100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 240
A multinational's risk register mixes data theft, regulatory fines, and negative publicity as separate unrelated risks for the same incident. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Reassess the service risk after major API dependencies or transaction volumes change
- Reassess assumptions when dependencies, geography, or recovery capabilities change
- Escalate missed patch milestones and reassess emerging exploitation evidence
- Review scenario taxonomy after emerging incident patterns change impact pathways
Explanation
Correct Answer
D:Model categories must follow actual enterprise risk.
Incorrect Answers
A:Exposure can shift after the launch baseline is established. It may help maintain assessing material risk before a business launch, whereas the stated continuing risk concerns avoiding double counting of scenario consequences.
B:Severe-event exposures are sensitive to systemic shifts. It may help maintain considering low-frequency catastrophic impact, whereas the stated continuing risk concerns avoiding double counting of scenario consequences.
C:Temporary plans need firm review triggers. It may help maintain handling temporary risk within operational constraints, whereas the stated continuing risk concerns avoiding double counting of scenario consequences.
Question 241
A technology provider proposes a control that lowers the probability of intrusion but increases customer transaction latency. Which management approach best satisfies the primary requirement?
- Assess customer-owned identity and data controls separately from provider platform obligations
- Evaluate residual fraud and availability risk for each option against approved risk criteria
- Assess whether provider-held key access matches the business's confidentiality requirements and appetite
- Assess net residual business risk and service consequences before approving the control
Explanation
Correct Answer
D:Effective treatment must address both security exposure and operational harm.
Incorrect Answers
A:Vendor security claims do not remove customer configuration risk. However, it does not make the decision needed for balancing security response and business impacts in this scenario.
B:A technology comparison without business impact does not justify selection. However, it does not make the decision needed for balancing security response and business impacts in this scenario.
C:Encryption claims alone do not establish separation of control. However, it does not make the decision needed for balancing security response and business impacts in this scenario.
Question 242
A technology provider proposes a control that lowers the probability of intrusion but increases customer transaction latency. Which concrete action would best operationalize the needed approach?
- Compare findings, remediation evidence, contract criticality, and compensating controls
- Separate current-state and target-state risk assessments with evidence and milestones
- Pilot the mitigation with performance thresholds and evidence of attack-path reduction
- Identify assets, threats, vulnerabilities, existing controls, and affected business processes with their owners
Explanation
Correct Answer
C:A controlled test reveals tradeoffs early.
Incorrect Answers
A:A reconciled evidence record supports an honest rating. That could support reconciling conflicting third-party risk evidence, but it does not implement the requested balancing security response and business impacts.
B:Two views prevent premature risk reduction claims. That could support distinguishing planned controls from effective controls, but it does not implement the requested balancing security response and business impacts.
D:A documented scope grounds risk estimates in the actual service. That could support assessing material risk before a business launch, but it does not implement the requested balancing security response and business impacts.
Question 243
A technology provider proposes a control that lowers the probability of intrusion but increases customer transaction latency. Which evidence best demonstrates the intended business and security outcome?
- Choose a risk and confirm the owner can articulate consequences and intended response
- Compare business impact and reduced exposure against the risk owner's agreed decision criteria
- Use a tabletop or red-team exercise to test key decision and detection assumptions
- Review test results and exceptions against the approved recovery requirements
Explanation
Correct Answer
B:The final choice should reflect enterprise value.
Incorrect Answers
A:Business understanding validates the risk record. This provides evidence for linking risk findings to business impact, not proof of balancing security response and business impacts.
C:Controlled evidence informs risk estimates without claiming certainty. This provides evidence for evaluating emerging threats under uncertainty, not proof of balancing security response and business impacts.
D:Observed outcomes determine actual residual exposure. This provides evidence for distinguishing test plans from demonstrated resilience, not proof of balancing security response and business impacts.
Question 244
A technology provider proposes a control that lowers the probability of intrusion but increases customer transaction latency. Which recurring management review most directly addresses future drift?
- Review production service quality and residual threat indicators after rollout
- Review threat and exposure assumptions after maintenance windows and network changes
- Reevaluate treatment economics when threat likelihood or control cost changes
- Reassess the service risk after major API dependencies or transaction volumes change
Explanation
Correct Answer
A:Control effectiveness can shift when usage changes.
Incorrect Answers
B:Previously unavailable evidence may become safely collectible. It may help maintain assessing risk when testing could interrupt operations, whereas the stated continuing risk concerns balancing security response and business impacts.
C:A once-rational response may cease to be proportionate. It may help maintain applying a cost-aware risk treatment process, whereas the stated continuing risk concerns balancing security response and business impacts.
D:Exposure can shift after the launch baseline is established. It may help maintain assessing material risk before a business launch, whereas the stated continuing risk concerns balancing security response and business impacts.
Question 245
A security director uses vulnerability scanner coverage as proof that all critical risks are identified. Which decision should the information security manager prioritize?
- Assess customer-owned identity and data controls separately from provider platform obligations
- Escalate independent adverse evidence and revise the residual supplier risk assessment
- Complement automated findings with business process, supplier, identity, and architecture risk analysis
- Quantify cumulative impact when many critical services rely on the same supplier or technology stack
Explanation
Correct Answer
C:Vulnerability tools expose only part of enterprise information risk.
Incorrect Answers
A:Vendor security claims do not remove customer configuration risk. However, it does not make the decision needed for recognizing limits of evidence and assessment coverage in this scenario.
B:A favorable self-attestation must not override validated control failures. However, it does not make the decision needed for recognizing limits of evidence and assessment coverage in this scenario.
D:Shared failures can generate losses much larger than each contract suggests. However, it does not make the decision needed for recognizing limits of evidence and assessment coverage in this scenario.
Question 246
A security director uses vulnerability scanner coverage as proof that all critical risks are identified. During implementation, which action most directly executes the necessary response?
- Coordinate asset and threat analysis with plant engineering, using approved nonintrusive discovery
- Identify unassessed assets and threat pathways with business stakeholders and other assurance sources
- Request proportionate assurance or contractual rights over material downstream processing
- Update scenario likelihood and existing defense evidence from relevant threat intelligence
Explanation
Correct Answer
B:Broader analysis closes blind spots.
Incorrect Answers
A:Joint analysis can reveal exposure without unsafe active probing. That could support assessing risk when testing could interrupt operations, but it does not implement the requested recognizing limits of evidence and assessment coverage.
C:Controls must follow critical information beyond the first provider. That could support assessing fourth-party and supply-chain concentration risk, but it does not implement the requested recognizing limits of evidence and assessment coverage.
D:Evidence-driven estimates support reprioritization. That could support integrating active threat intelligence into risk treatment, but it does not implement the requested recognizing limits of evidence and assessment coverage.
Question 247
A security director uses vulnerability scanner coverage as proof that all critical risks are identified. What would provide the strongest practical verification of this requirement?
- Verify key subcontractors and access paths are identified in the supplier risk record
- Choose a nontechnical failure scenario and verify it appears in the consolidated risk assessment
- Test a realistic outage scenario against the policy and continuity requirements
- Verify the prioritized control set demonstrably reduces the key business loss scenarios
Explanation
Correct Answer
B:A representative test validates coverage beyond scanning.
Incorrect Answers
A:Visibility is necessary for informed treatment. This provides evidence for assessing fourth-party and supply-chain concentration risk, not proof of recognizing limits of evidence and assessment coverage.
C:The review reveals uninsured consequences and recovery gaps. This provides evidence for understanding the limitations of risk transfer, not proof of recognizing limits of evidence and assessment coverage.
D:The review should test treatment coverage, not purchase count. This provides evidence for selecting risk treatments from business scenarios, not proof of recognizing limits of evidence and assessment coverage.
Question 248
A security director uses vulnerability scanner coverage as proof that all critical risks are identified. Which follow-up is most relevant as the environment changes?
- Reassess the risk when recovery dependencies or operating conditions change
- Reassess the service risk after major API dependencies or transaction volumes change
- Escalate expired or orphaned exceptions and reassess their business consequences
- Review newly introduced dependencies and unsupported tools as part of continuous risk discovery
Explanation
Correct Answer
D:Technical coverage changes over time.
Incorrect Answers
A:Resilience evidence ages with architecture. It may help maintain distinguishing test plans from demonstrated resilience, whereas the stated continuing risk concerns recognizing limits of evidence and assessment coverage.
B:Exposure can shift after the launch baseline is established. It may help maintain assessing material risk before a business launch, whereas the stated continuing risk concerns recognizing limits of evidence and assessment coverage.
C:Controls need owner accountability through their lifecycle. It may help maintain separating control waivers from approved risk decisions, whereas the stated continuing risk concerns recognizing limits of evidence and assessment coverage.
Question 249
A board demands that each division independently choose its security risk acceptance thresholds. Which management decision most directly addresses the stated business need?
- Evaluate correlated failure and concentration risk at the shared provider level
- Set group-level risk appetite boundaries while allowing controlled local tolerances
- Require an authorized, time-bounded risk acceptance within approved appetite
- Evaluate plausible severe-impact scenarios in relation to enterprise resilience and risk appetite
Explanation
Correct Answer
B:Decentralization cannot permit unacceptable aggregated exposure.
Incorrect Answers
A:Independent product risk scores can underestimate common dependencies. However, it does not make the decision needed for ensuring subsidiary tolerances remain within enterprise appetite in this scenario.
C:An indefinite informal acceptance is not effective risk governance. However, it does not make the decision needed for ensuring subsidiary tolerances remain within enterprise appetite in this scenario.
D:Low frequency does not make existential impact acceptable by default. However, it does not make the decision needed for ensuring subsidiary tolerances remain within enterprise appetite in this scenario.
Question 250
A board demands that each division independently choose its security risk acceptance thresholds. Which implementation step best translates the requirement into an operating control?
- Define delegated decision limits and escalation criteria for regional risk owners
- Identify assets, threats, vulnerabilities, existing controls, and affected business processes with their owners
- Assign business data owners and map processing locations, integrations, and classifications
- Calibrate rating criteria using representative incidents and business outcomes
Explanation
Correct Answer
A:Local autonomy needs explicit authority limits.
Incorrect Answers
B:A documented scope grounds risk estimates in the actual service. That could support assessing material risk before a business launch, but it does not implement the requested ensuring subsidiary tolerances remain within enterprise appetite.
C:A current map supports targeted controls and impact analysis. That could support using asset ownership to support risk assessment, but it does not implement the requested ensuring subsidiary tolerances remain within enterprise appetite.
D:Examples reduce inconsistent use of scales. That could support creating consistent enterprise risk criteria, but it does not implement the requested ensuring subsidiary tolerances remain within enterprise appetite.
Certified Information Security Manager (CISM) Practice Tests
