100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 660
A multinational wants to exercise a cloud-region outage but has never tested dependent identity and key-management services. Which recurring management review most directly addresses future drift?
- Review backup immutability and restore success after new storage and threat changes
- Revisit playbook relevance when threat intelligence and platform changes emerge
- Update notification playbooks after new contracts, insurers, or legal changes
- Review recovery dependency maps after cloud architecture and provider changes
Explanation
Correct Answer
D:Dependencies evolve faster than annual plans.
Incorrect Answers
A:Ransomware defense depends on reliable copies. It may help maintain planning clean restoration after destructive compromise, whereas the stated continuing risk concerns testing multi-service disaster dependencies.
B:Readiness requires current techniques. It may help maintain updating playbooks through incident intelligence, whereas the stated continuing risk concerns testing multi-service disaster dependencies.
C:Obligations evolve across agreements and regions. It may help maintain coordinating overlapping reporting obligations, whereas the stated continuing risk concerns testing multi-service disaster dependencies.
Question 661
An incident commander receives conflicting status updates from technical teams during a major ransomware response. Which decision should the information security manager prioritize?
- Use a controlled tabletop or test environment with engineering safety oversight
- Maintain a controlled common incident record of facts, uncertainty, decisions, and actions
- Activate enterprise privacy and incident obligations independently of vendor contract uncertainty
- Define when hunting findings trigger incident classification and authorized containment decisions
Explanation
Correct Answer
B:A single authoritative log helps command coordination.
Incorrect Answers
A:Exercises must not create real process safety risk. However, it does not make the decision needed for establishing a reliable incident situation report in this scenario.
C:Missing contractual terms do not suspend legal duties. However, it does not make the decision needed for establishing a reliable incident situation report in this scenario.
D:Hunting generates leads; disruptive actions require controlled authority. However, it does not make the decision needed for establishing a reliable incident situation report in this scenario.
Question 662
An incident commander receives conflicting status updates from technical teams during a major ransomware response. During implementation, which action most directly executes the necessary response?
- Establish handoff criteria, evidence capture, and approval roles for response actions
- Assign a corrective control owner, rollout plan, and verification criteria across systems
- Assign a scribe and enforce timestamped situation updates with source and approval status
- Set shared objectives, authorized containment scopes, and status coordination checkpoints
Explanation
Correct Answer
C:Structured updates reduce rumor-driven decisions.
Incorrect Answers
A:A formal transition protects investigations and operations. That could support separating investigation from authorized response, but it does not implement the requested establishing a reliable incident situation report.
B:Remediation must address systemic cause. That could support moving from eradication to enterprise corrective action, but it does not implement the requested establishing a reliable incident situation report.
D:Central decision rights enable consistent execution. That could support establishing unified incident command, but it does not implement the requested establishing a reliable incident situation report.
Question 663
An incident commander receives conflicting status updates from technical teams during a major ransomware response. What would provide the strongest practical verification of this requirement?
- Compare executive briefings with the command log for consistency during a tabletop
- Test the dependency chain end to end and compare actual completion with the tightest business requirement
- Run a tabletop where the incident commander is unavailable and verify a qualified delegate declares the incident
- Exercise executive and technical coordination while simulated corporate messaging is offline
Explanation
Correct Answer
A:A reconciliation test checks information integrity.
Incorrect Answers
B:An isolated server restore can hide process failure. This provides evidence for reconciling inconsistent business recovery dependencies, not proof of establishing a reliable incident situation report.
C:The exercise tests continuity of decision authority. This provides evidence for establishing crisis decision authority, not proof of establishing a reliable incident situation report.
D:A no-primary-channel test proves readiness. This provides evidence for planning alternate emergency communications, not proof of establishing a reliable incident situation report.
Question 664
An incident commander receives conflicting status updates from technical teams during a major ransomware response. Which follow-up is most relevant as the environment changes?
- Review mapping accuracy and response speed after incidents or data-system changes
- Review reporting delays and conflicting entries after incidents
- Review criteria after material incidents and changed business dependencies
- Review cross-region conflict events and authority gaps after incidents
Explanation
Correct Answer
B:Communication process should improve through feedback.
Incorrect Answers
A:Data inventory quality drives notification readiness. It may help maintain preparing a credible breach notification fact base, whereas the stated continuing risk concerns establishing a reliable incident situation report.
C:Severity scales must reflect current consequences. It may help maintain classifying incidents according to business severity, whereas the stated continuing risk concerns establishing a reliable incident situation report.
D:Complex structures require explicit learning. It may help maintain establishing unified incident command, whereas the stated continuing risk concerns establishing a reliable incident situation report.
Question 665
A ransomware infection is spreading laterally, and operations teams hesitate to disconnect critical servers because of business impact. Which management decision most directly addresses the stated business need?
- Invoke the incident command escalation path to weigh rapid containment against service criticality
- Assign incident classification and declaration authority with backup escalation paths
- Define the incident triage, classification, and escalation process with legal notification triggers
- Define when hunting findings trigger incident classification and authorized containment decisions
Explanation
Correct Answer
A:Containment is a business-impact decision when isolation can stop vital operations.
Incorrect Answers
B:Timely incident declaration requires a clearly accountable decision-maker. However, it does not make the decision needed for making proportionate urgent containment decisions in this scenario.
C:Consistent interpretation reduces late reporting. However, it does not make the decision needed for making proportionate urgent containment decisions in this scenario.
D:Hunting generates leads; disruptive actions require controlled authority. However, it does not make the decision needed for making proportionate urgent containment decisions in this scenario.
Question 666
A ransomware infection is spreading laterally, and operations teams hesitate to disconnect critical servers because of business impact. Which implementation step best translates the requirement into an operating control?
- Identify critical workflows, maximum tolerable disruption, dependencies, and agreed RTO and RPO
- Map measurable thresholds to incident categories and notification authority
- Define activation contacts, emergency authorization, evidence sharing, and access boundaries
- Identify isolation priorities and compensating controls under approved emergency authority
Explanation
Correct Answer
D:An ordered plan limits spread while preserving essential services.
Incorrect Answers
A:Business needs determine recovery objectives. That could support using business impact analysis for recovery priority, but it does not implement the requested making proportionate urgent containment decisions.
B:Clear criteria guide responders under pressure. That could support classifying incidents according to business severity, but it does not implement the requested making proportionate urgent containment decisions.
C:Readiness needs workable details. That could support making retainer services operational during a crisis, but it does not implement the requested making proportionate urgent containment decisions.
Question 667
A ransomware infection is spreading laterally, and operations teams hesitate to disconnect critical servers because of business impact. Which validation best confirms the control meets the stated need?
- Exercise incident activation with primary identity and ticketing systems unavailable
- Restore a representative application and verify integrity, RTO, and RPO performance
- Deploy a controlled misconfiguration and confirm the new guardrail detects or blocks it
- Verify a controlled exercise isolates the highest-risk hosts within tolerated downtime
Explanation
Correct Answer
D:A timed test checks decision and execution speed.
Incorrect Answers
A:A degraded-mode test exposes resource dependencies. This provides evidence for making incident response resources operationally ready, not proof of making proportionate urgent containment decisions.
B:Business outcomes validate recovery capability. This provides evidence for testing business continuity assumptions, not proof of making proportionate urgent containment decisions.
C:A realistic regression case validates improvement. This provides evidence for using root cause to choose lasting corrective action, not proof of making proportionate urgent containment decisions.
Question 668
A ransomware infection is spreading laterally, and operations teams hesitate to disconnect critical servers because of business impact. What continuing control would best preserve the intended outcome?
- Review containment decision latency and authority gaps in after-action findings
- Reassess containment effectiveness as attacker access paths are discovered
- Review public statements against post-incident findings and correct inaccuracies appropriately
- Review asset inventory and encryption control gaps after incident closure
Explanation
Correct Answer
A:Delayed approval can enlarge damage.
Incorrect Answers
B:Initial blocks may miss other channels. It may help maintain prioritizing containment during active compromise, whereas the stated continuing risk concerns making proportionate urgent containment decisions.
C:Communications should remain truthful as facts evolve. It may help maintain controlling sensitive incident disclosures, whereas the stated continuing risk concerns making proportionate urgent containment decisions.
D:Lessons should improve future impact assessment. It may help maintain integrating data discovery and privacy investigation, whereas the stated continuing risk concerns making proportionate urgent containment decisions.
Question 669
A detected data exfiltration event is ongoing, but the team focuses first on calculating exact historical losses. What is the MOST appropriate first management decision for this situation?
- Define when hunting findings trigger incident classification and authorized containment decisions
- Set enterprise-owned decision, escalation, evidence, and notification duties in the response arrangement
- Maintain a controlled common incident record of facts, uncertainty, decisions, and actions
- Stop or constrain the active exfiltration path while preserving evidence and coordinating business decisions
Explanation
Correct Answer
D:Waiting for a perfect impact estimate can permit further loss.
Incorrect Answers
A:Hunting generates leads; disruptive actions require controlled authority. However, it does not make the decision needed for prioritizing containment during active compromise in this scenario.
B:A vendor cannot unilaterally decide all business and regulatory actions. However, it does not make the decision needed for prioritizing containment during active compromise in this scenario.
C:A single authoritative log helps command coordination. However, it does not make the decision needed for prioritizing containment during active compromise in this scenario.
Question 670
A detected data exfiltration event is ongoing, but the team focuses first on calculating exact historical losses. What should the manager arrange during rollout to meet this requirement?
- Define measures for detection, escalation, containment, recovery, and exception causes
- Add secure defaults, policy checks, owner accountability, and exception review to the provisioning process
- Execute approved access revocation, endpoint isolation, and evidence capture with owner escalation
- Apply engineering-approved segmentation and manual control steps with documented authority
Explanation
Correct Answer
C:Containment and forensics should proceed together where feasible.
Incorrect Answers
A:Multiple stages expose bottlenecks. That could support improving incident response performance reporting, but it does not implement the requested prioritizing containment during active compromise.
B:Prevention should operate before exposure occurs. That could support using root cause to choose lasting corrective action, but it does not implement the requested prioritizing containment during active compromise.
D:Containment methods must respect process safety. That could support incorporating safety authority into incident containment, but it does not implement the requested prioritizing containment during active compromise.
Certified Information Security Manager (CISM) Practice Tests
