100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 700
An investigator is asked to image a compromised laptop but does not know whether legal proceedings are likely. What continuing control would best preserve the intended outcome?
- Review emergency contact reachability and independent access periodically
- Review key custody, backup, and recovery dependencies after architectural change
- Audit evidence access and retention as legal obligations and case status change
- Review procedures after changes in forensic platforms and legal expectations
Explanation
Correct Answer
C:Evidence governance extends beyond collection.
Incorrect Answers
A:Alternative channels can fail through stale data. It may help maintain planning alternate emergency communications, whereas the stated continuing risk concerns ensuring defensible evidence handling.
B:Recovery plans often miss security infrastructure. It may help maintain resolving recovery dependency failure, whereas the stated continuing risk concerns ensuring defensible evidence handling.
D:Evidence methods must remain supportable. It may help maintain incorporating evidence preservation into containment, whereas the stated continuing risk concerns ensuring defensible evidence handling.
Question 701
A global manufacturer receives regulatory and insurance reporting requests with different deadlines after one cyber incident. What is the MOST appropriate first management decision for this situation?
- Establish an incident governance model with legal, communications, business, and technical responsibilities
- Route public communication through authorized incident communications and legal approval
- Define the incident triage, classification, and escalation process with legal notification triggers
- Centralize a deadline and obligation register under incident command with legal and risk participation
Explanation
Correct Answer
D:Different audiences may require distinct timely disclosures.
Incorrect Answers
A:Major incidents affect more than infrastructure and need coordinated decisions. However, it does not make the decision needed for coordinating overlapping reporting obligations in this scenario.
B:Premature disclosure can impede containment, evidence, or legal obligations. However, it does not make the decision needed for coordinating overlapping reporting obligations in this scenario.
C:Consistent interpretation reduces late reporting. However, it does not make the decision needed for coordinating overlapping reporting obligations in this scenario.
Question 702
A global manufacturer receives regulatory and insurance reporting requests with different deadlines after one cyber incident. What should the manager arrange during rollout to meet this requirement?
- Map service handoffs, manual workarounds, data reconciliation, and acceptance owners
- Apply engineering-approved segmentation and manual control steps with documented authority
- Assign reporting owners, fact validation, approval steps, and jurisdictional clocks
- Document severity triggers, responsible roles, alternates, and approval channels in the response plan
Explanation
Correct Answer
C:A single calendar prevents missed duties.
Incorrect Answers
A:Business processes span multiple technologies. That could support testing end-to-end business continuity outcomes, but it does not implement the requested coordinating overlapping reporting obligations.
B:Containment methods must respect process safety. That could support incorporating safety authority into incident containment, but it does not implement the requested coordinating overlapping reporting obligations.
D:Explicit authority reduces delays during crises. That could support establishing crisis decision authority, but it does not implement the requested coordinating overlapping reporting obligations.
Question 703
A global manufacturer receives regulatory and insurance reporting requests with different deadlines after one cyber incident. Which test most directly verifies the desired managerial outcome?
- Run a clock-based incident exercise and verify each notification is sent or documented on time
- Exercise incident activation with primary identity and ticketing systems unavailable
- Restore a representative application and verify integrity, RTO, and RPO performance
- Activate the retainer in an authorized simulation and measure arrival and onboarding time
Explanation
Correct Answer
A:Timing is a real compliance outcome.
Incorrect Answers
B:A degraded-mode test exposes resource dependencies. This provides evidence for making incident response resources operationally ready, not proof of coordinating overlapping reporting obligations.
C:Business outcomes validate recovery capability. This provides evidence for testing business continuity assumptions, not proof of coordinating overlapping reporting obligations.
D:An end-to-end test validates service access. This provides evidence for making retainer services operational during a crisis, not proof of coordinating overlapping reporting obligations.
Question 704
A global manufacturer receives regulatory and insurance reporting requests with different deadlines after one cyber incident. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Monitor abnormal federation changes and new privileged grants after recovery
- Review recovery dependency maps after cloud architecture and provider changes
- Update notification playbooks after new contracts, insurers, or legal changes
- Refresh playbooks when cloud identity and provider features change
Explanation
Correct Answer
C:Obligations evolve across agreements and regions.
Incorrect Answers
A:Post-recovery assurance should focus on recurrence paths. It may help maintain requiring eradication before full recovery acceptance, whereas the stated continuing risk concerns coordinating overlapping reporting obligations.
B:Dependencies evolve faster than annual plans. It may help maintain testing multi-service disaster dependencies, whereas the stated continuing risk concerns coordinating overlapping reporting obligations.
D:Tool updates can invalidate response procedures. It may help maintain expanding incident readiness to relevant threat scenarios, whereas the stated continuing risk concerns coordinating overlapping reporting obligations.
Question 705
A security analyst wants to post detailed attacker indicators publicly while the investigation is still active. Which management approach best satisfies the primary requirement?
- Route public communication through authorized incident communications and legal approval
- Define the incident triage, classification, and escalation process with legal notification triggers
- Establish out-of-band crisis communications independent of primary identity and network services
- Define when hunting findings trigger incident classification and authorized containment decisions
Explanation
Correct Answer
A:Premature disclosure can impede containment, evidence, or legal obligations.
Incorrect Answers
B:Consistent interpretation reduces late reporting. However, it does not make the decision needed for controlling sensitive incident disclosures in this scenario.
C:Response coordination must survive loss of normal channels. However, it does not make the decision needed for controlling sensitive incident disclosures in this scenario.
D:Hunting generates leads; disruptive actions require controlled authority. However, it does not make the decision needed for controlling sensitive incident disclosures in this scenario.
Question 706
A security analyst wants to post detailed attacker indicators publicly while the investigation is still active. Which concrete action would best operationalize the needed approach?
- Map measurable thresholds to incident categories and notification authority
- Engage vendor incident contacts, counsel, and data owners for facts and timely escalation
- Identify an approved region or lawful contingency with documented risk-owner and legal review
- Set audiences, approved facts, timing, and disclosure authority for external messages
Explanation
Correct Answer
D:Controlled communication balances transparency and response.
Incorrect Answers
A:Clear criteria guide responders under pressure. That could support classifying incidents according to business severity, but it does not implement the requested controlling sensitive incident disclosures.
B:Coordinated evidence gathering protects deadlines. That could support handling an urgent supplier breach despite contract ambiguity, but it does not implement the requested controlling sensitive incident disclosures.
C:Alternatives must satisfy critical obligations. That could support recognizing nontechnical recovery constraints, but it does not implement the requested controlling sensitive incident disclosures.
Question 707
A security analyst wants to post detailed attacker indicators publicly while the investigation is still active. Which evidence best demonstrates the intended business and security outcome?
- Test a media inquiry and confirm responders do not share unapproved investigative details
- Test the dependency chain end to end and compare actual completion with the tightest business requirement
- Deploy a controlled misconfiguration and confirm the new guardrail detects or blocks it
- Run a hunt-to-incident simulation and confirm the proper commander approves containment
Explanation
Correct Answer
A:A simulation probes the decision boundary.
Incorrect Answers
B:An isolated server restore can hide process failure. This provides evidence for reconciling inconsistent business recovery dependencies, not proof of controlling sensitive incident disclosures.
C:A realistic regression case validates improvement. This provides evidence for using root cause to choose lasting corrective action, not proof of controlling sensitive incident disclosures.
D:The exercise validates the authorization boundary. This provides evidence for separating investigation from authorized response, not proof of controlling sensitive incident disclosures.
Question 708
A security analyst wants to post detailed attacker indicators publicly while the investigation is still active. Which recurring management review most directly addresses future drift?
- Review public statements against post-incident findings and correct inaccuracies appropriately
- Monitor residual anomalies and corrective actions during enhanced post-recovery observation
- Review preparedness gaps and recovery investments in the post-incident program plan
- Review containment decision latency and authority gaps in after-action findings
Explanation
Correct Answer
A:Communications should remain truthful as facts evolve.
Incorrect Answers
B:Recovery risk persists after the service comes online. It may help maintain balancing recovery time and integrity requirements, whereas the stated continuing risk concerns controlling sensitive incident disclosures.
C:The crisis should lead to resilience improvement. It may help maintain governing high-impact ransom decisions, whereas the stated continuing risk concerns controlling sensitive incident disclosures.
D:Delayed approval can enlarge damage. It may help maintain making proportionate urgent containment decisions, whereas the stated continuing risk concerns controlling sensitive incident disclosures.
Question 709
An incident manager lacks any way to contact the cloud provider outside the normal support portal during a tenant outage. Which decision should the information security manager prioritize?
- Activate enterprise privacy and incident obligations independently of vendor contract uncertainty
- Define the incident triage, classification, and escalation process with legal notification triggers
- Permit documented reclassification with renewed escalation as impact evidence changes
- Establish tested out-of-band provider escalation paths with entitlement and contract details
Explanation
Correct Answer
D:Incident response must work when ordinary cloud support access is unavailable.
Incorrect Answers
A:Missing contractual terms do not suspend legal duties. However, it does not make the decision needed for maintaining critical supplier emergency escalation in this scenario.
B:Consistent interpretation reduces late reporting. However, it does not make the decision needed for maintaining critical supplier emergency escalation in this scenario.
C:Initial severity is provisional and should not freeze response authority. However, it does not make the decision needed for maintaining critical supplier emergency escalation in this scenario.
Question 710
An incident manager lacks any way to contact the cloud provider outside the normal support portal during a tenant outage. During implementation, which action most directly executes the necessary response?
- Identify isolation priorities and compensating controls under approved emergency authority
- Document evidence thresholds, owner handoffs, and severity review procedures
- Maintain emergency contacts, support severity rules, and authorized personnel credentials offline securely
- Define boundaries, synthetic signals, stop rules, and simulation responsibilities
Explanation
Correct Answer
C:Ready channels reduce delay.
Incorrect Answers
A:An ordered plan limits spread while preserving essential services. That could support making proportionate urgent containment decisions, but it does not implement the requested maintaining critical supplier emergency escalation.
B:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested maintaining critical supplier emergency escalation.
D:Safe conditions permit meaningful learning. That could support conducting safe industrial cyber exercises, but it does not implement the requested maintaining critical supplier emergency escalation.
Certified Information Security Manager (CISM) Practice Tests
