100% Latest & Updated Isaca CISM Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 780
A security manager expects a threat hunting team to delete suspicious files without incident authority. What continuing control would best preserve the intended outcome?
- Review misclassified events and notification delays after exercises and real incidents
- Review handoff delays and unapproved actions after investigations
- Track dropped tasks and revise the handoff process based on errors
- Monitor residual anomalies and corrective actions during enhanced post-recovery observation
Explanation
Correct Answer
B:Roles should be reinforced by lessons learned.
Incorrect Answers
A:The workflow should learn from mistakes. It may help maintain establishing reliable detection-to-declaration workflow, whereas the stated continuing risk concerns separating investigation from authorized response.
C:Shift continuity improves through evidence. It may help maintain improving incident command continuity across shifts, whereas the stated continuing risk concerns separating investigation from authorized response.
D:Recovery risk persists after the service comes online. It may help maintain balancing recovery time and integrity requirements, whereas the stated continuing risk concerns separating investigation from authorized response.
Question 781
A major attack uses a new persistence mechanism while response playbooks assume only endpoint malware. What is the MOST appropriate first management decision for this situation?
- Integrate incident response, business continuity, and disaster recovery decision points
- Include third-party response activation in incident readiness exercises and ownership controls
- Expand response scenarios to cover the observed identity or cloud persistence behavior
- Set enterprise-owned decision, escalation, evidence, and notification duties in the response arrangement
Explanation
Correct Answer
C:Playbooks should reflect actual attacker techniques.
Incorrect Answers
A:Containment and restoration can conflict if plans are not coordinated. However, it does not make the decision needed for updating playbooks through incident intelligence in this scenario.
B:A signed contract is not assurance that help will arrive promptly. However, it does not make the decision needed for updating playbooks through incident intelligence in this scenario.
D:A vendor cannot unilaterally decide all business and regulatory actions. However, it does not make the decision needed for updating playbooks through incident intelligence in this scenario.
Question 782
A major attack uses a new persistence mechanism while response playbooks assume only endpoint malware. What should the manager arrange during rollout to meet this requirement?
- Define measures for detection, escalation, containment, recovery, and exception causes
- Apply engineering-approved segmentation and manual control steps with documented authority
- Document evidence thresholds, owner handoffs, and severity review procedures
- Capture indicators, affected trust paths, containment steps, and evidence needs in the revised runbook
Explanation
Correct Answer
D:A specific playbook makes next response faster.
Incorrect Answers
A:Multiple stages expose bottlenecks. That could support improving incident response performance reporting, but it does not implement the requested updating playbooks through incident intelligence.
B:Containment methods must respect process safety. That could support incorporating safety authority into incident containment, but it does not implement the requested updating playbooks through incident intelligence.
C:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested updating playbooks through incident intelligence.
Question 783
A major attack uses a new persistence mechanism while response playbooks assume only endpoint malware. Which test most directly verifies the desired managerial outcome?
- Run a ransomware scenario that requires both isolation and production recovery decisions
- Run a hunt-to-incident simulation and confirm the proper commander approves containment
- Deploy a controlled misconfiguration and confirm the new guardrail detects or blocks it
- Test a replayed safe scenario and confirm responders remove the persistence route
Explanation
Correct Answer
D:A practical test validates the update.
Incorrect Answers
A:An integrated exercise exposes plan conflicts. This provides evidence for aligning incident response with recovery and continuity, not proof of updating playbooks through incident intelligence.
B:The exercise validates the authorization boundary. This provides evidence for separating investigation from authorized response, not proof of updating playbooks through incident intelligence.
C:A realistic regression case validates improvement. This provides evidence for using root cause to choose lasting corrective action, not proof of updating playbooks through incident intelligence.
Question 784
A major attack uses a new persistence mechanism while response playbooks assume only endpoint malware. After deployment, what ongoing oversight most directly keeps the requirement effective?
- Revisit playbook relevance when threat intelligence and platform changes emerge
- Review procedures after changes in forensic platforms and legal expectations
- Review dependency changes whenever trading or settlement architecture changes
- Review retainer scope and contacts before renewal or significant business changes
Explanation
Correct Answer
A:Readiness requires current techniques.
Incorrect Answers
B:Evidence methods must remain supportable. It may help maintain incorporating evidence preservation into containment, whereas the stated continuing risk concerns updating playbooks through incident intelligence.
C:Recovery assumptions must match business workflows. It may help maintain reconciling inconsistent business recovery dependencies, whereas the stated continuing risk concerns updating playbooks through incident intelligence.
D:Vendor readiness can degrade. It may help maintain making retainer services operational during a crisis, whereas the stated continuing risk concerns updating playbooks through incident intelligence.
Question 785
A security team responds to a breach but stores the timeline only in individual analysts' chat messages. Which management approach best satisfies the primary requirement?
- Permit documented reclassification with renewed escalation as impact evidence changes
- Stop uncontrolled copying and establish a controlled evidence repository and chain-of-custody process
- Create a centralized incident record of facts, evidence, decisions, and chronology
- Define when hunting findings trigger incident classification and authorized containment decisions
Explanation
Correct Answer
C:An incident record supports coordination, legal duties, and lessons learned.
Incorrect Answers
A:Initial severity is provisional and should not freeze response authority. However, it does not make the decision needed for maintaining auditable incident documentation in this scenario.
B:Untraceable copies can compromise investigation credibility. However, it does not make the decision needed for maintaining auditable incident documentation in this scenario.
D:Hunting generates leads; disruptive actions require controlled authority. However, it does not make the decision needed for maintaining auditable incident documentation in this scenario.
Question 786
A security team responds to a breach but stores the timeline only in individual analysts' chat messages. Which concrete action would best operationalize the needed approach?
- Define activation contacts, emergency authorization, evidence sharing, and access boundaries
- Document evidence thresholds, owner handoffs, and severity review procedures
- Map service handoffs, manual workarounds, data reconciliation, and acceptance owners
- Require timestamped actions, evidence references, approval entries, and responsible owners
Explanation
Correct Answer
D:Structured records preserve the decision trail.
Incorrect Answers
A:Readiness needs workable details. That could support making retainer services operational during a crisis, but it does not implement the requested maintaining auditable incident documentation.
B:The procedure should guide responders from uncertain signals to decisions. That could support establishing reliable detection-to-declaration workflow, but it does not implement the requested maintaining auditable incident documentation.
C:Business processes span multiple technologies. That could support testing end-to-end business continuity outcomes, but it does not implement the requested maintaining auditable incident documentation.
Question 787
A security team responds to a breach but stores the timeline only in individual analysts' chat messages. Which evidence best demonstrates the intended business and security outcome?
- Verify sampled affected patient records can be traced to documented decisions and notification scope
- Reconstruct a sampled containment decision from the incident log and artifacts
- Validate financial totals across dependent ledgers before the recovery decision is signed off
- Verify the documented decision considers restored service feasibility and required legal review
Explanation
Correct Answer
B:Traceability confirms documentation quality.
Incorrect Answers
A:A sample prevents unsupported impact estimates. This provides evidence for integrating data discovery and privacy investigation, not proof of maintaining auditable incident documentation.
C:A reconciliation demonstrates usable restoration. This provides evidence for managing business validation after technical recovery, not proof of maintaining auditable incident documentation.
D:A disciplined record supports accountability. This provides evidence for governing high-impact ransom decisions, not proof of maintaining auditable incident documentation.
Question 788
A security team responds to a breach but stores the timeline only in individual analysts' chat messages. Which recurring management review most directly addresses future drift?
- Review missing records and refine logging processes after each incident
- Review untested business dependencies and update continuity plans after each drill
- Review public statements against post-incident findings and correct inaccuracies appropriately
- Track repeating incident patterns and overdue corrective actions with management
Explanation
Correct Answer
A:Reliable chronology improves future investigations.
Incorrect Answers
B:Operational reality changes beyond IT diagrams. It may help maintain testing end-to-end business continuity outcomes, whereas the stated continuing risk concerns maintaining auditable incident documentation.
C:Communications should remain truthful as facts evolve. It may help maintain controlling sensitive incident disclosures, whereas the stated continuing risk concerns maintaining auditable incident documentation.
D:Continuous improvement depends on follow-through. It may help maintain using post-incident review to improve controls, whereas the stated continuing risk concerns maintaining auditable incident documentation.
Question 789
A chemical plant needs to practice a cyber compromise of safety instrumented systems without interfering with production. Which decision should the information security manager prioritize?
- Limit evidence access to authorized, necessary data under legal and HR oversight
- Stop uncontrolled copying and establish a controlled evidence repository and chain-of-custody process
- Use a controlled tabletop or test environment with engineering safety oversight
- Maintain a controlled common incident record of facts, uncertainty, decisions, and actions
Explanation
Correct Answer
C:Exercises must not create real process safety risk.
Incorrect Answers
A:An investigation does not permit unrestricted collection of unrelated personal information. However, it does not make the decision needed for conducting safe industrial cyber exercises in this scenario.
B:Untraceable copies can compromise investigation credibility. However, it does not make the decision needed for conducting safe industrial cyber exercises in this scenario.
D:A single authoritative log helps command coordination. However, it does not make the decision needed for conducting safe industrial cyber exercises in this scenario.
Question 790
A chemical plant needs to practice a cyber compromise of safety instrumented systems without interfering with production. During implementation, which action most directly executes the necessary response?
- Define activation contacts, emergency authorization, evidence sharing, and access boundaries
- Define boundaries, synthetic signals, stop rules, and simulation responsibilities
- Maintain emergency contacts, support severity rules, and authorized personnel credentials offline securely
- Define roles, injects, success measures, and observer responsibilities before the session
Explanation
Correct Answer
B:Safe conditions permit meaningful learning.
Incorrect Answers
A:Readiness needs workable details. That could support making retainer services operational during a crisis, but it does not implement the requested conducting safe industrial cyber exercises.
C:Ready channels reduce delay. That could support maintaining critical supplier emergency escalation, but it does not implement the requested conducting safe industrial cyber exercises.
D:Well-scoped exercises create usable evidence. That could support making incident exercises test decision readiness, but it does not implement the requested conducting safe industrial cyber exercises.
Certified Information Security Manager (CISM) Practice Tests
