100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 490
A service provider demands unrestricted administrator access to troubleshoot one business application. Which implementation step best translates the requirement into an operating control?
- Implement just-in-time access with session evidence and designated internal sponsor approval
- Define user tiers, information access patterns, and device risk criteria with owners
- Classify data pathways and use risk-tiered access and monitoring policies with owners
- Add security conditions, ownership, and evidence checkpoints to acquisition and onboarding stages
Explanation
Correct Answer
A:Strong authorization and traceability limit misuse.
Incorrect Answers
B:Classification guides appropriate control strength. That could support tailoring controls to data and user risk, but it does not implement the requested implementing time-limited privileged vendor access.
C:Business context guides policy conditions. That could support selecting protective controls from business use cases, but it does not implement the requested implementing time-limited privileged vendor access.
D:Integration prevents unreviewed vendor exposure. That could support integrating security into procurement and project intake, but it does not implement the requested implementing time-limited privileged vendor access.
Question 491
A service provider demands unrestricted administrator access to troubleshoot one business application. Which validation best confirms the control meets the stated need?
- Test that optional data is omitted when the business process does not need it
- Test a controlled recovery path for authorization, traceability, and time-bounded use
- Attempt a tampered test artifact and confirm deployment controls reject it
- Test a support session for necessary functions and denial of unrelated administrative actions
Explanation
Correct Answer
D:Both utility and containment matter.
Incorrect Answers
A:The test verifies minimization, not just transport security. This provides evidence for applying data minimization before technical control selection, not proof of implementing time-limited privileged vendor access.
B:Assurance should verify emergency procedures without disabling them. This provides evidence for measuring identity-control coverage against critical paths, not proof of implementing time-limited privileged vendor access.
C:Integrity verification should fail closed. This provides evidence for establishing software supply-chain integrity, not proof of implementing time-limited privileged vendor access.
Question 492
A service provider demands unrestricted administrator access to troubleshoot one business application. What continuing control would best preserve the intended outcome?
- Review new sensor integrations and temporary remote vendor paths regularly
- Refresh content when roles, threats, or incident patterns change
- Revoke or reassess vendor roles after support tickets and contract renewals
- Review partner routes and stale accounts after contract changes
Explanation
Correct Answer
C:Temporary access should not become persistent.
Incorrect Answers
A:Additional devices can bypass the original design. It may help maintain integrating operational technology into information security architecture, whereas the stated continuing risk concerns implementing time-limited privileged vendor access.
B:Training must reflect the decisions people now face. It may help maintain designing role-relevant security awareness, whereas the stated continuing risk concerns implementing time-limited privileged vendor access.
D:Third-party access expands unless governed. It may help maintain designing third-party network trust boundaries, whereas the stated continuing risk concerns implementing time-limited privileged vendor access.
Question 493
A company has no consistent process for selecting network segmentation boundaries. What is the MOST appropriate first management decision for this situation?
- Assign business data owners and remediation duties before scaling automated discovery
- Define legitimate data flows and unacceptable disclosure scenarios before choosing egress controls
- Define zones from data sensitivity, business services, and required communications
- Use role-specific incident reporting exercises alongside awareness completion data
Explanation
Correct Answer
C:Random subnet boundaries do not reliably isolate risk.
Incorrect Answers
A:Discovering records does not resolve their sensitivity or lawful use. However, it does not make the decision needed for using information security architecture to drive segmentation in this scenario.
B:Overly broad blocking can disrupt business without targeting risk. However, it does not make the decision needed for using information security architecture to drive segmentation in this scenario.
D:Training should enable timely action, not just attendance. However, it does not make the decision needed for using information security architecture to drive segmentation in this scenario.
Question 494
A company has no consistent process for selecting network segmentation boundaries. What should the manager arrange during rollout to meet this requirement?
- Define approved providers, retention, access, and data minimization obligations for the use case
- Map approved information flows and implement least-privilege cross-zone paths
- Record trust boundaries, security requirements, waivers, and approved design dependencies
- Map recovery accounts, approved exemptions, and independent monitoring to defined owners
Explanation
Correct Answer
B:Controls should reflect legitimate dependencies.
Incorrect Answers
A:Policy must be translated into enforceable configuration. That could support governing permitted AI data processing, but it does not implement the requested using information security architecture to drive segmentation.
C:Structured artifacts enable impact analysis. That could support maintaining actionable security architecture artifacts, but it does not implement the requested using information security architecture to drive segmentation.
D:Privileged access coverage requires explicit exception handling. That could support measuring identity-control coverage against critical paths, but it does not implement the requested using information security architecture to drive segmentation.
Question 495
A company has no consistent process for selecting network segmentation boundaries. Which test most directly verifies the desired managerial outcome?
- Test attempted unauthorized movement across a critical zone boundary
- Test a controlled recovery path for authorization, traceability, and time-bounded use
- Attempt a tampered test artifact and confirm deployment controls reject it
- Select a critical finding and verify resolution evidence and any residual risk decision
Explanation
Correct Answer
A:An adversarial path confirms containment.
Incorrect Answers
B:Assurance should verify emergency procedures without disabling them. This provides evidence for measuring identity-control coverage against critical paths, not proof of using information security architecture to drive segmentation.
C:Integrity verification should fail closed. This provides evidence for establishing software supply-chain integrity, not proof of using information security architecture to drive segmentation.
D:Closure testing checks meaningful treatment. This provides evidence for operationalizing continuous posture management, not proof of using information security architecture to drive segmentation.
Question 496
A company has no consistent process for selecting network segmentation boundaries. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Monitor bypasses and change requests involving newly integrated providers
- Review excluded privileged identities whenever recovery methods or staffing change
- Review zone assumptions when applications or service owners change
- Retest models when APIs, identities, or data flows change materially
Explanation
Correct Answer
C:Architectural drift can reopen exposure.
Incorrect Answers
A:New service use may exceed original approval. It may help maintain integrating security into procurement and project intake, whereas the stated continuing risk concerns using information security architecture to drive segmentation.
B:Hidden access paths evolve with the environment. It may help maintain measuring identity-control coverage against critical paths, whereas the stated continuing risk concerns using information security architecture to drive segmentation.
D:Threat models age as software evolves. It may help maintain integrating secure design earlier in delivery, whereas the stated continuing risk concerns using information security architecture to drive segmentation.
Question 497
A startup uses outsourced code repositories and build runners without knowing which identities can release production software. Which management approach best satisfies the primary requirement?
- Define an enterprise identity program based on business roles and target information architecture
- Translate zero-trust principles into a risk-prioritized, business-aligned capability roadmap
- Embed risk-tiered threat modeling within architecture and development gates
- Define production release trust and least-privilege roles for outsourced development platforms
Explanation
Correct Answer
D:Unbounded pipeline identity access creates supply-chain risk.
Incorrect Answers
A:Shared identity controls should reflect authorized access boundaries. However, it does not make the decision needed for securing software supply-chain release authority in this scenario.
B:Architecture transformation should be governed by outcomes rather than a product slogan. However, it does not make the decision needed for securing software supply-chain release authority in this scenario.
C:Early analysis finds design flaws before expensive deployment. However, it does not make the decision needed for securing software supply-chain release authority in this scenario.
Question 498
A startup uses outsourced code repositories and build runners without knowing which identities can release production software. Which concrete action would best operationalize the needed approach?
- Inventory applications, identify exceptions, and stage changes with business owners
- Inventory build identities, enforce approval separation and signed artifacts, and log deployment actions
- Build service requirements and a transition plan with business dependencies and clear accountability
- Define key custody, rotation, separation of duties, backup, revocation, and approved usage
Explanation
Correct Answer
B:Release controls should protect the entire chain.
Incorrect Answers
A:Transition avoids abrupt service disruption. That could support harmonizing security standards through managed transition, but it does not implement the requested securing software supply-chain release authority.
C:Changing vendors without a plan can create coverage gaps. That could support evaluating the security operating model from measurable outcomes, but it does not implement the requested securing software supply-chain release authority.
D:Lifecycle rules make encryption operationally reliable. That could support establishing enterprise cryptographic controls, but it does not implement the requested securing software supply-chain release authority.
Question 499
A startup uses outsourced code repositories and build runners without knowing which identities can release production software. Which evidence best demonstrates the intended business and security outcome?
- Test attempted unauthorized movement across a critical zone boundary
- Attempt an unauthorized deployment using a development-only identity and confirm rejection
- Ask executives to act on a sample unresolved risk using the report's evidence
- Test a privileged sign-in that should require stronger assurance and confirm policy enforcement
Explanation
Correct Answer
B:A practical test validates the release boundary.
Incorrect Answers
A:An adversarial path confirms containment. This provides evidence for using information security architecture to drive segmentation, not proof of securing software supply-chain release authority.
C:If the report cannot guide action it is not useful. This provides evidence for communicating program risk to executive stakeholders, not proof of securing software supply-chain release authority.
D:Outcome testing reveals ineffective scope. This provides evidence for governing security policy exceptions for privileged access, not proof of securing software supply-chain release authority.
Question 500
A startup uses outsourced code repositories and build runners without knowing which identities can release production software. Which recurring management review most directly addresses future drift?
- Monitor service-account permissions and build-platform integrations for drift
- Review source and metric changes after platform migrations and process updates
- Review key custodian changes and restore dependencies after platform upgrades
- Review zone assumptions when applications or service owners change
Explanation
Correct Answer
A:Supply-chain trust changes as tools evolve.
Incorrect Answers
B:Reporting quality requires upkeep. It may help maintain building credible security reporting data quality, whereas the stated continuing risk concerns securing software supply-chain release authority.
C:People and systems change the recovery path. It may help maintain integrating recovery into cryptographic control design, whereas the stated continuing risk concerns securing software supply-chain release authority.
D:Architectural drift can reopen exposure. It may help maintain using information security architecture to drive segmentation, whereas the stated continuing risk concerns securing software supply-chain release authority.
Certified Information Security Manager (CISM) Practice Tests
