100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 500
A startup uses outsourced code repositories and build runners without knowing which identities can release production software. Which recurring management review most directly addresses future drift?
- Monitor service-account permissions and build-platform integrations for drift
- Review source and metric changes after platform migrations and process updates
- Review key custodian changes and restore dependencies after platform upgrades
- Review zone assumptions when applications or service owners change
Explanation
Correct Answer
A:Supply-chain trust changes as tools evolve.
Incorrect Answers
B:Reporting quality requires upkeep. It may help maintain building credible security reporting data quality, whereas the stated continuing risk concerns securing software supply-chain release authority.
C:People and systems change the recovery path. It may help maintain integrating recovery into cryptographic control design, whereas the stated continuing risk concerns securing software supply-chain release authority.
D:Architectural drift can reopen exposure. It may help maintain using information security architecture to drive segmentation, whereas the stated continuing risk concerns securing software supply-chain release authority.
Question 501
A marketing team wants to send private customer records to a generative AI service for automatic summarization. Which decision should the information security manager prioritize?
- Require classification, privacy, contractual and data-flow assessment before authorizing customer-data use
- Establish independently controlled backup and key-recovery privileges for critical data
- Standardize incident classification, measure definitions, and reporting ownership
- Define zones from data sensitivity, business services, and required communications
Explanation
Correct Answer
A:AI convenience is not a substitute for lawful and risk-acceptable processing.
Incorrect Answers
B:One compromised admin path should not destroy both production and recovery options. However, it does not make the decision needed for governing permitted AI data processing in this scenario.
C:Unaligned severity scales make response metrics incomparable. However, it does not make the decision needed for governing permitted AI data processing in this scenario.
D:Random subnet boundaries do not reliably isolate risk. However, it does not make the decision needed for governing permitted AI data processing in this scenario.
Question 502
A marketing team wants to send private customer records to a generative AI service for automatic summarization. During implementation, which action most directly executes the necessary response?
- Define user tiers, information access patterns, and device risk criteria with owners
- Define approved providers, retention, access, and data minimization obligations for the use case
- Define key custody, rotation, separation of duties, backup, revocation, and approved usage
- Map recovery accounts, approved exemptions, and independent monitoring to defined owners
Explanation
Correct Answer
B:Policy must be translated into enforceable configuration.
Incorrect Answers
A:Classification guides appropriate control strength. That could support tailoring controls to data and user risk, but it does not implement the requested governing permitted AI data processing.
C:Lifecycle rules make encryption operationally reliable. That could support establishing enterprise cryptographic controls, but it does not implement the requested governing permitted AI data processing.
D:Privileged access coverage requires explicit exception handling. That could support measuring identity-control coverage against critical paths, but it does not implement the requested governing permitted AI data processing.
Question 503
A marketing team wants to send private customer records to a generative AI service for automatic summarization. What would provide the strongest practical verification of this requirement?
- Test attempted unauthorized movement across a critical zone boundary
- Test that restricted records are excluded from unapproved prompts and connector logs
- Attempt a tampered test artifact and confirm deployment controls reject it
- Run a controlled restoration with production administrators excluded from protected key custody
Explanation
Correct Answer
B:An end-to-end test probes the actual disclosure path.
Incorrect Answers
A:An adversarial path confirms containment. This provides evidence for using information security architecture to drive segmentation, not proof of governing permitted AI data processing.
C:Integrity verification should fail closed. This provides evidence for establishing software supply-chain integrity, not proof of governing permitted AI data processing.
D:An exercise tests independence as well as data recovery. This provides evidence for separating backup recovery trust from production administration, not proof of governing permitted AI data processing.
Question 504
A marketing team wants to send private customer records to a generative AI service for automatic summarization. Which follow-up is most relevant as the environment changes?
- Revise guidance after incidents, legal changes, or usability feedback
- Monitor orphaned datasets and expired retention obligations for action
- Review device additions and firmware changes against segmentation assumptions
- Review prompt and data-retention controls after vendor model or feature changes
Explanation
Correct Answer
D:AI service behavior can change over time.
Incorrect Answers
A:Documentation must remain usable and current. It may help maintain building actionable policy hierarchy, whereas the stated continuing risk concerns governing permitted AI data processing.
B:Unmanaged accumulation increases exposure. It may help maintain governing information lifecycle within the program, whereas the stated continuing risk concerns governing permitted AI data processing.
C:IoT populations change quickly. It may help maintain selecting controls that work in the target architecture, whereas the stated continuing risk concerns governing permitted AI data processing.
Question 505
A bank's security team has implemented a phishing-resistant MFA program but cannot demonstrate coverage of privileged recovery accounts. Which management decision most directly addresses the stated business need?
- Include recovery and break-glass identities in the control coverage model with compensating assurance
- Segment partner access by business function, sensitivity, and identity assurance
- Apply validated compensating segmentation and monitoring with clinical risk ownership
- Choose compensating network, identity, and monitoring controls that fit device capabilities and business risk
Explanation
Correct Answer
A:Excluded identities can undermine the highest-value authentication paths.
Incorrect Answers
B:A universal trust boundary exposes unrelated systems. However, it does not make the decision needed for measuring identity-control coverage against critical paths in this scenario.
C:Patient safety may make standard patch windows inappropriate. However, it does not make the decision needed for measuring identity-control coverage against critical paths in this scenario.
D:Unusable agents do not reduce IoT exposure. However, it does not make the decision needed for measuring identity-control coverage against critical paths in this scenario.
Question 506
A bank's security team has implemented a phishing-resistant MFA program but cannot demonstrate coverage of privileged recovery accounts. Which implementation step best translates the requirement into an operating control?
- Define denominator rules, exception categories, and business-risk context with IT and asset owners
- Classify data pathways and use risk-tiered access and monitoring policies with owners
- Map recovery accounts, approved exemptions, and independent monitoring to defined owners
- Define user tiers, information access patterns, and device risk criteria with owners
Explanation
Correct Answer
C:Privileged access coverage requires explicit exception handling.
Incorrect Answers
A:Measurement rules should reflect the managed population. That could support correcting misleading control effectiveness reporting, but it does not implement the requested measuring identity-control coverage against critical paths.
B:Business context guides policy conditions. That could support selecting protective controls from business use cases, but it does not implement the requested measuring identity-control coverage against critical paths.
D:Classification guides appropriate control strength. That could support tailoring controls to data and user risk, but it does not implement the requested measuring identity-control coverage against critical paths.
Question 507
A bank's security team has implemented a phishing-resistant MFA program but cannot demonstrate coverage of privileged recovery accounts. Which validation best confirms the control meets the stated need?
- Run a controlled restoration with production administrators excluded from protected key custody
- Attempt a tampered test artifact and confirm deployment controls reject it
- Review a key compromise exercise for containment and data recovery obligations
- Test a controlled recovery path for authorization, traceability, and time-bounded use
Explanation
Correct Answer
D:Assurance should verify emergency procedures without disabling them.
Incorrect Answers
A:An exercise tests independence as well as data recovery. This provides evidence for separating backup recovery trust from production administration, not proof of measuring identity-control coverage against critical paths.
B:Integrity verification should fail closed. This provides evidence for establishing software supply-chain integrity, not proof of measuring identity-control coverage against critical paths.
C:Testing must cover failures, not just normal encryption. This provides evidence for establishing enterprise cryptographic controls, not proof of measuring identity-control coverage against critical paths.
Question 508
A bank's security team has implemented a phishing-resistant MFA program but cannot demonstrate coverage of privileged recovery accounts. What continuing control would best preserve the intended outcome?
- Review excluded privileged identities whenever recovery methods or staffing change
- Refresh content when roles, threats, or incident patterns change
- Review zone assumptions when applications or service owners change
- Reevaluate designs when threats or business architectures materially change
Explanation
Correct Answer
A:Hidden access paths evolve with the environment.
Incorrect Answers
B:Training must reflect the decisions people now face. It may help maintain designing role-relevant security awareness, whereas the stated continuing risk concerns measuring identity-control coverage against critical paths.
C:Architectural drift can reopen exposure. It may help maintain using information security architecture to drive segmentation, whereas the stated continuing risk concerns measuring identity-control coverage against critical paths.
D:A previously suitable control can become obsolete. It may help maintain establishing control design assurance, whereas the stated continuing risk concerns measuring identity-control coverage against critical paths.
Question 509
A program manager wants to spend the entire security budget on tools and defer training until next year. What is the MOST appropriate first management decision for this situation?
- Segment partner access by business function, sensitivity, and identity assurance
- Reduce excessive access-policy exemptions through risk-owned remediation and minimum necessary scope
- Fund the operating processes and skills necessary to use security controls effectively
- Compare insourcing, hybrid, and managed options against business risks, skills, costs, and response performance
Explanation
Correct Answer
C:Technology without trained owners often fails in incidents.
Incorrect Answers
A:A universal trust boundary exposes unrelated systems. However, it does not make the decision needed for ensuring people, process, and technology are balanced in this scenario.
B:Overbroad exceptions can nullify the control's purpose. However, it does not make the decision needed for ensuring people, process, and technology are balanced in this scenario.
D:Operating-model decisions should be evidence-based. However, it does not make the decision needed for ensuring people, process, and technology are balanced in this scenario.
Question 510
A program manager wants to spend the entire security budget on tools and defer training until next year. What should the manager arrange during rollout to meet this requirement?
- Map platform-specific implementations to common risk and assurance outcomes
- Allocate resources across configuration, support, awareness, response, and assurance needs
- Publish baseline control objectives, assurance tests, and deviation approval criteria
- Identify sensitive information flows and approve response actions for each business use case
Explanation
Correct Answer
B:Total capability includes staff and process costs.
Incorrect Answers
A:Shared requirements enable consistent oversight. That could support architecting integrated cloud security controls, but it does not implement the requested ensuring people, process, and technology are balanced.
C:A standard should be implementable and measurable. That could support standardizing control outcomes while allowing local implementation, but it does not implement the requested ensuring people, process, and technology are balanced.
D:Real flows inform meaningful policy conditions. That could support sequencing data-protection control selection, but it does not implement the requested ensuring people, process, and technology are balanced.
Certified Information Security Manager (CISM) Practice Tests
