100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 290
A risk owner changes a material risk to low after a planned disaster recovery test without actual recovery results. Which concrete action would best operationalize the needed approach?
- Assign business data owners and map processing locations, integrations, and classifications
- Document assumptions, plausible loss bands, frequency, and critical dependencies
- Map each candidate control to specific scenarios, residual impact, and implementation dependencies
- Define success criteria for data integrity, RTO, RPO, and required business dependencies
Explanation
Correct Answer
D:Criteria ensure testing measures real recovery obligations.
Incorrect Answers
A:A current map supports targeted controls and impact analysis. That could support using asset ownership to support risk assessment, but it does not implement the requested distinguishing test plans from demonstrated resilience.
B:Transparent estimates let owners judge confidence. That could support representing uncertainty in risk estimates, but it does not implement the requested distinguishing test plans from demonstrated resilience.
C:Traceability prevents arbitrary purchases. That could support selecting risk treatments from business scenarios, but it does not implement the requested distinguishing test plans from demonstrated resilience.
Question 291
A risk owner changes a material risk to low after a planned disaster recovery test without actual recovery results. Which evidence best demonstrates the intended business and security outcome?
- Review test results and exceptions against the approved recovery requirements
- Use a tabletop or red-team exercise to test key decision and detection assumptions
- Present the decision owner with catastrophic outcomes and recovery capability evidence
- Validate compensating controls against unauthorized access attempts and confirm approval authority
Explanation
Correct Answer
A:Observed outcomes determine actual residual exposure.
Incorrect Answers
B:Controlled evidence informs risk estimates without claiming certainty. This provides evidence for evaluating emerging threats under uncertainty, not proof of distinguishing test plans from demonstrated resilience.
C:Management should explicitly consider survivability. This provides evidence for considering low-frequency catastrophic impact, not proof of distinguishing test plans from demonstrated resilience.
D:Evidence is needed before accepting an exception. This provides evidence for evaluating compensating controls for a documented exception, not proof of distinguishing test plans from demonstrated resilience.
Question 292
A risk owner changes a material risk to low after a planned disaster recovery test without actual recovery results. Which recurring management review most directly addresses future drift?
- Reassess the risk when recovery dependencies or operating conditions change
- Review scenario taxonomy after emerging incident patterns change impact pathways
- Escalate missed patch milestones and reassess emerging exploitation evidence
- Review newly introduced dependencies and unsupported tools as part of continuous risk discovery
Explanation
Correct Answer
A:Resilience evidence ages with architecture.
Incorrect Answers
B:Model categories must follow actual enterprise risk. It may help maintain avoiding double counting of scenario consequences, whereas the stated continuing risk concerns distinguishing test plans from demonstrated resilience.
C:Temporary plans need firm review triggers. It may help maintain handling temporary risk within operational constraints, whereas the stated continuing risk concerns distinguishing test plans from demonstrated resilience.
D:Technical coverage changes over time. It may help maintain recognizing limits of evidence and assessment coverage, whereas the stated continuing risk concerns distinguishing test plans from demonstrated resilience.
Question 293
A company chooses to avoid risk by exiting a market that requires insecure unsupported payment technology. Which decision should the information security manager prioritize?
- Prioritize treatment using exploitability, asset criticality, exposure, and business impact
- Validate that exiting the activity actually removes the associated exposure and dependencies
- Evaluate liability, accountability, and residual exposure before treating outsourcing as risk transfer
- Assess combined phishing controls and residual business exposure using outcome evidence
Explanation
Correct Answer
B:Risk avoidance means ceasing the risky activity, not merely renaming it.
Incorrect Answers
A:A severity score alone does not define the organization's priority. However, it does not make the decision needed for confirming genuine risk avoidance in this scenario.
C:Contracting out processing rarely eliminates regulatory or reputational consequences. However, it does not make the decision needed for confirming genuine risk avoidance in this scenario.
D:Training completion does not prove attacks are prevented. However, it does not make the decision needed for confirming genuine risk avoidance in this scenario.
Question 294
A company chooses to avoid risk by exiting a market that requires insecure unsupported payment technology. During implementation, which action most directly executes the necessary response?
- Decommission affected services, revoke access, and transfer or delete retained data under policy
- Assign business data owners and map processing locations, integrations, and classifications
- Define success criteria for data integrity, RTO, RPO, and required business dependencies
- Map the control to protected business services and record an explicit risk acceptance chain
Explanation
Correct Answer
A:Residual data and contracts can preserve exposure after exit.
Incorrect Answers
B:A current map supports targeted controls and impact analysis. That could support using asset ownership to support risk assessment, but it does not implement the requested confirming genuine risk avoidance.
C:Criteria ensure testing measures real recovery obligations. That could support distinguishing test plans from demonstrated resilience, but it does not implement the requested confirming genuine risk avoidance.
D:Responsibility should follow the impact. That could support identifying the correct information risk owner, but it does not implement the requested confirming genuine risk avoidance.
Question 295
A company chooses to avoid risk by exiting a market that requires insecure unsupported payment technology. What would provide the strongest practical verification of this requirement?
- Verify no business processing or external dependency remains in the retired operation
- Verify a sample control operates as intended before recognizing its treatment benefit
- Verify the risk owner can explain why the changed likelihood affects the treatment choice
- Verify key subcontractors and access paths are identified in the supplier risk record
Explanation
Correct Answer
A:A completion test demonstrates actual avoidance.
Incorrect Answers
B:Operating evidence establishes whether risk was reduced. This provides evidence for distinguishing planned controls from effective controls, not proof of confirming genuine risk avoidance.
C:A documented decision links threat intelligence to action. This provides evidence for integrating active threat intelligence into risk treatment, not proof of confirming genuine risk avoidance.
D:Visibility is necessary for informed treatment. This provides evidence for assessing fourth-party and supply-chain concentration risk, not proof of confirming genuine risk avoidance.
Question 296
A company chooses to avoid risk by exiting a market that requires insecure unsupported payment technology. Which follow-up is most relevant as the environment changes?
- Track provider resilience evidence and diversification or exit options over time
- Monitor downstream provider changes and risk indicators during contract operation
- Monitor residual contractual and retention obligations after exit
- Review production service quality and residual threat indicators after rollout
Explanation
Correct Answer
C:Some liabilities continue after operations end.
Incorrect Answers
A:Dependency concentration can intensify with growth. It may help maintain assessing common-cause dependency risk, whereas the stated continuing risk concerns confirming genuine risk avoidance.
B:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns confirming genuine risk avoidance.
D:Control effectiveness can shift when usage changes. It may help maintain balancing security response and business impacts, whereas the stated continuing risk concerns confirming genuine risk avoidance.
Question 297
A critical business service has several moderate risk findings that share one vulnerable central identity provider. Which management decision most directly addresses the stated business need?
- Escalate independent adverse evidence and revise the residual supplier risk assessment
- Assess threat pathways and business impact before selecting the control portfolio
- Assess net residual business risk and service consequences before approving the control
- Assess the combined identity compromise pathway rather than treating findings as independent
Explanation
Correct Answer
D:Several small weaknesses may enable one material loss event.
Incorrect Answers
A:A favorable self-attestation must not override validated control failures. However, it does not make the decision needed for recognizing correlated weaknesses in risk aggregation in this scenario.
B:A collection of popular controls may miss the largest risks. However, it does not make the decision needed for recognizing correlated weaknesses in risk aggregation in this scenario.
C:Effective treatment must address both security exposure and operational harm. However, it does not make the decision needed for recognizing correlated weaknesses in risk aggregation in this scenario.
Question 298
A critical business service has several moderate risk findings that share one vulnerable central identity provider. Which implementation step best translates the requirement into an operating control?
- Pilot the mitigation with performance thresholds and evidence of attack-path reduction
- Review simulated attacks, reporting quality, authentication, and account-recovery controls together
- Combine credible intelligence with identity controls, workforce patterns, and known attack paths
- Map attack chains linking permissions, federation, recovery, and privileged access
Explanation
Correct Answer
D:Dependency analysis exposes plausible escalation.
Incorrect Answers
A:A controlled test reveals tradeoffs early. That could support balancing security response and business impacts, but it does not implement the requested recognizing correlated weaknesses in risk aggregation.
B:Layered effectiveness is more informative than a single awareness metric. That could support evaluating control effectiveness instead of activity, but it does not implement the requested recognizing correlated weaknesses in risk aggregation.
C:Context distinguishes credible scenarios from hype. That could support evaluating emerging threats under uncertainty, but it does not implement the requested recognizing correlated weaknesses in risk aggregation.
Question 299
A critical business service has several moderate risk findings that share one vulnerable central identity provider. Which validation best confirms the control meets the stated need?
- Inspect a sample high-impact change for updated risk owners and treatment decisions
- Confirm critical process owners agree on impact scenarios and the remaining evidence limitations
- Walk through a credible attacker path and compare total business impact to appetite
- Compare treatment rankings under optimistic and pessimistic assumptions
Explanation
Correct Answer
C:End-to-end scenarios reveal combined significance.
Incorrect Answers
A:A traceable review proves change integration. This provides evidence for triggering event-driven risk reassessment, not proof of recognizing correlated weaknesses in risk aggregation.
B:Assumptions should be visible rather than silently treated as facts. This provides evidence for assessing risk when testing could interrupt operations, not proof of recognizing correlated weaknesses in risk aggregation.
D:Sensitivity indicates whether the decision is robust. This provides evidence for using quantitative risk estimates responsibly, not proof of recognizing correlated weaknesses in risk aggregation.
Question 300
A critical business service has several moderate risk findings that share one vulnerable central identity provider. What continuing control would best preserve the intended outcome?
- Monitor downstream provider changes and risk indicators during contract operation
- Escalate missed patch milestones and reassess emerging exploitation evidence
- Reassess when actual industry attacks or internal signals change threat plausibility
- Reassess after identity architecture and privilege changes
Explanation
Correct Answer
D:Correlated risk evolves with the trust fabric.
Incorrect Answers
A:Supply chains evolve between annual reviews. It may help maintain assessing fourth-party and supply-chain concentration risk, whereas the stated continuing risk concerns recognizing correlated weaknesses in risk aggregation.
B:Temporary plans need firm review triggers. It may help maintain handling temporary risk within operational constraints, whereas the stated continuing risk concerns recognizing correlated weaknesses in risk aggregation.
C:Emerging risk should respond to evidence. It may help maintain evaluating emerging threats under uncertainty, whereas the stated continuing risk concerns recognizing correlated weaknesses in risk aggregation.
Certified Information Security Manager (CISM) Practice Tests
