100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 260
An enterprise security risk model excludes third-party concentration because vendors are treated as independent contracts. Which recurring management review most directly addresses future drift?
- Track exploitation indicators until remediation and validation are complete
- Monitor downstream provider changes and risk indicators during contract operation
- Refresh asset records through onboarding, procurement, and decommissioning events
- Track increasing reliance on the shared provider in procurement and renewals
Explanation
Correct Answer
D:Concentration can rise quietly over time.
Incorrect Answers
A:Threat urgency persists beyond a new score. It may help maintain integrating active threat intelligence into risk treatment, whereas the stated continuing risk concerns capturing aggregate supplier concentration.
B:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns capturing aggregate supplier concentration.
C:Periodic inventory sweeps alone miss rapid changes. It may help maintain using asset ownership to support risk assessment, whereas the stated continuing risk concerns capturing aggregate supplier concentration.
Question 261
A compliance manager wants to classify all control exceptions as accepted risks without business-owner signatures. Which decision should the information security manager prioritize?
- Require formal risk-owner acceptance where exceptions create material residual exposure
- Assess net residual business risk and service consequences before approving the control
- Assign risk ownership to the accountable business process owner, not simply the control operator
- Require a bounded exception with compensating controls, ownership, and a retirement plan
Explanation
Correct Answer
A:A technical deviation is not automatically authorized risk acceptance.
Incorrect Answers
B:Effective treatment must address both security exposure and operational harm. However, it does not make the decision needed for separating control waivers from approved risk decisions in this scenario.
C:The owner bears business consequences and approves treatment. However, it does not make the decision needed for separating control waivers from approved risk decisions in this scenario.
D:A permanent waiver extends risk beyond the legacy need. However, it does not make the decision needed for separating control waivers from approved risk decisions in this scenario.
Question 262
A compliance manager wants to classify all control exceptions as accepted risks without business-owner signatures. During implementation, which action most directly executes the necessary response?
- Link waivers to assessed scenarios, compensating controls, duration, and approving authority
- Document the selected frequency and magnitude inputs with uncertainty scenarios
- Compare findings, remediation evidence, contract criticality, and compensating controls
- Map each candidate control to specific scenarios, residual impact, and implementation dependencies
Explanation
Correct Answer
A:Explicit links protect against unauthorized risk transfer.
Incorrect Answers
B:Known modeling limitations should be visible. That could support using quantitative risk estimates responsibly, but it does not implement the requested separating control waivers from approved risk decisions.
C:A reconciled evidence record supports an honest rating. That could support reconciling conflicting third-party risk evidence, but it does not implement the requested separating control waivers from approved risk decisions.
D:Traceability prevents arbitrary purchases. That could support selecting risk treatments from business scenarios, but it does not implement the requested separating control waivers from approved risk decisions.
Question 263
A compliance manager wants to classify all control exceptions as accepted risks without business-owner signatures. What would provide the strongest practical verification of this requirement?
- Verify key subcontractors and access paths are identified in the supplier risk record
- Verify the prioritized control set demonstrably reduces the key business loss scenarios
- Review test results and exceptions against the approved recovery requirements
- Sample exceptions and verify they have valid approvals and clear risk statements
Explanation
Correct Answer
D:The check detects informal bypasses disguised as acceptance.
Incorrect Answers
A:Visibility is necessary for informed treatment. This provides evidence for assessing fourth-party and supply-chain concentration risk, not proof of separating control waivers from approved risk decisions.
B:The review should test treatment coverage, not purchase count. This provides evidence for selecting risk treatments from business scenarios, not proof of separating control waivers from approved risk decisions.
C:Observed outcomes determine actual residual exposure. This provides evidence for distinguishing test plans from demonstrated resilience, not proof of separating control waivers from approved risk decisions.
Question 264
A compliance manager wants to classify all control exceptions as accepted risks without business-owner signatures. Which follow-up is most relevant as the environment changes?
- Reassess when actual industry attacks or internal signals change threat plausibility
- Escalate expired or orphaned exceptions and reassess their business consequences
- Reassess assumptions when dependencies, geography, or recovery capabilities change
- Escalate overdue vendor milestones and unexpected exposure changes
Explanation
Correct Answer
B:Controls need owner accountability through their lifecycle.
Incorrect Answers
A:Emerging risk should respond to evidence. It may help maintain evaluating emerging threats under uncertainty, whereas the stated continuing risk concerns separating control waivers from approved risk decisions.
C:Severe-event exposures are sensitive to systemic shifts. It may help maintain considering low-frequency catastrophic impact, whereas the stated continuing risk concerns separating control waivers from approved risk decisions.
D:Reliance on promises needs continued oversight. It may help maintain requiring treatment verification before risk closure, whereas the stated continuing risk concerns separating control waivers from approved risk decisions.
Question 265
A company fears AI-assisted social engineering but has no evidence of successful attacks in its environment. Which management decision most directly addresses the stated business need?
- Assess plausible AI-enhanced attack scenarios without treating absence of incidents as proof of safety
- Assess threat pathways and business impact before selecting the control portfolio
- Assess net residual business risk and service consequences before approving the control
- Reframe entries around impacted business objectives, scenarios, and accountable risk owners
Explanation
Correct Answer
A:Emerging threats require proportionate forward-looking analysis.
Incorrect Answers
B:A collection of popular controls may miss the largest risks. However, it does not make the decision needed for evaluating emerging threats under uncertainty in this scenario.
C:Effective treatment must address both security exposure and operational harm. However, it does not make the decision needed for evaluating emerging threats under uncertainty in this scenario.
D:A scanner finding is evidence, not a complete enterprise risk statement. However, it does not make the decision needed for evaluating emerging threats under uncertainty in this scenario.
Question 266
A company fears AI-assisted social engineering but has no evidence of successful attacks in its environment. Which implementation step best translates the requirement into an operating control?
- Pilot the mitigation with performance thresholds and evidence of attack-path reduction
- Combine credible intelligence with identity controls, workforce patterns, and known attack paths
- Use credible worst-case business impact analysis with documented likelihood assumptions
- Map attack chains linking permissions, federation, recovery, and privileged access
Explanation
Correct Answer
B:Context distinguishes credible scenarios from hype.
Incorrect Answers
A:A controlled test reveals tradeoffs early. That could support balancing security response and business impacts, but it does not implement the requested evaluating emerging threats under uncertainty.
C:Scenario analysis captures material tail risk. That could support considering low-frequency catastrophic impact, but it does not implement the requested evaluating emerging threats under uncertainty.
D:Dependency analysis exposes plausible escalation. That could support recognizing correlated weaknesses in risk aggregation, but it does not implement the requested evaluating emerging threats under uncertainty.
Question 267
A company fears AI-assisted social engineering but has no evidence of successful attacks in its environment. Which validation best confirms the control meets the stated need?
- Use a tabletop or red-team exercise to test key decision and detection assumptions
- Present both residual-risk estimates and decision confidence to the service risk owner
- Present the decision owner with catastrophic outcomes and recovery capability evidence
- Verify an unresolved high-risk finding is reflected in the owner's treatment decision
Explanation
Correct Answer
A:Controlled evidence informs risk estimates without claiming certainty.
Incorrect Answers
B:Accountable management should see uncertainty as well as numbers. This provides evidence for comparing risk treatments on business impact, not proof of evaluating emerging threats under uncertainty.
C:Management should explicitly consider survivability. This provides evidence for considering low-frequency catastrophic impact, not proof of evaluating emerging threats under uncertainty.
D:The exception must affect management action, not just notes. This provides evidence for reconciling conflicting third-party risk evidence, not proof of evaluating emerging threats under uncertainty.
Question 268
A company fears AI-assisted social engineering but has no evidence of successful attacks in its environment. What continuing control would best preserve the intended outcome?
- Review the change-trigger criteria after missed or late risk assessments
- Reassess when actual industry attacks or internal signals change threat plausibility
- Escalate expired or orphaned exceptions and reassess their business consequences
- Reassess after identity architecture and privilege changes
Explanation
Correct Answer
B:Emerging risk should respond to evidence.
Incorrect Answers
A:The process must catch the changes that matter. It may help maintain triggering event-driven risk reassessment, whereas the stated continuing risk concerns evaluating emerging threats under uncertainty.
C:Controls need owner accountability through their lifecycle. It may help maintain separating control waivers from approved risk decisions, whereas the stated continuing risk concerns evaluating emerging threats under uncertainty.
D:Correlated risk evolves with the trust fabric. It may help maintain recognizing correlated weaknesses in risk aggregation, whereas the stated continuing risk concerns evaluating emerging threats under uncertainty.
Question 269
An organization has an effective control but cannot identify who would bear the loss if it failed. What is the MOST appropriate first management decision for this situation?
- Approve a time-limited treatment with safety-aware compensating protection and owner accountability
- Reframe entries around impacted business objectives, scenarios, and accountable risk owners
- Require formal risk-owner acceptance where exceptions create material residual exposure
- Assign risk ownership to the accountable business process owner, not simply the control operator
Explanation
Correct Answer
D:The owner bears business consequences and approves treatment.
Incorrect Answers
A:Immediate patching may be unsafe, but unmanaged delay is also unacceptable. However, it does not make the decision needed for identifying the correct information risk owner in this scenario.
B:A scanner finding is evidence, not a complete enterprise risk statement. However, it does not make the decision needed for identifying the correct information risk owner in this scenario.
C:A technical deviation is not automatically authorized risk acceptance. However, it does not make the decision needed for identifying the correct information risk owner in this scenario.
Question 270
An organization has an effective control but cannot identify who would bear the loss if it failed. What should the manager arrange during rollout to meet this requirement?
- Document exposure, protected network paths, monitoring, change window, and retest schedule
- Map the control to protected business services and record an explicit risk acceptance chain
- Decommission affected services, revoke access, and transfer or delete retained data under policy
- Record the accepting owner, residual exposure, controls, expiry date, and review trigger
Explanation
Correct Answer
B:Responsibility should follow the impact.
Incorrect Answers
A:A staged plan manages both risks. That could support handling temporary risk within operational constraints, but it does not implement the requested identifying the correct information risk owner.
C:Residual data and contracts can preserve exposure after exit. That could support confirming genuine risk avoidance, but it does not implement the requested identifying the correct information risk owner.
D:Conditions make the decision enforceable and reviewable. That could support making risk acceptance a managed decision, but it does not implement the requested identifying the correct information risk owner.
Certified Information Security Manager (CISM) Practice Tests
