100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 580
A global company cannot decide which cybersecurity events must be escalated to the crisis committee. Which recurring management review most directly addresses future drift?
- Review mapping accuracy and response speed after incidents or data-system changes
- Review misclassified events and notification delays after exercises and real incidents
- Review untested business dependencies and update continuity plans after each drill
- Review criteria after material incidents and changed business dependencies
Explanation
Correct Answer
D:Severity scales must reflect current consequences.
Incorrect Answers
A:Data inventory quality drives notification readiness. It may help maintain preparing a credible breach notification fact base, whereas the stated continuing risk concerns classifying incidents according to business severity.
B:The workflow should learn from mistakes. It may help maintain establishing reliable detection-to-declaration workflow, whereas the stated continuing risk concerns classifying incidents according to business severity.
C:Operational reality changes beyond IT diagrams. It may help maintain testing end-to-end business continuity outcomes, whereas the stated continuing risk concerns classifying incidents according to business severity.
Question 581
A hospital wants to prepare for a malware outbreak but has not identified the clinical services that must be restored first. Which decision should the information security manager prioritize?
- Permit documented reclassification with renewed escalation as impact evidence changes
- Conduct a root-cause and control-gap review with accountable remediation owners
- Perform a business impact analysis with clinical and operational owners before setting restoration order
- Establish disaster declaration authority based on business impact, dependency failures, and tolerances
Explanation
Correct Answer
C:Recovery should follow patient-care consequences and dependencies.
Incorrect Answers
A:Initial severity is provisional and should not freeze response authority. However, it does not make the decision needed for using business impact analysis for recovery priority in this scenario.
B:Service recovery alone does not eliminate systemic weaknesses. However, it does not make the decision needed for using business impact analysis for recovery priority in this scenario.
D:Labels should reflect service consequences rather than technical complexity alone. However, it does not make the decision needed for using business impact analysis for recovery priority in this scenario.
Question 582
A hospital wants to prepare for a malware outbreak but has not identified the clinical services that must be restored first. During implementation, which action most directly executes the necessary response?
- Identify isolation priorities and compensating controls under approved emergency authority
- Identify critical workflows, maximum tolerable disruption, dependencies, and agreed RTO and RPO
- Define cross-plan activation triggers, dependencies, and recovery ownership with business teams
- Define restoration scope, clean copy selection, dependencies, and success criteria
Explanation
Correct Answer
B:Business needs determine recovery objectives.
Incorrect Answers
A:An ordered plan limits spread while preserving essential services. That could support making proportionate urgent containment decisions, but it does not implement the requested using business impact analysis for recovery priority.
C:A shared framework clarifies handoffs. That could support aligning incident response with recovery and continuity, but it does not implement the requested using business impact analysis for recovery priority.
D:A structured test checks more than file availability. That could support testing business continuity assumptions, but it does not implement the requested using business impact analysis for recovery priority.
Question 583
A hospital wants to prepare for a malware outbreak but has not identified the clinical services that must be restored first. What would provide the strongest practical verification of this requirement?
- Complete a sample customer order from intake to fulfillment under the simulated outage
- Exercise a simulated diagnostic outage and confirm safe treatment documentation and handback
- Run a scenario without coaching and record response and escalation choices against objectives
- Validate a restoration sequence against a simulated emergency patient-care workload
Explanation
Correct Answer
D:A realistic test confirms prioritization protects critical functions.
Incorrect Answers
A:A functional test validates business continuity. This provides evidence for testing end-to-end business continuity outcomes, not proof of using business impact analysis for recovery priority.
B:A clinical exercise tests real operations. This provides evidence for activating patient-safety continuity during cyber containment, not proof of using business impact analysis for recovery priority.
C:Observed behavior measures readiness. This provides evidence for making incident exercises test decision readiness, not proof of using business impact analysis for recovery priority.
Question 584
A hospital wants to prepare for a malware outbreak but has not identified the clinical services that must be restored first. Which follow-up is most relevant as the environment changes?
- Refresh playbooks when cloud identity and provider features change
- Review notification templates and jurisdictions after changes in service footprint
- Refresh BIA assumptions after new clinical systems and service models are adopted
- Review trigger thresholds after BIA updates and critical service migrations
Explanation
Correct Answer
C:Critical paths change with healthcare operations.
Incorrect Answers
A:Tool updates can invalidate response procedures. It may help maintain expanding incident readiness to relevant threat scenarios, whereas the stated continuing risk concerns using business impact analysis for recovery priority.
B:Communication obligations can shift. It may help maintain coordinating cross-business incident communications, whereas the stated continuing risk concerns using business impact analysis for recovery priority.
D:Disaster criteria must reflect new dependencies. It may help maintain distinguishing operational incidents from disaster activation, whereas the stated continuing risk concerns using business impact analysis for recovery priority.
Question 585
An enterprise has multiple disaster recovery sites but no assured communication route if corporate identity systems fail. Which management decision most directly addresses the stated business need?
- Address compromised identity trust and persistence before declaring the incident resolved
- Establish an incident governance model with legal, communications, business, and technical responsibilities
- Establish out-of-band crisis communications independent of primary identity and network services
- Use objective-driven exercises with realistic ambiguity and independent observation
Explanation
Correct Answer
C:Response coordination must survive loss of normal channels.
Incorrect Answers
A:Rebuilding hosts without removing access paths invites reinfection. However, it does not make the decision needed for planning alternate emergency communications in this scenario.
B:Major incidents affect more than infrastructure and need coordinated decisions. However, it does not make the decision needed for planning alternate emergency communications in this scenario.
D:Predetermined prompts hide gaps in actual incident judgment. However, it does not make the decision needed for planning alternate emergency communications in this scenario.
Question 586
An enterprise has multiple disaster recovery sites but no assured communication route if corporate identity systems fail. Which implementation step best translates the requirement into an operating control?
- Maintain approved alternate contact methods, secured emergency directory, and access procedures
- Use business-owned reconciliations and safe transaction replay procedures before normal operations
- Apply engineering-approved segmentation and manual control steps with documented authority
- Document evidence thresholds, owner handoffs, and severity review procedures
Explanation
Correct Answer
A:Redundant communications require controlled availability.
Incorrect Answers
B:Controlled data repair reduces secondary losses. That could support managing business validation after technical recovery, but it does not implement the requested planning alternate emergency communications.
C:Containment methods must respect process safety. That could support incorporating safety authority into incident containment, but it does not implement the requested planning alternate emergency communications.
D:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested planning alternate emergency communications.
Question 587
An enterprise has multiple disaster recovery sites but no assured communication route if corporate identity systems fail. Which validation best confirms the control meets the stated need?
- Exercise incident activation with primary identity and ticketing systems unavailable
- Verify malicious messages are quarantined while approved business mail continues
- Exercise executive and technical coordination while simulated corporate messaging is offline
- Compare executive briefings with the command log for consistency during a tabletop
Explanation
Correct Answer
C:A no-primary-channel test proves readiness.
Incorrect Answers
A:A degraded-mode test exposes resource dependencies. This provides evidence for making incident response resources operationally ready, not proof of planning alternate emergency communications.
B:Positive and negative tests measure containment quality. This provides evidence for choosing proportional email containment, not proof of planning alternate emergency communications.
D:A reconciliation test checks information integrity. This provides evidence for establishing a reliable incident situation report, not proof of planning alternate emergency communications.
Question 588
An enterprise has multiple disaster recovery sites but no assured communication route if corporate identity systems fail. What continuing control would best preserve the intended outcome?
- Audit evidence access and retention as legal obligations and case status change
- Reassess containment effectiveness as attacker access paths are discovered
- Review provider staffing, contact changes, and SLA misses continuously
- Review emergency contact reachability and independent access periodically
Explanation
Correct Answer
D:Alternative channels can fail through stale data.
Incorrect Answers
A:Evidence governance extends beyond collection. It may help maintain ensuring defensible evidence handling, whereas the stated continuing risk concerns planning alternate emergency communications.
B:Initial blocks may miss other channels. It may help maintain prioritizing containment during active compromise, whereas the stated continuing risk concerns planning alternate emergency communications.
C:Outsourced response needs oversight. It may help maintain governing managed incident response contract boundaries, whereas the stated continuing risk concerns planning alternate emergency communications.
Question 589
A security team conducts tabletop exercises where facilitators always provide the correct answer to participants. What is the MOST appropriate first management decision for this situation?
- Establish out-of-band crisis communications independent of primary identity and network services
- Design continuity exercises around critical business transactions and their dependencies
- Use objective-driven exercises with realistic ambiguity and independent observation
- Include third-party response activation in incident readiness exercises and ownership controls
Explanation
Correct Answer
C:Predetermined prompts hide gaps in actual incident judgment.
Incorrect Answers
A:Response coordination must survive loss of normal channels. However, it does not make the decision needed for making incident exercises test decision readiness in this scenario.
B:A restored server does not prove that an end-to-end process works. However, it does not make the decision needed for making incident exercises test decision readiness in this scenario.
D:A signed contract is not assurance that help will arrive promptly. However, it does not make the decision needed for making incident exercises test decision readiness in this scenario.
Question 590
A security team conducts tabletop exercises where facilitators always provide the correct answer to participants. What should the manager arrange during rollout to meet this requirement?
- Define restoration scope, clean copy selection, dependencies, and success criteria
- Define measures for detection, escalation, containment, recovery, and exception causes
- Define roles, injects, success measures, and observer responsibilities before the session
- Define boundaries, synthetic signals, stop rules, and simulation responsibilities
Explanation
Correct Answer
C:Well-scoped exercises create usable evidence.
Incorrect Answers
A:A structured test checks more than file availability. That could support testing business continuity assumptions, but it does not implement the requested making incident exercises test decision readiness.
B:Multiple stages expose bottlenecks. That could support improving incident response performance reporting, but it does not implement the requested making incident exercises test decision readiness.
D:Safe conditions permit meaningful learning. That could support conducting safe industrial cyber exercises, but it does not implement the requested making incident exercises test decision readiness.
Certified Information Security Manager (CISM) Practice Tests
