100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 770
A forensic responder has copied evidence files to multiple personal drives without logging custody transfers. Which concrete action would best operationalize the needed approach?
- Inventory existing copies, record known provenance, restrict access, and obtain forensic/legal guidance on gaps
- Revoke affected credentials and validate access to clean copies under separate trusted identities
- Define activation contacts, emergency authorization, evidence sharing, and access boundaries
- Identify an approved region or lawful contingency with documented risk-owner and legal review
Explanation
Correct Answer
A:Recovery action must transparently preserve what is known.
Incorrect Answers
B:Recovery trust must be reestablished before use. That could support protecting backup recovery capability during an active incident, but it does not implement the requested restoring evidence integrity and custody governance.
C:Readiness needs workable details. That could support making retainer services operational during a crisis, but it does not implement the requested restoring evidence integrity and custody governance.
D:Alternatives must satisfy critical obligations. That could support recognizing nontechnical recovery constraints, but it does not implement the requested restoring evidence integrity and custody governance.
Question 771
A forensic responder has copied evidence files to multiple personal drives without logging custody transfers. Which evidence best demonstrates the intended business and security outcome?
- Deploy a controlled misconfiguration and confirm the new guardrail detects or blocks it
- Compare hashes for known source and controlled copies, documenting any unverifiable provenance
- Test the dependency chain end to end and compare actual completion with the tightest business requirement
- Compare executive briefings with the command log for consistency during a tabletop
Explanation
Correct Answer
B:Integrity evidence must disclose limitations.
Incorrect Answers
A:A realistic regression case validates improvement. This provides evidence for using root cause to choose lasting corrective action, not proof of restoring evidence integrity and custody governance.
C:An isolated server restore can hide process failure. This provides evidence for reconciling inconsistent business recovery dependencies, not proof of restoring evidence integrity and custody governance.
D:A reconciliation test checks information integrity. This provides evidence for establishing a reliable incident situation report, not proof of restoring evidence integrity and custody governance.
Question 772
A forensic responder has copied evidence files to multiple personal drives without logging custody transfers. Which recurring management review most directly addresses future drift?
- Review asset inventory and encryption control gaps after incident closure
- Review emergency contact reachability and independent access periodically
- Reassess containment effectiveness as attacker access paths are discovered
- Audit access and retention for all case artifacts through closure
Explanation
Correct Answer
D:Evidence handling remains a continuing obligation.
Incorrect Answers
A:Lessons should improve future impact assessment. It may help maintain integrating data discovery and privacy investigation, whereas the stated continuing risk concerns restoring evidence integrity and custody governance.
B:Alternative channels can fail through stale data. It may help maintain planning alternate emergency communications, whereas the stated continuing risk concerns restoring evidence integrity and custody governance.
C:Initial blocks may miss other channels. It may help maintain prioritizing containment during active compromise, whereas the stated continuing risk concerns restoring evidence integrity and custody governance.
Question 773
A multinational runs a disaster recovery drill but tests only systems rather than the customer order process they support. Which decision should the information security manager prioritize?
- Develop a business-continuity fallback for dispatch processes based on BIA priorities
- Use objective-driven exercises with realistic ambiguity and independent observation
- Design continuity exercises around critical business transactions and their dependencies
- Integrate incident response, business continuity, and disaster recovery decision points
Explanation
Correct Answer
C:A restored server does not prove that an end-to-end process works.
Incorrect Answers
A:Service resilience requires alternate ways to perform essential operations. However, it does not make the decision needed for testing end-to-end business continuity outcomes in this scenario.
B:Predetermined prompts hide gaps in actual incident judgment. However, it does not make the decision needed for testing end-to-end business continuity outcomes in this scenario.
D:Containment and restoration can conflict if plans are not coordinated. However, it does not make the decision needed for testing end-to-end business continuity outcomes in this scenario.
Question 774
A multinational runs a disaster recovery drill but tests only systems rather than the customer order process they support. During implementation, which action most directly executes the necessary response?
- Map service handoffs, manual workarounds, data reconciliation, and acceptance owners
- Apply engineering-approved segmentation and manual control steps with documented authority
- Assign reporting owners, fact validation, approval steps, and jurisdictional clocks
- Document evidence thresholds, owner handoffs, and severity review procedures
Explanation
Correct Answer
A:Business processes span multiple technologies.
Incorrect Answers
B:Containment methods must respect process safety. That could support incorporating safety authority into incident containment, but it does not implement the requested testing end-to-end business continuity outcomes.
C:A single calendar prevents missed duties. That could support coordinating overlapping reporting obligations, but it does not implement the requested testing end-to-end business continuity outcomes.
D:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested testing end-to-end business continuity outcomes.
Question 775
A multinational runs a disaster recovery drill but tests only systems rather than the customer order process they support. What would provide the strongest practical verification of this requirement?
- Exercise executive and technical coordination while simulated corporate messaging is offline
- Validate a representative transaction sample and owner sign-off after restoration
- Complete a sample customer order from intake to fulfillment under the simulated outage
- Run a simulation where regulator and customer communication decisions are required mid-containment
Explanation
Correct Answer
C:A functional test validates business continuity.
Incorrect Answers
A:A no-primary-channel test proves readiness. This provides evidence for planning alternate emergency communications, not proof of testing end-to-end business continuity outcomes.
B:Business verification confirms usable data. This provides evidence for balancing recovery time and integrity requirements, not proof of testing end-to-end business continuity outcomes.
D:Cross-functional exercises expose missing ownership. This provides evidence for creating a cross-functional incident management team, not proof of testing end-to-end business continuity outcomes.
Question 776
A multinational runs a disaster recovery drill but tests only systems rather than the customer order process they support. Which follow-up is most relevant as the environment changes?
- Update notification playbooks after new contracts, insurers, or legal changes
- Review late escalations and update thresholds when classification mistakes recur
- Review key custody, backup, and recovery dependencies after architectural change
- Review untested business dependencies and update continuity plans after each drill
Explanation
Correct Answer
D:Operational reality changes beyond IT diagrams.
Incorrect Answers
A:Obligations evolve across agreements and regions. It may help maintain coordinating overlapping reporting obligations, whereas the stated continuing risk concerns testing end-to-end business continuity outcomes.
B:Learning from missed signs improves triage. It may help maintain updating incident severity during investigation, whereas the stated continuing risk concerns testing end-to-end business continuity outcomes.
C:Recovery plans often miss security infrastructure. It may help maintain resolving recovery dependency failure, whereas the stated continuing risk concerns testing end-to-end business continuity outcomes.
Question 777
A security manager expects a threat hunting team to delete suspicious files without incident authority. Which management decision most directly addresses the stated business need?
- Assign incident classification and declaration authority with backup escalation paths
- Maintain a controlled common incident record of facts, uncertainty, decisions, and actions
- Create a centralized incident record of facts, evidence, decisions, and chronology
- Define when hunting findings trigger incident classification and authorized containment decisions
Explanation
Correct Answer
D:Hunting generates leads; disruptive actions require controlled authority.
Incorrect Answers
A:Timely incident declaration requires a clearly accountable decision-maker. However, it does not make the decision needed for separating investigation from authorized response in this scenario.
B:A single authoritative log helps command coordination. However, it does not make the decision needed for separating investigation from authorized response in this scenario.
C:An incident record supports coordination, legal duties, and lessons learned. However, it does not make the decision needed for separating investigation from authorized response in this scenario.
Question 778
A security manager expects a threat hunting team to delete suspicious files without incident authority. Which implementation step best translates the requirement into an operating control?
- Define roles, injects, success measures, and observer responsibilities before the session
- Map outage criteria and recovery-plan activation steps to accountable executives
- Establish handoff criteria, evidence capture, and approval roles for response actions
- Document evidence thresholds, owner handoffs, and severity review procedures
Explanation
Correct Answer
C:A formal transition protects investigations and operations.
Incorrect Answers
A:Well-scoped exercises create usable evidence. That could support making incident exercises test decision readiness, but it does not implement the requested separating investigation from authorized response.
B:Clear authority avoids premature or delayed disaster declaration. That could support distinguishing operational incidents from disaster activation, but it does not implement the requested separating investigation from authorized response.
D:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested separating investigation from authorized response.
Question 779
A security manager expects a threat hunting team to delete suspicious files without incident authority. Which validation best confirms the control meets the stated need?
- Deploy a controlled misconfiguration and confirm the new guardrail detects or blocks it
- Attempt authorized replay of the previous unauthorized login and confirm it is denied
- Run a limited clean restore to confirm backup integrity and independent access controls
- Run a hunt-to-incident simulation and confirm the proper commander approves containment
Explanation
Correct Answer
D:The exercise validates the authorization boundary.
Incorrect Answers
A:A realistic regression case validates improvement. This provides evidence for using root cause to choose lasting corrective action, not proof of separating investigation from authorized response.
B:A targeted test validates removal of persistence. This provides evidence for requiring eradication before full recovery acceptance, not proof of separating investigation from authorized response.
C:A successful isolated restore supports recovery planning. This provides evidence for protecting backup recovery capability during an active incident, not proof of separating investigation from authorized response.
Question 780
A security manager expects a threat hunting team to delete suspicious files without incident authority. What continuing control would best preserve the intended outcome?
- Review misclassified events and notification delays after exercises and real incidents
- Review handoff delays and unapproved actions after investigations
- Track dropped tasks and revise the handoff process based on errors
- Monitor residual anomalies and corrective actions during enhanced post-recovery observation
Explanation
Correct Answer
B:Roles should be reinforced by lessons learned.
Incorrect Answers
A:The workflow should learn from mistakes. It may help maintain establishing reliable detection-to-declaration workflow, whereas the stated continuing risk concerns separating investigation from authorized response.
C:Shift continuity improves through evidence. It may help maintain improving incident command continuity across shifts, whereas the stated continuing risk concerns separating investigation from authorized response.
D:Recovery risk persists after the service comes online. It may help maintain balancing recovery time and integrity requirements, whereas the stated continuing risk concerns separating investigation from authorized response.
Certified Information Security Manager (CISM) Practice Tests
