100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 250
A board demands that each division independently choose its security risk acceptance thresholds. Which implementation step best translates the requirement into an operating control?
- Define delegated decision limits and escalation criteria for regional risk owners
- Identify assets, threats, vulnerabilities, existing controls, and affected business processes with their owners
- Assign business data owners and map processing locations, integrations, and classifications
- Calibrate rating criteria using representative incidents and business outcomes
Explanation
Correct Answer
A:Local autonomy needs explicit authority limits.
Incorrect Answers
B:A documented scope grounds risk estimates in the actual service. That could support assessing material risk before a business launch, but it does not implement the requested ensuring subsidiary tolerances remain within enterprise appetite.
C:A current map supports targeted controls and impact analysis. That could support using asset ownership to support risk assessment, but it does not implement the requested ensuring subsidiary tolerances remain within enterprise appetite.
D:Examples reduce inconsistent use of scales. That could support creating consistent enterprise risk criteria, but it does not implement the requested ensuring subsidiary tolerances remain within enterprise appetite.
Question 251
A board demands that each division independently choose its security risk acceptance thresholds. Which validation best confirms the control meets the stated need?
- Test a proposed regional acceptance that exceeds group tolerance and confirm escalation
- Review test results and exceptions against the approved recovery requirements
- Use a tabletop or red-team exercise to test key decision and detection assumptions
- Test a misconfigured customer role against the contractual responsibility map
Explanation
Correct Answer
A:A boundary test shows hierarchy is respected.
Incorrect Answers
B:Observed outcomes determine actual residual exposure. This provides evidence for distinguishing test plans from demonstrated resilience, not proof of ensuring subsidiary tolerances remain within enterprise appetite.
C:Controlled evidence informs risk estimates without claiming certainty. This provides evidence for evaluating emerging threats under uncertainty, not proof of ensuring subsidiary tolerances remain within enterprise appetite.
D:Ownership clarity informs effective treatment. This provides evidence for allocating shared-responsibility risk accurately, not proof of ensuring subsidiary tolerances remain within enterprise appetite.
Question 252
A board demands that each division independently choose its security risk acceptance thresholds. What continuing control would best preserve the intended outcome?
- Track overdue vendor remediation and changed service exposure until closure
- Review local decisions and aggregated exposure at enterprise level regularly
- Escalate overdue vendor milestones and unexpected exposure changes
- Review threat and exposure assumptions after maintenance windows and network changes
Explanation
Correct Answer
B:Distributed acceptances can collectively breach appetite.
Incorrect Answers
A:Provider promises need measured follow-through. It may help maintain reconciling conflicting third-party risk evidence, whereas the stated continuing risk concerns ensuring subsidiary tolerances remain within enterprise appetite.
C:Reliance on promises needs continued oversight. It may help maintain requiring treatment verification before risk closure, whereas the stated continuing risk concerns ensuring subsidiary tolerances remain within enterprise appetite.
D:Previously unavailable evidence may become safely collectible. It may help maintain assessing risk when testing could interrupt operations, whereas the stated continuing risk concerns ensuring subsidiary tolerances remain within enterprise appetite.
Question 253
A transportation firm wants assurance that a compensating firewall rule genuinely reduces exposure from an unpatched system. What is the MOST appropriate first management decision for this situation?
- Evaluate the firewall rule against the specific exploit pathway and remaining business exposure
- Evaluate correlated failure and concentration risk at the shared provider level
- Validate that exiting the activity actually removes the associated exposure and dependencies
- Evaluate plausible severe-impact scenarios in relation to enterprise resilience and risk appetite
Explanation
Correct Answer
A:A network rule may not block other vectors or remove the vulnerability.
Incorrect Answers
B:Independent product risk scores can underestimate common dependencies. However, it does not make the decision needed for verifying residual risk after mitigation in this scenario.
C:Risk avoidance means ceasing the risky activity, not merely renaming it. However, it does not make the decision needed for verifying residual risk after mitigation in this scenario.
D:Low frequency does not make existential impact acceptable by default. However, it does not make the decision needed for verifying residual risk after mitigation in this scenario.
Question 254
A transportation firm wants assurance that a compensating firewall rule genuinely reduces exposure from an unpatched system. What should the manager arrange during rollout to meet this requirement?
- Assess the authentication path, alternative safeguards, time limit, and technical migration steps
- Test permitted and denied traffic plus alternative routes under an approved change window
- Add security risk checkpoints to product and architecture change governance
- Decommission affected services, revoke access, and transfer or delete retained data under policy
Explanation
Correct Answer
B:Validation should reproduce relevant threats safely.
Incorrect Answers
A:A temporary risk treatment should address the actual weakness. That could support evaluating compensating controls for a documented exception, but it does not implement the requested verifying residual risk after mitigation.
C:A trigger ensures assessment happens before irreversible commitments. That could support triggering event-driven risk reassessment, but it does not implement the requested verifying residual risk after mitigation.
D:Residual data and contracts can preserve exposure after exit. That could support confirming genuine risk avoidance, but it does not implement the requested verifying residual risk after mitigation.
Question 255
A transportation firm wants assurance that a compensating firewall rule genuinely reduces exposure from an unpatched system. Which test most directly verifies the desired managerial outcome?
- Confirm owners approve the selected treatment on the basis of risk and costs
- Choose a risk and confirm the owner can articulate consequences and intended response
- Confirm the control evaluation measures actual compromise pathways and response performance
- Confirm the risk register records evidence of residual rather than assumed full risk removal
Explanation
Correct Answer
D:A control outcome, not implementation completion, changes ratings.
Incorrect Answers
A:Approval requires more than a control recommendation. This provides evidence for applying a cost-aware risk treatment process, not proof of verifying residual risk after mitigation.
B:Business understanding validates the risk record. This provides evidence for linking risk findings to business impact, not proof of verifying residual risk after mitigation.
C:An outcome test can reveal gaps behind healthy completion rates. This provides evidence for evaluating control effectiveness instead of activity, not proof of verifying residual risk after mitigation.
Question 256
A transportation firm wants assurance that a compensating firewall rule genuinely reduces exposure from an unpatched system. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Update the model after near-misses, insurance studies, or site changes
- Monitor downstream provider changes and risk indicators during contract operation
- Escalate missed patch milestones and reassess emerging exploitation evidence
- Reassess after topology changes or publication of new exploit paths
Explanation
Correct Answer
D:Compensating controls need ongoing validation.
Incorrect Answers
A:New data should refine the estimate. It may help maintain representing uncertainty in risk estimates, whereas the stated continuing risk concerns verifying residual risk after mitigation.
B:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns verifying residual risk after mitigation.
C:Temporary plans need firm review triggers. It may help maintain handling temporary risk within operational constraints, whereas the stated continuing risk concerns verifying residual risk after mitigation.
Question 257
An enterprise security risk model excludes third-party concentration because vendors are treated as independent contracts. Which management approach best satisfies the primary requirement?
- Complement automated findings with business process, supplier, identity, and architecture risk analysis
- Assess threat pathways and business impact before selecting the control portfolio
- Quantify cumulative impact when many critical services rely on the same supplier or technology stack
- Recalculate privacy and security impact using the new obligation and enforcement environment
Explanation
Correct Answer
C:Shared failures can generate losses much larger than each contract suggests.
Incorrect Answers
A:Vulnerability tools expose only part of enterprise information risk. However, it does not make the decision needed for capturing aggregate supplier concentration in this scenario.
B:A collection of popular controls may miss the largest risks. However, it does not make the decision needed for capturing aggregate supplier concentration in this scenario.
D:An unchanged control landscape can carry a different business impact. However, it does not make the decision needed for capturing aggregate supplier concentration in this scenario.
Question 258
An enterprise security risk model excludes third-party concentration because vendors are treated as independent contracts. Which concrete action would best operationalize the needed approach?
- Map each candidate control to specific scenarios, residual impact, and implementation dependencies
- Request proportionate assurance or contractual rights over material downstream processing
- Assign business data owners and map processing locations, integrations, and classifications
- Map critical contracts to underlying cloud, telecom, and processing dependencies
Explanation
Correct Answer
D:Dependency relationships reveal hidden common points.
Incorrect Answers
A:Traceability prevents arbitrary purchases. That could support selecting risk treatments from business scenarios, but it does not implement the requested capturing aggregate supplier concentration.
B:Controls must follow critical information beyond the first provider. That could support assessing fourth-party and supply-chain concentration risk, but it does not implement the requested capturing aggregate supplier concentration.
C:A current map supports targeted controls and impact analysis. That could support using asset ownership to support risk assessment, but it does not implement the requested capturing aggregate supplier concentration.
Question 259
An enterprise security risk model excludes third-party concentration because vendors are treated as independent contracts. Which evidence best demonstrates the intended business and security outcome?
- Simulate one provider outage across multiple business units and reconcile total impact
- Validate who can decrypt representative records under a documented provider compromise scenario
- Inspect a sample high-impact change for updated risk owners and treatment decisions
- Test a realistic outage scenario against the policy and continuity requirements
Explanation
Correct Answer
A:Enterprise scenarios show whether concentration is material.
Incorrect Answers
B:An access-path test reveals residual confidentiality risk. This provides evidence for evaluating key custody as a third-party risk, not proof of capturing aggregate supplier concentration.
C:A traceable review proves change integration. This provides evidence for triggering event-driven risk reassessment, not proof of capturing aggregate supplier concentration.
D:The review reveals uninsured consequences and recovery gaps. This provides evidence for understanding the limitations of risk transfer, not proof of capturing aggregate supplier concentration.
Question 260
An enterprise security risk model excludes third-party concentration because vendors are treated as independent contracts. Which recurring management review most directly addresses future drift?
- Track exploitation indicators until remediation and validation are complete
- Monitor downstream provider changes and risk indicators during contract operation
- Refresh asset records through onboarding, procurement, and decommissioning events
- Track increasing reliance on the shared provider in procurement and renewals
Explanation
Correct Answer
D:Concentration can rise quietly over time.
Incorrect Answers
A:Threat urgency persists beyond a new score. It may help maintain integrating active threat intelligence into risk treatment, whereas the stated continuing risk concerns capturing aggregate supplier concentration.
B:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns capturing aggregate supplier concentration.
C:Periodic inventory sweeps alone miss rapid changes. It may help maintain using asset ownership to support risk assessment, whereas the stated continuing risk concerns capturing aggregate supplier concentration.
Certified Information Security Manager (CISM) Practice Tests
