100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 400
A major software supplier provides binary updates without verifiable provenance. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Review untested material changes and outstanding assurance exceptions regularly
- Review contract renewals for control changes and missing assurance rights
- Revoke or reassess vendor roles after support tickets and contract renewals
- Review supplier build assurance and key compromise notices over time
Explanation
Correct Answer
D:Trust in signing material requires maintenance.
Incorrect Answers
A:Coverage should not depend on memory. It may help maintain aligning assurance frequency with material changes, whereas the stated continuing risk concerns establishing software supply-chain integrity.
B:A prior agreement may become inadequate. It may help maintain embedding the security program in contract governance, whereas the stated continuing risk concerns establishing software supply-chain integrity.
C:Temporary access should not become persistent. It may help maintain implementing time-limited privileged vendor access, whereas the stated continuing risk concerns establishing software supply-chain integrity.
Question 401
A business unit stores backup encryption keys with the same privileged admins who can delete all backups. Which management approach best satisfies the primary requirement?
- Create a consistent classification scheme led by accountable data owners
- Assign business data owners and remediation duties before scaling automated discovery
- Create an information security program for AI use based on classification, access, and permitted data processing
- Establish independently controlled backup and key-recovery privileges for critical data
Explanation
Correct Answer
D:One compromised admin path should not destroy both production and recovery options.
Incorrect Answers
A:Control selection depends on common understanding of information value. However, it does not make the decision needed for separating backup recovery trust from production administration in this scenario.
B:Discovering records does not resolve their sensitivity or lawful use. However, it does not make the decision needed for separating backup recovery trust from production administration in this scenario.
C:AI deployment must fit corporate information governance rather than tool-by-tool promises. However, it does not make the decision needed for separating backup recovery trust from production administration in this scenario.
Question 402
A business unit stores backup encryption keys with the same privileged admins who can delete all backups. Which concrete action would best operationalize the needed approach?
- Define user tiers, information access patterns, and device risk criteria with owners
- Classify data pathways and use risk-tiered access and monitoring policies with owners
- Separate access, preserve immutable copies, and require independent recovery approvals
- Define notice, retention, access, permitted analytics, and audit controls for monitoring datasets
Explanation
Correct Answer
C:Layered recovery controls reduce common-cause compromise.
Incorrect Answers
A:Classification guides appropriate control strength. That could support tailoring controls to data and user risk, but it does not implement the requested separating backup recovery trust from production administration.
B:Business context guides policy conditions. That could support selecting protective controls from business use cases, but it does not implement the requested separating backup recovery trust from production administration.
D:Governance translates permissible purposes into procedures. That could support designing lawful and proportionate monitoring, but it does not implement the requested separating backup recovery trust from production administration.
Question 403
A business unit stores backup encryption keys with the same privileged admins who can delete all backups. Which evidence best demonstrates the intended business and security outcome?
- Time a controlled suspicious-payment report and verify correct escalation
- Verify a major authentication redesign received relevant assurance before production use
- Run a controlled restoration with production administrators excluded from protected key custody
- Test a controlled recovery path for authorization, traceability, and time-bounded use
Explanation
Correct Answer
C:An exercise tests independence as well as data recovery.
Incorrect Answers
A:Measured action demonstrates the intended behavior. This provides evidence for making awareness support incident readiness, not proof of separating backup recovery trust from production administration.
B:The test proves change linkage. This provides evidence for aligning assurance frequency with material changes, not proof of separating backup recovery trust from production administration.
D:Assurance should verify emergency procedures without disabling them. This provides evidence for measuring identity-control coverage against critical paths, not proof of separating backup recovery trust from production administration.
Question 404
A business unit stores backup encryption keys with the same privileged admins who can delete all backups. Which recurring management review most directly addresses future drift?
- Review privileged backup grants and immutable retention settings after platform changes
- Track performance, costs, and retention of key expertise after transition
- Review skills gaps after workforce changes and new tool adoption
- Monitor new asset classes and exclusions as inventory changes
Explanation
Correct Answer
A:Recovery trust can degrade through configuration drift.
Incorrect Answers
B:The operating model needs ongoing governance. It may help maintain evaluating the security operating model from measurable outcomes, whereas the stated continuing risk concerns separating backup recovery trust from production administration.
C:Capabilities deteriorate without continued learning. It may help maintain ensuring people, process, and technology are balanced, whereas the stated continuing risk concerns separating backup recovery trust from production administration.
D:A metric's validity depends on scope. It may help maintain correcting misleading control effectiveness reporting, whereas the stated continuing risk concerns separating backup recovery trust from production administration.
Question 405
A company deploys SSO for workforce apps but fails to disable accounts promptly when contractors leave. Which decision should the information security manager prioritize?
- Integrate joiner-mover-leaver provisioning and deprovisioning with business ownership
- Set metric lineage, reconciliation, and ownership controls before relying on dashboard decisions
- Standardize incident classification, measure definitions, and reporting ownership
- Assign data ownership and implement classification, retention, and disposal controls based on business need
Explanation
Correct Answer
A:SSO convenience does not guarantee prompt removal of access.
Incorrect Answers
B:Untrusted reports cannot govern risk accurately. However, it does not make the decision needed for designing identity lifecycle controls beyond login in this scenario.
C:Unaligned severity scales make response metrics incomparable. However, it does not make the decision needed for designing identity lifecycle controls beyond login in this scenario.
D:Security includes knowing what is kept and why. However, it does not make the decision needed for designing identity lifecycle controls beyond login in this scenario.
Question 406
A company deploys SSO for workforce apps but fails to disable accounts promptly when contractors leave. During implementation, which action most directly executes the necessary response?
- Specify screening, approval, session logging, termination, and independent review duties
- Define key custody, rotation, separation of duties, backup, revocation, and approved usage
- Define partner zones, least-privilege connectivity, and monitored privileged paths
- Define authoritative HR events, removal SLAs, and privileged-session revocation procedures
Explanation
Correct Answer
D:Life-cycle triggers need clear deadlines and mechanisms.
Incorrect Answers
A:Service agreements should match privileged-access risk. That could support governing privileged access in outsourced operations, but it does not implement the requested designing identity lifecycle controls beyond login.
B:Lifecycle rules make encryption operationally reliable. That could support establishing enterprise cryptographic controls, but it does not implement the requested designing identity lifecycle controls beyond login.
C:Access patterns should follow approved use cases. That could support designing third-party network trust boundaries, but it does not implement the requested designing identity lifecycle controls beyond login.
Question 407
A company deploys SSO for workforce apps but fails to disable accounts promptly when contractors leave. What would provide the strongest practical verification of this requirement?
- Test attempted unauthorized movement across a critical zone boundary
- Offboard a test contractor and verify application sessions and direct entitlements are removed
- Attempt a tampered test artifact and confirm deployment controls reject it
- Test that optional data is omitted when the business process does not need it
Explanation
Correct Answer
B:A practical test finds disconnected accounts.
Incorrect Answers
A:An adversarial path confirms containment. This provides evidence for using information security architecture to drive segmentation, not proof of designing identity lifecycle controls beyond login.
C:Integrity verification should fail closed. This provides evidence for establishing software supply-chain integrity, not proof of designing identity lifecycle controls beyond login.
D:The test verifies minimization, not just transport security. This provides evidence for applying data minimization before technical control selection, not proof of designing identity lifecycle controls beyond login.
Question 408
A company deploys SSO for workforce apps but fails to disable accounts promptly when contractors leave. Which follow-up is most relevant as the environment changes?
- Monitor delayed offboarding and unmanaged local identities across connected apps
- Review local deviations and obsolete implementation patterns regularly
- Monitor detection coverage as new systems join the enterprise
- Monitor new asset classes and exclusions as inventory changes
Explanation
Correct Answer
A:Integration gaps appear with each new application.
Incorrect Answers
B:Different technologies can drift from intended controls. It may help maintain standardizing control outcomes while allowing local implementation, whereas the stated continuing risk concerns designing identity lifecycle controls beyond login.
C:Unmanaged onboarding creates fresh blind spots. It may help maintain avoiding false confidence from missing telemetry, whereas the stated continuing risk concerns designing identity lifecycle controls beyond login.
D:A metric's validity depends on scope. It may help maintain correcting misleading control effectiveness reporting, whereas the stated continuing risk concerns designing identity lifecycle controls beyond login.
Question 409
A CISO's scorecard reports total blocked malware but no evidence of reduced financial exposure. Which management decision most directly addresses the stated business need?
- Use risk-based outcome and control-effectiveness metrics alongside activity indicators
- Introduce risk-based control design review against defined objectives and threats
- Use role-specific incident reporting exercises alongside awareness completion data
- Create an information security program for AI use based on classification, access, and permitted data processing
Explanation
Correct Answer
A:High alert volume does not necessarily mean stronger protection.
Incorrect Answers
B:Testing deployment alone misses flawed underlying design. However, it does not make the decision needed for selecting program performance measures tied to outcomes in this scenario.
C:Training should enable timely action, not just attendance. However, it does not make the decision needed for selecting program performance measures tied to outcomes in this scenario.
D:AI deployment must fit corporate information governance rather than tool-by-tool promises. However, it does not make the decision needed for selecting program performance measures tied to outcomes in this scenario.
Question 410
A CISO's scorecard reports total blocked malware but no evidence of reduced financial exposure. Which implementation step best translates the requirement into an operating control?
- Map platform-specific implementations to common risk and assurance outcomes
- Define approved providers, retention, access, and data minimization obligations for the use case
- Classify data pathways and use risk-tiered access and monitoring policies with owners
- Define baselines, data sources, risk tolerances, and target thresholds for priority outcomes
Explanation
Correct Answer
D:Well-defined metrics avoid misleading directionality.
Incorrect Answers
A:Shared requirements enable consistent oversight. That could support architecting integrated cloud security controls, but it does not implement the requested selecting program performance measures tied to outcomes.
B:Policy must be translated into enforceable configuration. That could support governing permitted AI data processing, but it does not implement the requested selecting program performance measures tied to outcomes.
C:Business context guides policy conditions. That could support selecting protective controls from business use cases, but it does not implement the requested selecting program performance measures tied to outcomes.
Certified Information Security Manager (CISM) Practice Tests
