100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 720
A cyber incident team identifies patient records on a lost laptop but cannot determine which patients were affected. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Track lessons and retest unresolved readiness gaps after corrective action
- Review cross-region conflict events and authority gaps after incidents
- Audit access and retention for all case artifacts through closure
- Review asset inventory and encryption control gaps after incident closure
Explanation
Correct Answer
D:Lessons should improve future impact assessment.
Incorrect Answers
A:Exercises should improve capability rather than generate attendance. It may help maintain making incident exercises test decision readiness, whereas the stated continuing risk concerns integrating data discovery and privacy investigation.
B:Complex structures require explicit learning. It may help maintain establishing unified incident command, whereas the stated continuing risk concerns integrating data discovery and privacy investigation.
C:Evidence handling remains a continuing obligation. It may help maintain restoring evidence integrity and custody governance, whereas the stated continuing risk concerns integrating data discovery and privacy investigation.
Question 721
A payment network has recovered after a major outage but customers still see inconsistent balances. Which management approach best satisfies the primary requirement?
- Activate approved key recovery procedures as part of the dependent service restoration plan
- Use approved recovery criteria that include integrity, confidentiality, and RTO commitments
- Integrate incident response, business continuity, and disaster recovery decision points
- Keep the incident recovery phase open until business data consistency is verified and accepted
Explanation
Correct Answer
D:Infrastructure availability does not equal complete service restoration.
Incorrect Answers
A:Data cannot be restored independently of key availability. However, it does not make the decision needed for managing business validation after technical recovery in this scenario.
B:Rapid restoration is not success if records are corrupted or compromised. However, it does not make the decision needed for managing business validation after technical recovery in this scenario.
C:Containment and restoration can conflict if plans are not coordinated. However, it does not make the decision needed for managing business validation after technical recovery in this scenario.
Question 722
A payment network has recovered after a major outage but customers still see inconsistent balances. Which concrete action would best operationalize the needed approach?
- Use business-owned reconciliations and safe transaction replay procedures before normal operations
- Coordinate approved manual dispatch steps, safety checks, staffing, and re-entry procedures
- Document evidence thresholds, owner handoffs, and severity review procedures
- Record acquisition method, timestamps, hashes, handlers, and secure storage procedures
Explanation
Correct Answer
A:Controlled data repair reduces secondary losses.
Incorrect Answers
B:Fallback operations must be controlled and workable. That could support planning operational continuity for a critical dependency, but it does not implement the requested managing business validation after technical recovery.
C:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested managing business validation after technical recovery.
D:A custody trail preserves evidentiary integrity. That could support ensuring defensible evidence handling, but it does not implement the requested managing business validation after technical recovery.
Question 723
A payment network has recovered after a major outage but customers still see inconsistent balances. Which evidence best demonstrates the intended business and security outcome?
- Validate financial totals across dependent ledgers before the recovery decision is signed off
- Reconstruct a sampled containment decision from the incident log and artifacts
- Run a ransomware scenario that requires both isolation and production recovery decisions
- Validate a representative transaction sample and owner sign-off after restoration
Explanation
Correct Answer
A:A reconciliation demonstrates usable restoration.
Incorrect Answers
B:Traceability confirms documentation quality. This provides evidence for maintaining auditable incident documentation, not proof of managing business validation after technical recovery.
C:An integrated exercise exposes plan conflicts. This provides evidence for aligning incident response with recovery and continuity, not proof of managing business validation after technical recovery.
D:Business verification confirms usable data. This provides evidence for balancing recovery time and integrity requirements, not proof of managing business validation after technical recovery.
Question 724
A payment network has recovered after a major outage but customers still see inconsistent balances. Which recurring management review most directly addresses future drift?
- Monitor exception rates and transaction anomalies during a post-recovery observation window
- Monitor recurrence and overdue corrective actions in program governance
- Review key custody, backup, and recovery dependencies after architectural change
- Monitor performance distributions after process changes and new incident types
Explanation
Correct Answer
A:Residual errors may surface after traffic resumes.
Incorrect Answers
B:Post-incident work requires follow-through. It may help maintain moving from eradication to enterprise corrective action, whereas the stated continuing risk concerns managing business validation after technical recovery.
C:Recovery plans often miss security infrastructure. It may help maintain resolving recovery dependency failure, whereas the stated continuing risk concerns managing business validation after technical recovery.
D:Response data should guide improvement. It may help maintain improving incident response performance reporting, whereas the stated continuing risk concerns managing business validation after technical recovery.
Question 725
A cyberattack compromises privileged access to the organization's backup console. Which decision should the information security manager prioritize?
- Assign incident classification and declaration authority with backup escalation paths
- Isolate the compromised backup administration path while preserving immutable, independently controlled recovery copies
- Address compromised identity trust and persistence before declaring the incident resolved
- Activate enterprise privacy and incident obligations independently of vendor contract uncertainty
Explanation
Correct Answer
B:An attacker with backup privileges can destroy restoration options.
Incorrect Answers
A:Timely incident declaration requires a clearly accountable decision-maker. However, it does not make the decision needed for protecting backup recovery capability during an active incident in this scenario.
C:Rebuilding hosts without removing access paths invites reinfection. However, it does not make the decision needed for protecting backup recovery capability during an active incident in this scenario.
D:Missing contractual terms do not suspend legal duties. However, it does not make the decision needed for protecting backup recovery capability during an active incident in this scenario.
Question 726
A cyberattack compromises privileged access to the organization's backup console. During implementation, which action most directly executes the necessary response?
- Define restoration scope, clean copy selection, dependencies, and success criteria
- Inventory existing copies, record known provenance, restrict access, and obtain forensic/legal guidance on gaps
- Identify isolation priorities and compensating controls under approved emergency authority
- Revoke affected credentials and validate access to clean copies under separate trusted identities
Explanation
Correct Answer
D:Recovery trust must be reestablished before use.
Incorrect Answers
A:A structured test checks more than file availability. That could support testing business continuity assumptions, but it does not implement the requested protecting backup recovery capability during an active incident.
B:Recovery action must transparently preserve what is known. That could support restoring evidence integrity and custody governance, but it does not implement the requested protecting backup recovery capability during an active incident.
C:An ordered plan limits spread while preserving essential services. That could support making proportionate urgent containment decisions, but it does not implement the requested protecting backup recovery capability during an active incident.
Question 727
A cyberattack compromises privileged access to the organization's backup console. What would provide the strongest practical verification of this requirement?
- Deploy a controlled misconfiguration and confirm the new guardrail detects or blocks it
- Run a limited clean restore to confirm backup integrity and independent access controls
- Run a simulation and confirm regional actions follow one incident strategy without duplicate disruption
- Run a hunt-to-incident simulation and confirm the proper commander approves containment
Explanation
Correct Answer
B:A successful isolated restore supports recovery planning.
Incorrect Answers
A:A realistic regression case validates improvement. This provides evidence for using root cause to choose lasting corrective action, not proof of protecting backup recovery capability during an active incident.
C:A coordinated test validates unity of command. This provides evidence for establishing unified incident command, not proof of protecting backup recovery capability during an active incident.
D:The exercise validates the authorization boundary. This provides evidence for separating investigation from authorized response, not proof of protecting backup recovery capability during an active incident.
Question 728
A cyberattack compromises privileged access to the organization's backup console. Which follow-up is most relevant as the environment changes?
- Monitor new privileged backup grants and unauthorized deletion attempts during recovery
- Monitor recurrence and overdue corrective actions in program governance
- Monitor performance distributions after process changes and new incident types
- Review preparedness gaps and recovery investments in the post-incident program plan
Explanation
Correct Answer
A:Attackers may attempt to regain backup access.
Incorrect Answers
B:Post-incident work requires follow-through. It may help maintain moving from eradication to enterprise corrective action, whereas the stated continuing risk concerns protecting backup recovery capability during an active incident.
C:Response data should guide improvement. It may help maintain improving incident response performance reporting, whereas the stated continuing risk concerns protecting backup recovery capability during an active incident.
D:The crisis should lead to resilience improvement. It may help maintain governing high-impact ransom decisions, whereas the stated continuing risk concerns protecting backup recovery capability during an active incident.
Question 729
A business continuity exercise meets the RTO but requires transferring customer data to an unapproved region. Which management decision most directly addresses the stated business need?
- Reject recovery as fully successful until legal and security location requirements are addressed
- Define the incident triage, classification, and escalation process with legal notification triggers
- Establish an incident governance model with legal, communications, business, and technical responsibilities
- Integrate incident response, business continuity, and disaster recovery decision points
Explanation
Correct Answer
A:Timely restoration alone may violate mandatory processing restrictions.
Incorrect Answers
B:Consistent interpretation reduces late reporting. However, it does not make the decision needed for recognizing nontechnical recovery constraints in this scenario.
C:Major incidents affect more than infrastructure and need coordinated decisions. However, it does not make the decision needed for recognizing nontechnical recovery constraints in this scenario.
D:Containment and restoration can conflict if plans are not coordinated. However, it does not make the decision needed for recognizing nontechnical recovery constraints in this scenario.
Question 730
A business continuity exercise meets the RTO but requires transferring customer data to an unapproved region. Which implementation step best translates the requirement into an operating control?
- Add secure defaults, policy checks, owner accountability, and exception review to the provisioning process
- Document evidence thresholds, owner handoffs, and severity review procedures
- Identify an approved region or lawful contingency with documented risk-owner and legal review
- Assign a corrective control owner, rollout plan, and verification criteria across systems
Explanation
Correct Answer
C:Alternatives must satisfy critical obligations.
Incorrect Answers
A:Prevention should operate before exposure occurs. That could support using root cause to choose lasting corrective action, but it does not implement the requested recognizing nontechnical recovery constraints.
B:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested recognizing nontechnical recovery constraints.
D:Remediation must address systemic cause. That could support moving from eradication to enterprise corrective action, but it does not implement the requested recognizing nontechnical recovery constraints.
Certified Information Security Manager (CISM) Practice Tests
