100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 390
A developer team runs threat modeling only after releases are complete. During implementation, which action most directly executes the necessary response?
- Pilot required policy cases and migration dependencies with network and business owners
- Use a total lifecycle cost and skills plan with role ownership and handover milestones
- Add security conditions, ownership, and evidence checkpoints to acquisition and onboarding stages
- Define misuse cases, trust boundaries, reviewers, and remediation ownership at design review
Explanation
Correct Answer
D:Repeatable steps support consistent decisions.
Incorrect Answers
A:A controlled trial reveals compatibility and control gaps. That could support selecting technology based on security architecture requirements, but it does not implement the requested integrating secure design earlier in delivery.
B:Operating readiness must precede closure of deployment. That could support planning sustainable security operating resources, but it does not implement the requested integrating secure design earlier in delivery.
C:Integration prevents unreviewed vendor exposure. That could support integrating security into procurement and project intake, but it does not implement the requested integrating secure design earlier in delivery.
Question 391
A developer team runs threat modeling only after releases are complete. What would provide the strongest practical verification of this requirement?
- Verify a major authentication redesign received relevant assurance before production use
- Inspect a major feature for recorded threat decisions and validation of high-risk mitigations
- Sample a high-risk agreement for approved security clauses and any deviations
- Trace a changed interface to affected controls and accountable review decisions
Explanation
Correct Answer
B:A real case shows whether design reviews influence implementation.
Incorrect Answers
A:The test proves change linkage. This provides evidence for aligning assurance frequency with material changes, not proof of integrating secure design earlier in delivery.
C:Contract evidence tests program integration. This provides evidence for embedding the security program in contract governance, not proof of integrating secure design earlier in delivery.
D:Traceability makes architecture operational. This provides evidence for maintaining actionable security architecture artifacts, not proof of integrating secure design earlier in delivery.
Question 392
A developer team runs threat modeling only after releases are complete. Which follow-up is most relevant as the environment changes?
- Refresh content when roles, threats, or incident patterns change
- Review metrics when detection coverage and attack patterns change
- Retest models when APIs, identities, or data flows change materially
- Review zone assumptions when applications or service owners change
Explanation
Correct Answer
C:Threat models age as software evolves.
Incorrect Answers
A:Training must reflect the decisions people now face. It may help maintain designing role-relevant security awareness, whereas the stated continuing risk concerns integrating secure design earlier in delivery.
B:Counts can become incomparable after tooling changes. It may help maintain selecting program performance measures tied to outcomes, whereas the stated continuing risk concerns integrating secure design earlier in delivery.
D:Architectural drift can reopen exposure. It may help maintain using information security architecture to drive segmentation, whereas the stated continuing risk concerns integrating secure design earlier in delivery.
Question 393
An organization uses CI/CD deployment pipelines but secrets appear in build logs. Which management decision most directly addresses the stated business need?
- Protect capabilities that address unacceptable business exposure before lower-impact enhancements
- Treat secret exposure as a priority software supply-chain control failure
- Trigger security testing after high-impact architecture and exposure changes as well as on schedule
- Report material exposure, progress, exceptions, costs, and decisions needed in business language
Explanation
Correct Answer
B:Credentials in logs can enable immediate unauthorized access.
Incorrect Answers
A:Budget reductions should follow risk impact, not equal cuts across teams. However, it does not make the decision needed for securing the software delivery pipeline in this scenario.
C:Annual cadence alone can miss new attack paths. However, it does not make the decision needed for securing the software delivery pipeline in this scenario.
D:Leaders need action-oriented information, not a technical catalog. However, it does not make the decision needed for securing the software delivery pipeline in this scenario.
Question 394
An organization uses CI/CD deployment pipelines but secrets appear in build logs. Which implementation step best translates the requirement into an operating control?
- Implement secret management, masked logs, least-privilege pipeline identities, and rotation
- Map conflicting functions, implement separate roles, and require independent approvals
- Assess inherited systems, identities, key dependencies, and time-bound exceptions
- Define key custody, rotation, separation of duties, backup, revocation, and approved usage
Explanation
Correct Answer
A:Multiple controls reduce exposure if a build step fails.
Incorrect Answers
B:A documented conflict matrix guides authorization. That could support designing preventive controls for conflicting privileges, but it does not implement the requested securing the software delivery pipeline.
C:A staged approach contains exposure during consolidation. That could support integrating acquired operations into the program, but it does not implement the requested securing the software delivery pipeline.
D:Lifecycle rules make encryption operationally reliable. That could support establishing enterprise cryptographic controls, but it does not implement the requested securing the software delivery pipeline.
Question 395
An organization uses CI/CD deployment pipelines but secrets appear in build logs. Which validation best confirms the control meets the stated need?
- Confirm critical shared interfaces meet minimum controls before unrestricted connectivity
- Test that optional data is omitted when the business process does not need it
- Sample discovered data and confirm ownership and corrections are completed within SLA
- Test a seeded synthetic secret and confirm it is not recoverable from build artifacts
Explanation
Correct Answer
D:A controlled test checks the actual leakage route.
Incorrect Answers
A:Boundary tests prevent premature trust. This provides evidence for integrating acquired operations into the program, not proof of securing the software delivery pipeline.
B:The test verifies minimization, not just transport security. This provides evidence for applying data minimization before technical control selection, not proof of securing the software delivery pipeline.
C:Closure evidence demonstrates program effectiveness. This provides evidence for connecting discovery tooling with data accountability, not proof of securing the software delivery pipeline.
Question 396
An organization uses CI/CD deployment pipelines but secrets appear in build logs. What continuing control would best preserve the intended outcome?
- Monitor new asset classes and exclusions as inventory changes
- Monitor credential exposure alerts and rotate any leaked identities promptly
- Monitor false positives and new external collaboration patterns
- Monitor exception growth and stale temporary access grants
Explanation
Correct Answer
B:Pipeline changes can reintroduce secrets.
Incorrect Answers
A:A metric's validity depends on scope. It may help maintain correcting misleading control effectiveness reporting, whereas the stated continuing risk concerns securing the software delivery pipeline.
C:Egress patterns evolve with business operations. It may help maintain selecting protective controls from business use cases, whereas the stated continuing risk concerns securing the software delivery pipeline.
D:Policy erosion often happens gradually. It may help maintain governing security policy exceptions for privileged access, whereas the stated continuing risk concerns securing the software delivery pipeline.
Question 397
A major software supplier provides binary updates without verifiable provenance. What is the MOST appropriate first management decision for this situation?
- Segment partner access by business function, sensitivity, and identity assurance
- Require recovery key access and continuity responsibilities that preserve segregation of duties
- Require provenance, trusted release signing, and supplier assurance proportional to business criticality
- Apply risk-based device and access control profiles that reflect business criticality
Explanation
Correct Answer
C:Unverified updates can bypass application controls.
Incorrect Answers
A:A universal trust boundary exposes unrelated systems. However, it does not make the decision needed for establishing software supply-chain integrity in this scenario.
B:Encryption that prevents restoration fails a critical business objective. However, it does not make the decision needed for establishing software supply-chain integrity in this scenario.
D:Uniform controls can create costs without proportional protection. However, it does not make the decision needed for establishing software supply-chain integrity in this scenario.
Question 398
A major software supplier provides binary updates without verifiable provenance. What should the manager arrange during rollout to meet this requirement?
- Add standardized security schedules and routing for nonstandard supplier terms
- Add artifact verification and restricted build/deploy access to supplier acceptance criteria
- Build service requirements and a transition plan with business dependencies and clear accountability
- Define notice, retention, access, permitted analytics, and audit controls for monitoring datasets
Explanation
Correct Answer
B:The program should authenticate releases before production use.
Incorrect Answers
A:Controls should apply before contracts are signed. That could support embedding the security program in contract governance, but it does not implement the requested establishing software supply-chain integrity.
C:Changing vendors without a plan can create coverage gaps. That could support evaluating the security operating model from measurable outcomes, but it does not implement the requested establishing software supply-chain integrity.
D:Governance translates permissible purposes into procedures. That could support designing lawful and proportionate monitoring, but it does not implement the requested establishing software supply-chain integrity.
Question 399
A major software supplier provides binary updates without verifiable provenance. Which test most directly verifies the desired managerial outcome?
- Test a controlled recovery path for authorization, traceability, and time-bounded use
- Attempt a tampered test artifact and confirm deployment controls reject it
- Test attempted unauthorized movement across a critical zone boundary
- Test that restricted records are excluded from unapproved prompts and connector logs
Explanation
Correct Answer
B:Integrity verification should fail closed.
Incorrect Answers
A:Assurance should verify emergency procedures without disabling them. This provides evidence for measuring identity-control coverage against critical paths, not proof of establishing software supply-chain integrity.
C:An adversarial path confirms containment. This provides evidence for using information security architecture to drive segmentation, not proof of establishing software supply-chain integrity.
D:An end-to-end test probes the actual disclosure path. This provides evidence for governing permitted AI data processing, not proof of establishing software supply-chain integrity.
Question 400
A major software supplier provides binary updates without verifiable provenance. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Review untested material changes and outstanding assurance exceptions regularly
- Review contract renewals for control changes and missing assurance rights
- Revoke or reassess vendor roles after support tickets and contract renewals
- Review supplier build assurance and key compromise notices over time
Explanation
Correct Answer
D:Trust in signing material requires maintenance.
Incorrect Answers
A:Coverage should not depend on memory. It may help maintain aligning assurance frequency with material changes, whereas the stated continuing risk concerns establishing software supply-chain integrity.
B:A prior agreement may become inadequate. It may help maintain embedding the security program in contract governance, whereas the stated continuing risk concerns establishing software supply-chain integrity.
C:Temporary access should not become persistent. It may help maintain implementing time-limited privileged vendor access, whereas the stated continuing risk concerns establishing software supply-chain integrity.
Certified Information Security Manager (CISM) Practice Tests
