100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 30
A merger leaves incompatible identity directories and overlapping privileged administrators. What should the manager arrange during rollout to meet this requirement?
- Introduce risk-based security checkpoints at business-case and design approval stages
- Map local categories to the enterprise taxonomy and define ownership and handling rules
- Define trust zones, identity federation decisions, privileged-account ownership, and migration stages
- Document the RACI for key custody, data ownership, control operations, and risk acceptance
Explanation
Correct Answer
C:Explicit interfaces reduce unmanaged access during consolidation.
Incorrect Answers
A:Early engagement links risk to business choices. That could support embedding security governance in investment decisions, but it does not implement the requested using enterprise architecture to resolve security integration risk.
B:A crosswalk reduces misclassification during consolidation. That could support standardizing enterprise information definitions, but it does not implement the requested using enterprise architecture to resolve security integration risk.
D:A role matrix clarifies who can decide and who can implement. That could support distinguishing control operation from risk ownership, but it does not implement the requested using enterprise architecture to resolve security integration risk.
Question 31
A merger leaves incompatible identity directories and overlapping privileged administrators. Which test most directly verifies the desired managerial outcome?
- Validate one critical data path against the intended trust and authorization principles
- Validate that the roadmap addresses the highest-risk service with a viable business transition plan
- Sample critical obligations in each jurisdiction and verify their approved policy owner and implementation
- Validate that a transferred employee loses legacy privileges and receives only approved target-state access
Explanation
Correct Answer
D:A transition test exposes orphaned identity grants.
Incorrect Answers
A:Actual use-case testing shows architecture relevance. This provides evidence for defining protection priorities before architecture tooling, not proof of using enterprise architecture to resolve security integration risk.
B:A focused check tests prioritization, not simply vendor selection. This provides evidence for linking architecture debt to a funded security roadmap, not proof of using enterprise architecture to resolve security integration risk.
C:Coverage must be established beyond publishing a group-wide document. This provides evidence for harmonizing governance without erasing legal duties, not proof of using enterprise architecture to resolve security integration risk.
Question 32
A merger leaves incompatible identity directories and overlapping privileged administrators. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Repeat assessments after material changes and track capability outcomes, not just scores
- Monitor overdue executive actions and bring exceptions back to the oversight forum
- Track temporary trusts and privilege exceptions until decommissioned
- Reassess cross-entity exceptions when corporate structure or shared-service dependencies change
Explanation
Correct Answer
C:Transitional integration bridges must not become permanent exposure.
Incorrect Answers
A:Maturity should reflect sustained performance. It may help maintain using capability maturity to guide governance decisions, whereas the stated continuing risk concerns using enterprise architecture to resolve security integration risk.
B:Governance should follow through on decisions. It may help maintain demonstrating board-level cyber oversight, whereas the stated continuing risk concerns using enterprise architecture to resolve security integration risk.
D:Shared exposure can outlive the subsidiary decision that created it. It may help maintain resolving subsidiary and enterprise accountability, whereas the stated continuing risk concerns using enterprise architecture to resolve security integration risk.
Question 33
An executive proposes deploying AI assistants before determining which corporate records they may access. Which management approach best satisfies the primary requirement?
- Require a data-flow and information classification architecture review before deployment
- Assess target-state enterprise architecture against business resilience and risk appetite before approving migration
- Require a risk-based mapping of vendor controls to mandatory enterprise outcomes before accepting equivalence
- Bring engineering safety owners into security architecture risk decisions for production systems
Explanation
Correct Answer
A:An AI interface must respect the enterprise's existing information boundaries.
Incorrect Answers
B:Architecture choices change dependencies and the location of exposure. However, it does not make the decision needed for governing enterprise AI access through information architecture in this scenario.
C:Matching framework names is not evidence of comparable protection. However, it does not make the decision needed for governing enterprise AI access through information architecture in this scenario.
D:Availability and safety constraints affect acceptable treatment. However, it does not make the decision needed for governing enterprise AI access through information architecture in this scenario.
Question 34
An executive proposes deploying AI assistants before determining which corporate records they may access. Which concrete action would best operationalize the needed approach?
- Map retrieval sources, identity propagation, data classes, and record retention obligations
- Map inherited policies to enterprise requirements and record approved local deviations
- Compare control intent, scope, assurance evidence, and unaddressed obligations
- Document the RACI for key custody, data ownership, control operations, and risk acceptance
Explanation
Correct Answer
A:A documented architecture clarifies which users and services can access each dataset.
Incorrect Answers
B:A traceable crosswalk prevents gaps during policy consolidation. That could support harmonizing governance without erasing legal duties, but it does not implement the requested governing enterprise AI access through information architecture.
C:The mapping should expose real residual gaps. That could support governing equivalence of external control frameworks, but it does not implement the requested governing enterprise AI access through information architecture.
D:A role matrix clarifies who can decide and who can implement. That could support distinguishing control operation from risk ownership, but it does not implement the requested governing enterprise AI access through information architecture.
Question 35
An executive proposes deploying AI assistants before determining which corporate records they may access. Which evidence best demonstrates the intended business and security outcome?
- Perform a readiness review of data discovery and notification workflows against the new obligations
- Check a representative critical business process against the proposed cloud architecture and defined RTO and RPO
- Test a low-privilege user request against confidential sources and confirm unauthorized passages are not retrieved
- Confirm business stakeholders can demonstrate key decisions and evidence under the tailored processes
Explanation
Correct Answer
C:Access-boundary testing directly probes the risk of cross-user disclosure.
Incorrect Answers
A:A gap test demonstrates practical readiness. This provides evidence for incorporating new legal duties into security strategy, not proof of governing enterprise AI access through information architecture.
B:Architecture assurance links platform choices to business recovery expectations. This provides evidence for integrating enterprise architecture into security strategy, not proof of governing enterprise AI access through information architecture.
D:Working practices matter more than a completed compliance matrix. This provides evidence for selecting a governance framework appropriate to business context, not proof of governing enterprise AI access through information architecture.
Question 36
An executive proposes deploying AI assistants before determining which corporate records they may access. Which recurring management review most directly addresses future drift?
- Review source connectors and access mappings after organizational permission changes
- Refresh metrics when service models or assurance coverage changes across subsidiaries
- Repeat assessments after material changes and track capability outcomes, not just scores
- Review role assignments when the operating model or shared service contract changes
Explanation
Correct Answer
A:New integrations can silently broaden data exposure.
Incorrect Answers
B:Comparability can degrade after reorganizations. It may help maintain establishing comparable group security reporting, whereas the stated continuing risk concerns governing enterprise AI access through information architecture.
C:Maturity should reflect sustained performance. It may help maintain using capability maturity to guide governance decisions, whereas the stated continuing risk concerns governing enterprise AI access through information architecture.
D:Responsibility boundaries can shift without explicit governance. It may help maintain distinguishing control operation from risk ownership, whereas the stated continuing risk concerns governing enterprise AI access through information architecture.
Question 37
A retailer's security strategy invests heavily in tools but lacks connection to its five-year expansion objectives. Which decision should the information security manager prioritize?
- Require a risk-based mapping of vendor controls to mandatory enterprise outcomes before accepting equivalence
- Develop a security strategy based on business expansion risks, capabilities, and tolerance for disruption
- Explain residual information risk and obtain enterprise-approved, risk-based priorities
- Assess defined security governance and management capabilities against an agreed maturity model
Explanation
Correct Answer
B:Security strategy should enable growth while addressing the risks that growth creates.
Incorrect Answers
A:Matching framework names is not evidence of comparable protection. However, it does not make the decision needed for aligning security investment with strategic outcomes in this scenario.
C:Security manages risk rather than eliminating every possible event. However, it does not make the decision needed for aligning security investment with strategic outcomes in this scenario.
D:Tools owned do not measure how reliably processes deliver outcomes. However, it does not make the decision needed for aligning security investment with strategic outcomes in this scenario.
Question 38
A retailer's security strategy invests heavily in tools but lacks connection to its five-year expansion objectives. During implementation, which action most directly executes the necessary response?
- Define the prompt, output, training, and audit data lifecycles with accountable information owners
- Set measurable maturity criteria and obtain evidence from representative divisions
- Prepare a risk decision brief with residual exposure, business impact, alternatives, and authority
- Prepare a multi-year capability roadmap with business owners, dependencies, funding, and measurable outcomes
Explanation
Correct Answer
D:Roadmaps connect strategic intent to deliverable program work.
Incorrect Answers
A:Lifecycle diagrams reveal hidden retention and reuse risks. That could support integrating information architecture and data lifecycle governance, but it does not implement the requested aligning security investment with strategic outcomes.
B:Consistent criteria enable meaningful comparison. That could support using capability maturity to guide governance decisions, but it does not implement the requested aligning security investment with strategic outcomes.
C:Decision-makers need a defensible basis for accepting or treating risk. That could support separating security advice from business risk acceptance, but it does not implement the requested aligning security investment with strategic outcomes.
Question 39
A retailer's security strategy invests heavily in tools but lacks connection to its five-year expansion objectives. What would provide the strongest practical verification of this requirement?
- Trace an encryption exception through operational recommendation and business risk approval
- Trace a breached risk tolerance to board awareness and a recorded direction to management
- Trace each significant proposed investment to a prioritized business capability or accepted risk gap
- Check a representative critical business process against the proposed cloud architecture and defined RTO and RPO
Explanation
Correct Answer
C:A traceability check separates strategy from a product wish list.
Incorrect Answers
A:Separate records show that decisions were not silently delegated. This provides evidence for distinguishing control operation from risk ownership, not proof of aligning security investment with strategic outcomes.
B:Escalation evidence shows the governance framework functions. This provides evidence for demonstrating board-level cyber oversight, not proof of aligning security investment with strategic outcomes.
D:Architecture assurance links platform choices to business recovery expectations. This provides evidence for integrating enterprise architecture into security strategy, not proof of aligning security investment with strategic outcomes.
Question 40
A retailer's security strategy invests heavily in tools but lacks connection to its five-year expansion objectives. Which follow-up is most relevant as the environment changes?
- Reassess expected benefits after delivery milestones and changes in exposure
- Review equivalence when vendor services, standards, or the business use case change
- Reassess priorities when market expansion or digital channel assumptions change
- Revisit migration sequencing when major platforms or cryptographic standards change
Explanation
Correct Answer
C:Strategy needs regular alignment with enterprise direction.
Incorrect Answers
A:Investment governance needs benefits realization. It may help maintain constructing an executive security business case, whereas the stated continuing risk concerns aligning security investment with strategic outcomes.
B:An equivalence decision has a limited context. It may help maintain governing equivalence of external control frameworks, whereas the stated continuing risk concerns aligning security investment with strategic outcomes.
D:A multi-year roadmap must adapt to credible new threats. It may help maintain linking architecture debt to a funded security roadmap, whereas the stated continuing risk concerns aligning security investment with strategic outcomes.
Certified Information Security Manager (CISM) Practice Tests
