment.
D:A reconciled evidence record supports an honest rating. That could support reconciling conflicting third-party risk evidence, but it does not implement the requested integrating active threat intelligence into risk treatment.
Question 227
A risk manager wants to accept a vulnerability because it has a medium CVSS score despite public exploitation against a similar environment. Which evidence best demonstrates the intended business and security outcome?
- Verify no business processing or external dependency remains in the retired operation
- Verify the prioritized control set demonstrably reduces the key business loss scenarios
- Verify the risk owner can explain why the changed likelihood affects the treatment choice
- Choose a risk and confirm the owner can articulate consequences and intended response
Explanation
Correct Answer
C:A documented decision links threat intelligence to action.
Incorrect Answers
A:A completion test demonstrates actual avoidance. This provides evidence for confirming genuine risk avoidance, not proof of integrating active threat intelligence into risk treatment.
B:The review should test treatment coverage, not purchase count. This provides evidence for selecting risk treatments from business scenarios, not proof of integrating active threat intelligence into risk treatment.
D:Business understanding validates the risk record. This provides evidence for linking risk findings to business impact, not proof of integrating active threat intelligence into risk treatment.
Question 228
A risk manager wants to accept a vulnerability because it has a medium CVSS score despite public exploitation against a similar environment. Which recurring management review most directly addresses future drift?
- Track exploitation indicators until remediation and validation are complete
- Track increasing reliance on the shared provider in procurement and renewals
- Review production service quality and residual threat indicators after rollout
- Track the migration milestone and close the waiver when the obsolete component retires
Explanation
Correct Answer
A:Threat urgency persists beyond a new score.
Incorrect Answers
B:Concentration can rise quietly over time. It may help maintain capturing aggregate supplier concentration, whereas the stated continuing risk concerns integrating active threat intelligence into risk treatment.
C:Control effectiveness can shift when usage changes. It may help maintain balancing security response and business impacts, whereas the stated continuing risk concerns integrating active threat intelligence into risk treatment.
D:Exceptions must not survive their original justification. It may help maintain evaluating compensating controls for a documented exception, whereas the stated continuing risk concerns integrating active threat intelligence into risk treatment.
Question 229
A chief financial officer asks whether to transfer processing to a vendor to avoid data breach liability. Which decision should the information security manager prioritize?
- Validate that exiting the activity actually removes the associated exposure and dependencies
- Escalate independent adverse evidence and revise the residual supplier risk assessment
- Evaluate liability, accountability, and residual exposure before treating outsourcing as risk transfer
- Evaluate correlated failure and concentration risk at the shared provider level
Explanation
Correct Answer
C:Contracting out processing rarely eliminates regulatory or reputational consequences.
Incorrect Answers
A:Risk avoidance means ceasing the risky activity, not merely renaming it. However, it does not make the decision needed for distinguishing operational outsourcing from risk transfer in this scenario.
B:A favorable self-attestation must not override validated control failures. However, it does not make the decision needed for distinguishing operational outsourcing from risk transfer in this scenario.
D:Independent product risk scores can underestimate common dependencies. However, it does not make the decision needed for distinguishing operational outsourcing from risk transfer in this scenario.
Question 230
A chief financial officer asks whether to transfer processing to a vendor to avoid data breach liability. During implementation, which action most directly executes the necessary response?
- Define success criteria for data integrity, RTO, RPO, and required business dependencies
- Map critical contracts to underlying cloud, telecom, and processing dependencies
- Identify assets, threats, vulnerabilities, existing controls, and affected business processes with their owners
- Review data-processing terms, liability limits, audit rights, and dependency risk with legal and business owners
Explanation
Correct Answer
D:Contract terms define what, if anything, is transferred.
Incorrect Answers
A:Criteria ensure testing measures real recovery obligations. That could support distinguishing test plans from demonstrated resilience, but it does not implement the requested distinguishing operational outsourcing from risk transfer.
B:Dependency relationships reveal hidden common points. That could support capturing aggregate supplier concentration, but it does not implement the requested distinguishing operational outsourcing from risk transfer.
C:A documented scope grounds risk estimates in the actual service. That could support assessing material risk before a business launch, but it does not implement the requested distinguishing operational outsourcing from risk transfer.
Certified Information Security Manager (CISM) Practice Tests
