100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 280
A corporation calculates annualized loss expectancy for a rare event but presents one precise dollar value as guaranteed. Which follow-up is most relevant as the environment changes?
- Track the migration milestone and close the waiver when the obsolete component retires
- Update the model after near-misses, insurance studies, or site changes
- Reassess after new attacker tactics or business communication patterns appear
- Calibrate the model with new incidents and credible external data
Explanation
Correct Answer
D:Risk estimates should learn from observed outcomes.
Incorrect Answers
A:Exceptions must not survive their original justification. It may help maintain evaluating compensating controls for a documented exception, whereas the stated continuing risk concerns using quantitative risk estimates responsibly.
B:New data should refine the estimate. It may help maintain representing uncertainty in risk estimates, whereas the stated continuing risk concerns using quantitative risk estimates responsibly.
C:A static control mix can lose effectiveness. It may help maintain evaluating control effectiveness instead of activity, whereas the stated continuing risk concerns using quantitative risk estimates responsibly.
Question 281
A security manager is asked to prioritize authentication, backup, and segmentation without knowing the dominant business failure scenarios. Which management decision most directly addresses the stated business need?
- Prioritize treatment using exploitability, asset criticality, exposure, and business impact
- Assess threat pathways and business impact before selecting the control portfolio
- Approve common impact, likelihood, and escalation criteria before consolidating scores
- Evaluate plausible severe-impact scenarios in relation to enterprise resilience and risk appetite
Explanation
Correct Answer
B:A collection of popular controls may miss the largest risks.
Incorrect Answers
A:A severity score alone does not define the organization's priority. However, it does not make the decision needed for selecting risk treatments from business scenarios in this scenario.
C:Numbers without shared definitions cannot be compared meaningfully. However, it does not make the decision needed for selecting risk treatments from business scenarios in this scenario.
D:Low frequency does not make existential impact acceptable by default. However, it does not make the decision needed for selecting risk treatments from business scenarios in this scenario.
Question 282
A security manager is asked to prioritize authentication, backup, and segmentation without knowing the dominant business failure scenarios. Which implementation step best translates the requirement into an operating control?
- Map responsibilities and supporting evidence for each critical shared cloud control
- Map each candidate control to specific scenarios, residual impact, and implementation dependencies
- Define success criteria for data integrity, RTO, RPO, and required business dependencies
- Document the selected frequency and magnitude inputs with uncertainty scenarios
Explanation
Correct Answer
B:Traceability prevents arbitrary purchases.
Incorrect Answers
A:A control matrix avoids assuming the provider operates everything. That could support allocating shared-responsibility risk accurately, but it does not implement the requested selecting risk treatments from business scenarios.
C:Criteria ensure testing measures real recovery obligations. That could support distinguishing test plans from demonstrated resilience, but it does not implement the requested selecting risk treatments from business scenarios.
D:Known modeling limitations should be visible. That could support using quantitative risk estimates responsibly, but it does not implement the requested selecting risk treatments from business scenarios.
Question 283
A security manager is asked to prioritize authentication, backup, and segmentation without knowing the dominant business failure scenarios. Which validation best confirms the control meets the stated need?
- Verify an unresolved high-risk finding is reflected in the owner's treatment decision
- Choose a nontechnical failure scenario and verify it appears in the consolidated risk assessment
- Verify the risk owner can explain why the changed likelihood affects the treatment choice
- Verify the prioritized control set demonstrably reduces the key business loss scenarios
Explanation
Correct Answer
D:The review should test treatment coverage, not purchase count.
Incorrect Answers
A:The exception must affect management action, not just notes. This provides evidence for reconciling conflicting third-party risk evidence, not proof of selecting risk treatments from business scenarios.
B:A representative test validates coverage beyond scanning. This provides evidence for recognizing limits of evidence and assessment coverage, not proof of selecting risk treatments from business scenarios.
C:A documented decision links threat intelligence to action. This provides evidence for integrating active threat intelligence into risk treatment, not proof of selecting risk treatments from business scenarios.
Question 284
A security manager is asked to prioritize authentication, backup, and segmentation without knowing the dominant business failure scenarios. What continuing control would best preserve the intended outcome?
- Reassess when actual industry attacks or internal signals change threat plausibility
- Reassess assumptions when dependencies, geography, or recovery capabilities change
- Revisit priorities as attack paths and business services change
- Reassess the service risk after major API dependencies or transaction volumes change
Explanation
Correct Answer
C:Threat-driven control portfolios require maintenance.
Incorrect Answers
A:Emerging risk should respond to evidence. It may help maintain evaluating emerging threats under uncertainty, whereas the stated continuing risk concerns selecting risk treatments from business scenarios.
B:Severe-event exposures are sensitive to systemic shifts. It may help maintain considering low-frequency catastrophic impact, whereas the stated continuing risk concerns selecting risk treatments from business scenarios.
D:Exposure can shift after the launch baseline is established. It may help maintain assessing material risk before a business launch, whereas the stated continuing risk concerns selecting risk treatments from business scenarios.
Question 285
A new data-processing vendor stores encrypted customer records but holds the encryption keys itself. What is the MOST appropriate first management decision for this situation?
- Assess threat pathways and business impact before selecting the control portfolio
- Assess whether provider-held key access matches the business's confidentiality requirements and appetite
- Assess net residual business risk and service consequences before approving the control
- Evaluate correlated failure and concentration risk at the shared provider level
Explanation
Correct Answer
B:Encryption claims alone do not establish separation of control.
Incorrect Answers
A:A collection of popular controls may miss the largest risks. However, it does not make the decision needed for evaluating key custody as a third-party risk in this scenario.
C:Effective treatment must address both security exposure and operational harm. However, it does not make the decision needed for evaluating key custody as a third-party risk in this scenario.
D:Independent product risk scores can underestimate common dependencies. However, it does not make the decision needed for evaluating key custody as a third-party risk in this scenario.
Question 286
A new data-processing vendor stores encrypted customer records but holds the encryption keys itself. What should the manager arrange during rollout to meet this requirement?
- Review policy coverage, exclusions, deductibles, and control obligations with the risk owner
- Review key administration, logging, access restrictions, contractual obligations, and recovery responsibility
- Request proportionate assurance or contractual rights over material downstream processing
- Review simulated attacks, reporting quality, authentication, and account-recovery controls together
Explanation
Correct Answer
B:Key custody details determine practical exposure.
Incorrect Answers
A:Residual operational loss may remain even when some costs are insured. That could support understanding the limitations of risk transfer, but it does not implement the requested evaluating key custody as a third-party risk.
C:Controls must follow critical information beyond the first provider. That could support assessing fourth-party and supply-chain concentration risk, but it does not implement the requested evaluating key custody as a third-party risk.
D:Layered effectiveness is more informative than a single awareness metric. That could support evaluating control effectiveness instead of activity, but it does not implement the requested evaluating key custody as a third-party risk.
Question 287
A new data-processing vendor stores encrypted customer records but holds the encryption keys itself. Which test most directly verifies the desired managerial outcome?
- Compare treatment rankings under optimistic and pessimistic assumptions
- Validate who can decrypt representative records under a documented provider compromise scenario
- Choose a nontechnical failure scenario and verify it appears in the consolidated risk assessment
- Test a realistic outage scenario against the policy and continuity requirements
Explanation
Correct Answer
B:An access-path test reveals residual confidentiality risk.
Incorrect Answers
A:Sensitivity indicates whether the decision is robust. This provides evidence for using quantitative risk estimates responsibly, not proof of evaluating key custody as a third-party risk.
C:A representative test validates coverage beyond scanning. This provides evidence for recognizing limits of evidence and assessment coverage, not proof of evaluating key custody as a third-party risk.
D:The review reveals uninsured consequences and recovery gaps. This provides evidence for understanding the limitations of risk transfer, not proof of evaluating key custody as a third-party risk.
Question 288
A new data-processing vendor stores encrypted customer records but holds the encryption keys itself. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Monitor provider key-management changes and privileged-access findings
- Track provider resilience evidence and diversification or exit options over time
- Update the model after near-misses, insurance studies, or site changes
- Review threat and exposure assumptions after maintenance windows and network changes
Explanation
Correct Answer
A:Custody arrangements can change after onboarding.
Incorrect Answers
B:Dependency concentration can intensify with growth. It may help maintain assessing common-cause dependency risk, whereas the stated continuing risk concerns evaluating key custody as a third-party risk.
C:New data should refine the estimate. It may help maintain representing uncertainty in risk estimates, whereas the stated continuing risk concerns evaluating key custody as a third-party risk.
D:Previously unavailable evidence may become safely collectible. It may help maintain assessing risk when testing could interrupt operations, whereas the stated continuing risk concerns evaluating key custody as a third-party risk.
Question 289
A risk owner changes a material risk to low after a planned disaster recovery test without actual recovery results. Which management approach best satisfies the primary requirement?
- Rate current residual risk using implemented and operating controls, not planned purchases
- Escalate independent adverse evidence and revise the residual supplier risk assessment
- Retain the current risk rating until a meaningful recovery test provides evidence of treatment effectiveness
- Escalate the evidence gap as residual third-party risk to the accountable service owner
Explanation
Correct Answer
C:A planned exercise is not proof of restored service.
Incorrect Answers
A:A future capability cannot yet reduce present exposure. However, it does not make the decision needed for distinguishing test plans from demonstrated resilience in this scenario.
B:A favorable self-attestation must not override validated control failures. However, it does not make the decision needed for distinguishing test plans from demonstrated resilience in this scenario.
D:Questionnaire completion is not proof of subcontractor control. However, it does not make the decision needed for distinguishing test plans from demonstrated resilience in this scenario.
Question 290
A risk owner changes a material risk to low after a planned disaster recovery test without actual recovery results. Which concrete action would best operationalize the needed approach?
- Assign business data owners and map processing locations, integrations, and classifications
- Document assumptions, plausible loss bands, frequency, and critical dependencies
- Map each candidate control to specific scenarios, residual impact, and implementation dependencies
- Define success criteria for data integrity, RTO, RPO, and required business dependencies
Explanation
Correct Answer
D:Criteria ensure testing measures real recovery obligations.
Incorrect Answers
A:A current map supports targeted controls and impact analysis. That could support using asset ownership to support risk assessment, but it does not implement the requested distinguishing test plans from demonstrated resilience.
B:Transparent estimates let owners judge confidence. That could support representing uncertainty in risk estimates, but it does not implement the requested distinguishing test plans from demonstrated resilience.
C:Traceability prevents arbitrary purchases. That could support selecting risk treatments from business scenarios, but it does not implement the requested distinguishing test plans from demonstrated resilience.
Certified Information Security Manager (CISM) Practice Tests
