100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 690
A malware incident is contained, but root cause analysis shows a widely deployed unsafe configuration. Which concrete action would best operationalize the needed approach?
- Add secure defaults, policy checks, owner accountability, and exception review to the provisioning process
- Assign a corrective control owner, rollout plan, and verification criteria across systems
- Document evidence thresholds, owner handoffs, and severity review procedures
- Map outage criteria and recovery-plan activation steps to accountable executives
Explanation
Correct Answer
B:Remediation must address systemic cause.
Incorrect Answers
A:Prevention should operate before exposure occurs. That could support using root cause to choose lasting corrective action, but it does not implement the requested moving from eradication to enterprise corrective action.
C:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested moving from eradication to enterprise corrective action.
D:Clear authority avoids premature or delayed disaster declaration. That could support distinguishing operational incidents from disaster activation, but it does not implement the requested moving from eradication to enterprise corrective action.
Question 691
A malware incident is contained, but root cause analysis shows a widely deployed unsafe configuration. Which evidence best demonstrates the intended business and security outcome?
- Deploy a controlled misconfiguration and confirm the new guardrail detects or blocks it
- Test representative systems to confirm the weakness no longer permits the observed attack path
- Exercise incident activation with primary identity and ticketing systems unavailable
- Restore a representative application and verify integrity, RTO, and RPO performance
Explanation
Correct Answer
B:Regression tests demonstrate wider correction.
Incorrect Answers
A:A realistic regression case validates improvement. This provides evidence for using root cause to choose lasting corrective action, not proof of moving from eradication to enterprise corrective action.
C:A degraded-mode test exposes resource dependencies. This provides evidence for making incident response resources operationally ready, not proof of moving from eradication to enterprise corrective action.
D:Business outcomes validate recovery capability. This provides evidence for testing business continuity assumptions, not proof of moving from eradication to enterprise corrective action.
Question 692
A malware incident is contained, but root cause analysis shows a widely deployed unsafe configuration. Which recurring management review most directly addresses future drift?
- Monitor new privileged backup grants and unauthorized deletion attempts during recovery
- Track lessons and retest unresolved readiness gaps after corrective action
- Monitor for new sessions and related identities until investigation closes
- Monitor recurrence and overdue corrective actions in program governance
Explanation
Correct Answer
D:Post-incident work requires follow-through.
Incorrect Answers
A:Attackers may attempt to regain backup access. It may help maintain protecting backup recovery capability during an active incident, whereas the stated continuing risk concerns moving from eradication to enterprise corrective action.
B:Exercises should improve capability rather than generate attendance. It may help maintain making incident exercises test decision readiness, whereas the stated continuing risk concerns moving from eradication to enterprise corrective action.
C:Attackers may use additional access paths. It may help maintain preserving forensic evidence during supplier identity compromise, whereas the stated continuing risk concerns moving from eradication to enterprise corrective action.
Question 693
A breached customer database must be restored, and the service owner wants to skip data integrity validation to meet a deadline. Which decision should the information security manager prioritize?
- Use approved recovery criteria that include integrity, confidentiality, and RTO commitments
- Integrate incident response, business continuity, and disaster recovery decision points
- Include third-party response activation in incident readiness exercises and ownership controls
- Prioritize a recovery exercise against business-defined data and time objectives
Explanation
Correct Answer
A:Rapid restoration is not success if records are corrupted or compromised.
Incorrect Answers
B:Containment and restoration can conflict if plans are not coordinated. However, it does not make the decision needed for balancing recovery time and integrity requirements in this scenario.
C:A signed contract is not assurance that help will arrive promptly. However, it does not make the decision needed for balancing recovery time and integrity requirements in this scenario.
D:Backups have little value unless the business can be restored. However, it does not make the decision needed for balancing recovery time and integrity requirements in this scenario.
Question 694
A breached customer database must be restored, and the service owner wants to skip data integrity validation to meet a deadline. During implementation, which action most directly executes the necessary response?
- Define restoration scope, clean copy selection, dependencies, and success criteria
- Engage vendor incident contacts, counsel, and data owners for facts and timely escalation
- Add secure defaults, policy checks, owner accountability, and exception review to the provisioning process
- Define clean data sources, reconciliation checks, and business acceptance before returning service
Explanation
Correct Answer
D:Restoration must reestablish trustworthy operations.
Incorrect Answers
A:A structured test checks more than file availability. That could support testing business continuity assumptions, but it does not implement the requested balancing recovery time and integrity requirements.
B:Coordinated evidence gathering protects deadlines. That could support handling an urgent supplier breach despite contract ambiguity, but it does not implement the requested balancing recovery time and integrity requirements.
C:Prevention should operate before exposure occurs. That could support using root cause to choose lasting corrective action, but it does not implement the requested balancing recovery time and integrity requirements.
Question 695
A breached customer database must be restored, and the service owner wants to skip data integrity validation to meet a deadline. What would provide the strongest practical verification of this requirement?
- Restore an encrypted representative dataset and verify authorized key use and data integrity
- Validate a representative transaction sample and owner sign-off after restoration
- Exercise dispatch during a simulated provider outage and reconcile transactions after restoration
- Validate financial totals across dependent ledgers before the recovery decision is signed off
Explanation
Correct Answer
B:Business verification confirms usable data.
Incorrect Answers
A:A combined test proves practical recovery. This provides evidence for resolving recovery dependency failure, not proof of balancing recovery time and integrity requirements.
C:End-to-end testing exposes transition errors. This provides evidence for planning operational continuity for a critical dependency, not proof of balancing recovery time and integrity requirements.
D:A reconciliation demonstrates usable restoration. This provides evidence for managing business validation after technical recovery, not proof of balancing recovery time and integrity requirements.
Question 696
A breached customer database must be restored, and the service owner wants to skip data integrity validation to meet a deadline. Which follow-up is most relevant as the environment changes?
- Monitor performance distributions after process changes and new incident types
- Monitor residual anomalies and corrective actions during enhanced post-recovery observation
- Review handoff delays and unapproved actions after investigations
- Review key custody, backup, and recovery dependencies after architectural change
Explanation
Correct Answer
B:Recovery risk persists after the service comes online.
Incorrect Answers
A:Response data should guide improvement. It may help maintain improving incident response performance reporting, whereas the stated continuing risk concerns balancing recovery time and integrity requirements.
C:Roles should be reinforced by lessons learned. It may help maintain separating investigation from authorized response, whereas the stated continuing risk concerns balancing recovery time and integrity requirements.
D:Recovery plans often miss security infrastructure. It may help maintain resolving recovery dependency failure, whereas the stated continuing risk concerns balancing recovery time and integrity requirements.
Question 697
An investigator is asked to image a compromised laptop but does not know whether legal proceedings are likely. Which management decision most directly addresses the stated business need?
- Preserve relevant evidence through approved forensic procedures and consult legal counsel on custody requirements
- Establish an incident governance model with legal, communications, business, and technical responsibilities
- Define the incident triage, classification, and escalation process with legal notification triggers
- Create a centralized incident record of facts, evidence, decisions, and chronology
Explanation
Correct Answer
A:Potential litigation raises the need for reliable documentation.
Incorrect Answers
B:Major incidents affect more than infrastructure and need coordinated decisions. However, it does not make the decision needed for ensuring defensible evidence handling in this scenario.
C:Consistent interpretation reduces late reporting. However, it does not make the decision needed for ensuring defensible evidence handling in this scenario.
D:An incident record supports coordination, legal duties, and lessons learned. However, it does not make the decision needed for ensuring defensible evidence handling in this scenario.
Question 698
An investigator is asked to image a compromised laptop but does not know whether legal proceedings are likely. Which implementation step best translates the requirement into an operating control?
- Add secure defaults, policy checks, owner accountability, and exception review to the provisioning process
- Document evidence thresholds, owner handoffs, and severity review procedures
- Record acquisition method, timestamps, hashes, handlers, and secure storage procedures
- Use business-owned reconciliations and safe transaction replay procedures before normal operations
Explanation
Correct Answer
C:A custody trail preserves evidentiary integrity.
Incorrect Answers
A:Prevention should operate before exposure occurs. That could support using root cause to choose lasting corrective action, but it does not implement the requested ensuring defensible evidence handling.
B:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested ensuring defensible evidence handling.
D:Controlled data repair reduces secondary losses. That could support managing business validation after technical recovery, but it does not implement the requested ensuring defensible evidence handling.
Question 699
An investigator is asked to image a compromised laptop but does not know whether legal proceedings are likely. Which validation best confirms the control meets the stated need?
- Inspect a test incident for preserved artifacts, timestamps, and documented custody transitions
- Verify an independently inspected forensic copy matches the recorded acquisition hash and custody log
- Verify malicious messages are quarantined while approved business mail continues
- Restore a representative application and verify integrity, RTO, and RPO performance
Explanation
Correct Answer
B:Integrity testing validates preservation.
Incorrect Answers
A:An evidence audit checks admissibility and integrity. This provides evidence for incorporating evidence preservation into containment, not proof of ensuring defensible evidence handling.
C:Positive and negative tests measure containment quality. This provides evidence for choosing proportional email containment, not proof of ensuring defensible evidence handling.
D:Business outcomes validate recovery capability. This provides evidence for testing business continuity assumptions, not proof of ensuring defensible evidence handling.
Question 700
An investigator is asked to image a compromised laptop but does not know whether legal proceedings are likely. What continuing control would best preserve the intended outcome?
- Review emergency contact reachability and independent access periodically
- Review key custody, backup, and recovery dependencies after architectural change
- Audit evidence access and retention as legal obligations and case status change
- Review procedures after changes in forensic platforms and legal expectations
Explanation
Correct Answer
C:Evidence governance extends beyond collection.
Incorrect Answers
A:Alternative channels can fail through stale data. It may help maintain planning alternate emergency communications, whereas the stated continuing risk concerns ensuring defensible evidence handling.
B:Recovery plans often miss security infrastructure. It may help maintain resolving recovery dependency failure, whereas the stated continuing risk concerns ensuring defensible evidence handling.
D:Evidence methods must remain supportable. It may help maintain incorporating evidence preservation into containment, whereas the stated continuing risk concerns ensuring defensible evidence handling.
Certified Information Security Manager (CISM) Practice Tests
