100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 270
An organization has an effective control but cannot identify who would bear the loss if it failed. What should the manager arrange during rollout to meet this requirement?
- Document exposure, protected network paths, monitoring, change window, and retest schedule
- Map the control to protected business services and record an explicit risk acceptance chain
- Decommission affected services, revoke access, and transfer or delete retained data under policy
- Record the accepting owner, residual exposure, controls, expiry date, and review trigger
Explanation
Correct Answer
B:Responsibility should follow the impact.
Incorrect Answers
A:A staged plan manages both risks. That could support handling temporary risk within operational constraints, but it does not implement the requested identifying the correct information risk owner.
C:Residual data and contracts can preserve exposure after exit. That could support confirming genuine risk avoidance, but it does not implement the requested identifying the correct information risk owner.
D:Conditions make the decision enforceable and reviewable. That could support making risk acceptance a managed decision, but it does not implement the requested identifying the correct information risk owner.
Question 271
An organization has an effective control but cannot identify who would bear the loss if it failed. Which test most directly verifies the desired managerial outcome?
- Verify key subcontractors and access paths are identified in the supplier risk record
- Ask the named owner to approve a plausible residual-loss scenario and verify authority
- Test a realistic outage scenario against the policy and continuity requirements
- Verify a sample control operates as intended before recognizing its treatment benefit
Explanation
Correct Answer
B:Owner participation demonstrates accountability.
Incorrect Answers
A:Visibility is necessary for informed treatment. This provides evidence for assessing fourth-party and supply-chain concentration risk, not proof of identifying the correct information risk owner.
C:The review reveals uninsured consequences and recovery gaps. This provides evidence for understanding the limitations of risk transfer, not proof of identifying the correct information risk owner.
D:Operating evidence establishes whether risk was reduced. This provides evidence for distinguishing planned controls from effective controls, not proof of identifying the correct information risk owner.
Question 272
An organization has an effective control but cannot identify who would bear the loss if it failed. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Review ownership after changes in service sponsorship or outsourcing
- Update the risk estimate when actual fraud attempts or service outages differ from assumptions
- Monitor downstream provider changes and risk indicators during contract operation
- Track overdue vendor remediation and changed service exposure until closure
Explanation
Correct Answer
A:Control location and business accountability may diverge.
Incorrect Answers
B:Risk quantification requires calibration with evidence. It may help maintain comparing risk treatments on business impact, whereas the stated continuing risk concerns identifying the correct information risk owner.
C:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns identifying the correct information risk owner.
D:Provider promises need measured follow-through. It may help maintain reconciling conflicting third-party risk evidence, whereas the stated continuing risk concerns identifying the correct information risk owner.
Question 273
A new vulnerability patch must be delayed for two weeks because it breaks a life-critical monitoring system. Which management approach best satisfies the primary requirement?
- Assign risk ownership to the accountable business process owner, not simply the control operator
- Establish an owner-led information asset inventory and classification process as a risk-assessment foundation
- Require a bounded exception with compensating controls, ownership, and a retirement plan
- Approve a time-limited treatment with safety-aware compensating protection and owner accountability
Explanation
Correct Answer
D:Immediate patching may be unsafe, but unmanaged delay is also unacceptable.
Incorrect Answers
A:The owner bears business consequences and approves treatment. However, it does not make the decision needed for handling temporary risk within operational constraints in this scenario.
B:Unknown data and systems prevent complete exposure assessment. However, it does not make the decision needed for handling temporary risk within operational constraints in this scenario.
C:A permanent waiver extends risk beyond the legacy need. However, it does not make the decision needed for handling temporary risk within operational constraints in this scenario.
Question 274
A new vulnerability patch must be delayed for two weeks because it breaks a life-critical monitoring system. Which concrete action would best operationalize the needed approach?
- Map the control to protected business services and record an explicit risk acceptance chain
- Document the selected frequency and magnitude inputs with uncertainty scenarios
- Add security risk checkpoints to product and architecture change governance
- Document exposure, protected network paths, monitoring, change window, and retest schedule
Explanation
Correct Answer
D:A staged plan manages both risks.
Incorrect Answers
A:Responsibility should follow the impact. That could support identifying the correct information risk owner, but it does not implement the requested handling temporary risk within operational constraints.
B:Known modeling limitations should be visible. That could support using quantitative risk estimates responsibly, but it does not implement the requested handling temporary risk within operational constraints.
C:A trigger ensures assessment happens before irreversible commitments. That could support triggering event-driven risk reassessment, but it does not implement the requested handling temporary risk within operational constraints.
Question 275
A new vulnerability patch must be delayed for two weeks because it breaks a life-critical monitoring system. Which evidence best demonstrates the intended business and security outcome?
- Verify key subcontractors and access paths are identified in the supplier risk record
- Verify a sample control operates as intended before recognizing its treatment benefit
- Verify interim restrictions reduce exploit reach while the monitoring system remains functional
- Verify the prioritized control set demonstrably reduces the key business loss scenarios
Explanation
Correct Answer
C:Dual-condition testing supports a defensible delay.
Incorrect Answers
A:Visibility is necessary for informed treatment. This provides evidence for assessing fourth-party and supply-chain concentration risk, not proof of handling temporary risk within operational constraints.
B:Operating evidence establishes whether risk was reduced. This provides evidence for distinguishing planned controls from effective controls, not proof of handling temporary risk within operational constraints.
D:The review should test treatment coverage, not purchase count. This provides evidence for selecting risk treatments from business scenarios, not proof of handling temporary risk within operational constraints.
Question 276
A new vulnerability patch must be delayed for two weeks because it breaks a life-critical monitoring system. Which recurring management review most directly addresses future drift?
- Revisit the rating when implementation evidence or performance changes
- Reassess after new attacker tactics or business communication patterns appear
- Escalate missed patch milestones and reassess emerging exploitation evidence
- Reassess the risk when recovery dependencies or operating conditions change
Explanation
Correct Answer
C:Temporary plans need firm review triggers.
Incorrect Answers
A:Ratings must reflect the actual control state. It may help maintain distinguishing planned controls from effective controls, whereas the stated continuing risk concerns handling temporary risk within operational constraints.
B:A static control mix can lose effectiveness. It may help maintain evaluating control effectiveness instead of activity, whereas the stated continuing risk concerns handling temporary risk within operational constraints.
D:Resilience evidence ages with architecture. It may help maintain distinguishing test plans from demonstrated resilience, whereas the stated continuing risk concerns handling temporary risk within operational constraints.
Question 277
A corporation calculates annualized loss expectancy for a rare event but presents one precise dollar value as guaranteed. Which decision should the information security manager prioritize?
- Evaluate the firewall rule against the specific exploit pathway and remaining business exposure
- Reassess the weakness using observed exploitation, exposure, and critical service impact
- Present ALE as a decision aid with assumptions, variability, and sensitivity ranges
- Keep risks open until promised mitigation is implemented and validated, with approved interim treatment
Explanation
Correct Answer
C:Expected values are not promises about actual yearly loss.
Incorrect Answers
A:A network rule may not block other vectors or remove the vulnerability. However, it does not make the decision needed for using quantitative risk estimates responsibly in this scenario.
B:Threat activity may outweigh a generic severity label. However, it does not make the decision needed for using quantitative risk estimates responsibly in this scenario.
D:Provider commitments do not reduce today's residual exposure automatically. However, it does not make the decision needed for using quantitative risk estimates responsibly in this scenario.
Question 278
A corporation calculates annualized loss expectancy for a rare event but presents one precise dollar value as guaranteed. During implementation, which action most directly executes the necessary response?
- Document the selected frequency and magnitude inputs with uncertainty scenarios
- Link waivers to assessed scenarios, compensating controls, duration, and approving authority
- Link shared causes to combined business consequences and document dependency assumptions
- Map each candidate control to specific scenarios, residual impact, and implementation dependencies
Explanation
Correct Answer
A:Known modeling limitations should be visible.
Incorrect Answers
B:Explicit links protect against unauthorized risk transfer. That could support separating control waivers from approved risk decisions, but it does not implement the requested using quantitative risk estimates responsibly.
C:Consistent scenario modeling prevents inflated totals. That could support avoiding double counting of scenario consequences, but it does not implement the requested using quantitative risk estimates responsibly.
D:Traceability prevents arbitrary purchases. That could support selecting risk treatments from business scenarios, but it does not implement the requested using quantitative risk estimates responsibly.
Question 279
A corporation calculates annualized loss expectancy for a rare event but presents one precise dollar value as guaranteed. What would provide the strongest practical verification of this requirement?
- Compare treatment rankings under optimistic and pessimistic assumptions
- Verify a sample control operates as intended before recognizing its treatment benefit
- Confirm owners approve the selected treatment on the basis of risk and costs
- Verify the risk owner can explain why the changed likelihood affects the treatment choice
Explanation
Correct Answer
A:Sensitivity indicates whether the decision is robust.
Incorrect Answers
B:Operating evidence establishes whether risk was reduced. This provides evidence for distinguishing planned controls from effective controls, not proof of using quantitative risk estimates responsibly.
C:Approval requires more than a control recommendation. This provides evidence for applying a cost-aware risk treatment process, not proof of using quantitative risk estimates responsibly.
D:A documented decision links threat intelligence to action. This provides evidence for integrating active threat intelligence into risk treatment, not proof of using quantitative risk estimates responsibly.
Question 280
A corporation calculates annualized loss expectancy for a rare event but presents one precise dollar value as guaranteed. Which follow-up is most relevant as the environment changes?
- Track the migration milestone and close the waiver when the obsolete component retires
- Update the model after near-misses, insurance studies, or site changes
- Reassess after new attacker tactics or business communication patterns appear
- Calibrate the model with new incidents and credible external data
Explanation
Correct Answer
D:Risk estimates should learn from observed outcomes.
Incorrect Answers
A:Exceptions must not survive their original justification. It may help maintain evaluating compensating controls for a documented exception, whereas the stated continuing risk concerns using quantitative risk estimates responsibly.
B:New data should refine the estimate. It may help maintain representing uncertainty in risk estimates, whereas the stated continuing risk concerns using quantitative risk estimates responsibly.
C:A static control mix can lose effectiveness. It may help maintain evaluating control effectiveness instead of activity, whereas the stated continuing risk concerns using quantitative risk estimates responsibly.
Certified Information Security Manager (CISM) Practice Tests
