100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 680
A security incident affects an industrial process, and remote shutdown could create a physical safety hazard. Which follow-up is most relevant as the environment changes?
- Review mapping accuracy and response speed after incidents or data-system changes
- Revisit playbook relevance when threat intelligence and platform changes emerge
- Update notification playbooks after new contracts, insurers, or legal changes
- Review cyber-safety interfaces after process control changes
Explanation
Correct Answer
D:Operational changes can invalidate safe containment plans.
Incorrect Answers
A:Data inventory quality drives notification readiness. It may help maintain preparing a credible breach notification fact base, whereas the stated continuing risk concerns incorporating safety authority into incident containment.
B:Readiness requires current techniques. It may help maintain updating playbooks through incident intelligence, whereas the stated continuing risk concerns incorporating safety authority into incident containment.
C:Obligations evolve across agreements and regions. It may help maintain coordinating overlapping reporting obligations, whereas the stated continuing risk concerns incorporating safety authority into incident containment.
Question 681
A cloud account takeover has granted persistent application permissions that survive a user's password reset. Which management decision most directly addresses the stated business need?
- Identify and revoke malicious grants, credentials, and sessions rather than relying on password reset alone
- Target malicious messages, senders, and compromised accounts while minimizing collateral business disruption
- Address the systemic provisioning and assurance weakness rather than repeating generic training
- Coordinate asset and data inventory evidence with forensic findings to identify the affected population
Explanation
Correct Answer
A:App permissions can persist independently of a user's primary sign-in secret.
Incorrect Answers
B:Blanket mail shutdown may create larger enterprise impact. However, it does not make the decision needed for eradicating persistent cloud identity access in this scenario.
C:Recurring technical defaults need technical and governance corrections. However, it does not make the decision needed for eradicating persistent cloud identity access in this scenario.
D:Accurate notice and harm decisions depend on knowing the exposed data. However, it does not make the decision needed for eradicating persistent cloud identity access in this scenario.
Question 682
A cloud account takeover has granted persistent application permissions that survive a user's password reset. Which implementation step best translates the requirement into an operating control?
- Inventory compromised identities, tokens, service principals, and consent grants and remove malicious persistence
- Correlate shared indicators, affected identities, and business criticality within one incident process
- Define clean data sources, reconciliation checks, and business acceptance before returning service
- Revoke malicious federation artifacts, rotate affected credentials, and revalidate identity design
Explanation
Correct Answer
A:Eradication must cover every confirmed access path.
Incorrect Answers
B:Clustering reduces duplicate work and directs response. That could support coordinating triage under incident volume, but it does not implement the requested eradicating persistent cloud identity access.
C:Restoration must reestablish trustworthy operations. That could support balancing recovery time and integrity requirements, but it does not implement the requested eradicating persistent cloud identity access.
D:Eradication should close the route the attacker used. That could support requiring eradication before full recovery acceptance, but it does not implement the requested eradicating persistent cloud identity access.
Question 683
A cloud account takeover has granted persistent application permissions that survive a user's password reset. Which validation best confirms the control meets the stated need?
- Run a tabletop where the incident commander is unavailable and verify a qualified delegate declares the incident
- Restore a representative application and verify integrity, RTO, and RPO performance
- Verify revoked applications cannot access protected resources and legitimate integrations recover safely
- Verify a corrective plan assigns owners, due dates, and measurable closure evidence
Explanation
Correct Answer
C:A dual outcome test confirms cleanup and continuity.
Incorrect Answers
A:The exercise tests continuity of decision authority. This provides evidence for establishing crisis decision authority, not proof of eradicating persistent cloud identity access.
B:Business outcomes validate recovery capability. This provides evidence for testing business continuity assumptions, not proof of eradicating persistent cloud identity access.
D:Lessons need implementation, not only a meeting. This provides evidence for using post-incident review to improve controls, not proof of eradicating persistent cloud identity access.
Question 684
A cloud account takeover has granted persistent application permissions that survive a user's password reset. What continuing control would best preserve the intended outcome?
- Review recovery dependency maps after cloud architecture and provider changes
- Monitor re-consent activity and suspicious app grants after recovery
- Reassess recovery placement after cloud-region and legal changes
- Monitor for new sessions and related identities until investigation closes
Explanation
Correct Answer
B:Persistent access can be re-established.
Incorrect Answers
A:Dependencies evolve faster than annual plans. It may help maintain testing multi-service disaster dependencies, whereas the stated continuing risk concerns eradicating persistent cloud identity access.
C:Recovery compliance can change with geography. It may help maintain recognizing nontechnical recovery constraints, whereas the stated continuing risk concerns eradicating persistent cloud identity access.
D:Attackers may use additional access paths. It may help maintain preserving forensic evidence during supplier identity compromise, whereas the stated continuing risk concerns eradicating persistent cloud identity access.
Question 685
A major phishing campaign generates hundreds of user reports but only a few confirmed compromises. What is the MOST appropriate first management decision for this situation?
- Define the incident triage, classification, and escalation process with legal notification triggers
- Create a centralized incident record of facts, evidence, decisions, and chronology
- Use risk-based triage to prioritize confirmed compromise and exposure while retaining evidence for other reports
- Develop a business-continuity fallback for dispatch processes based on BIA priorities
Explanation
Correct Answer
C:High alert volume should not obscure severe incidents.
Incorrect Answers
A:Consistent interpretation reduces late reporting. However, it does not make the decision needed for coordinating triage under incident volume in this scenario.
B:An incident record supports coordination, legal duties, and lessons learned. However, it does not make the decision needed for coordinating triage under incident volume in this scenario.
D:Service resilience requires alternate ways to perform essential operations. However, it does not make the decision needed for coordinating triage under incident volume in this scenario.
Question 686
A major phishing campaign generates hundreds of user reports but only a few confirmed compromises. What should the manager arrange during rollout to meet this requirement?
- Revoke malicious federation artifacts, rotate affected credentials, and revalidate identity design
- Correlate shared indicators, affected identities, and business criticality within one incident process
- Set shared objectives, authorized containment scopes, and status coordination checkpoints
- Create one authoritative fact log, affected-party map, approval chain, and reporting calendar
Explanation
Correct Answer
B:Clustering reduces duplicate work and directs response.
Incorrect Answers
A:Eradication should close the route the attacker used. That could support requiring eradication before full recovery acceptance, but it does not implement the requested coordinating triage under incident volume.
C:Central decision rights enable consistent execution. That could support establishing unified incident command, but it does not implement the requested coordinating triage under incident volume.
D:Shared information reduces contradictory external statements. That could support coordinating cross-business incident communications, but it does not implement the requested coordinating triage under incident volume.
Question 687
A major phishing campaign generates hundreds of user reports but only a few confirmed compromises. Which test most directly verifies the desired managerial outcome?
- Run a scenario with escalating service unavailability and confirm timely transition to disaster management
- Check that confirmed account misuse receives timely containment despite report volume
- Reconstruct a sampled containment decision from the incident log and artifacts
- Run a hunt-to-incident simulation and confirm the proper commander approves containment
Explanation
Correct Answer
B:A representative test validates prioritization.
Incorrect Answers
A:The exercise tests the handoff. This provides evidence for distinguishing operational incidents from disaster activation, not proof of coordinating triage under incident volume.
C:Traceability confirms documentation quality. This provides evidence for maintaining auditable incident documentation, not proof of coordinating triage under incident volume.
D:The exercise validates the authorization boundary. This provides evidence for separating investigation from authorized response, not proof of coordinating triage under incident volume.
Question 688
A major phishing campaign generates hundreds of user reports but only a few confirmed compromises. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Review emergency contact reachability and independent access periodically
- Review untested business dependencies and update continuity plans after each drill
- Review campaign indicators and blocking false positives after the event
- Review triage backlog and overlooked high-impact reports after the campaign
Explanation
Correct Answer
D:Volume events can hide meaningful signals.
Incorrect Answers
A:Alternative channels can fail through stale data. It may help maintain planning alternate emergency communications, whereas the stated continuing risk concerns coordinating triage under incident volume.
B:Operational reality changes beyond IT diagrams. It may help maintain testing end-to-end business continuity outcomes, whereas the stated continuing risk concerns coordinating triage under incident volume.
C:Threat patterns and legitimate communications change. It may help maintain choosing proportional email containment, whereas the stated continuing risk concerns coordinating triage under incident volume.
Question 689
A malware incident is contained, but root cause analysis shows a widely deployed unsafe configuration. Which management approach best satisfies the primary requirement?
- Integrate incident response, business continuity, and disaster recovery decision points
- Treat the shared weakness across the affected estate before declaring sustainable recovery
- Address compromised identity trust and persistence before declaring the incident resolved
- Use approved recovery criteria that include integrity, confidentiality, and RTO commitments
Explanation
Correct Answer
B:Removing one infection is not enough when the attack path remains open.
Incorrect Answers
A:Containment and restoration can conflict if plans are not coordinated. However, it does not make the decision needed for moving from eradication to enterprise corrective action in this scenario.
C:Rebuilding hosts without removing access paths invites reinfection. However, it does not make the decision needed for moving from eradication to enterprise corrective action in this scenario.
D:Rapid restoration is not success if records are corrupted or compromised. However, it does not make the decision needed for moving from eradication to enterprise corrective action in this scenario.
Question 690
A malware incident is contained, but root cause analysis shows a widely deployed unsafe configuration. Which concrete action would best operationalize the needed approach?
- Add secure defaults, policy checks, owner accountability, and exception review to the provisioning process
- Assign a corrective control owner, rollout plan, and verification criteria across systems
- Document evidence thresholds, owner handoffs, and severity review procedures
- Map outage criteria and recovery-plan activation steps to accountable executives
Explanation
Correct Answer
B:Remediation must address systemic cause.
Incorrect Answers
A:Prevention should operate before exposure occurs. That could support using root cause to choose lasting corrective action, but it does not implement the requested moving from eradication to enterprise corrective action.
C:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested moving from eradication to enterprise corrective action.
D:Clear authority avoids premature or delayed disaster declaration. That could support distinguishing operational incidents from disaster activation, but it does not implement the requested moving from eradication to enterprise corrective action.
Certified Information Security Manager (CISM) Practice Tests
