ISC Exam Questions and Answers

Mean Time to Detect (MTTD)

Mean Time to Detect (MTTD) directly quantifies the interval between the initial compromise and the moment security teams identify the intrusion. By measuring this duration, organisations can effectively track the dwell time constraint, as it represents the period a threat actor remains active within the environment before detection occurs. Reducing this metric is essential for minimising the window of opportunity for data exfiltration or lateral movement, often facilitated by telemetry ingested from sources such as Microsoft Entra ID to accelerate visibility into unauthorised access attempts.

Incident Response Plan (IRP)

The Incident Response Plan serves as the authoritative framework by codifying the governance structures, escalation triggers, and operational mandates required during a crisis. It satisfies the constraint of defining roles, responsibilities, and communication paths by establishing a formalised playbook that synchronises cross-functional teams. Unlike technical configuration guides or Microsoft Entra ID access policies, this document provides the procedural governance necessary to ensure consistent decision-making and clear accountability when mitigating major security threats across the enterprise.

Playbook

Playbooks serve as the core architectural component in Cortex XSOAR responsible for orchestrating automated workflows. By utilising visual logic blocks, task nodes, and conditional branching, a playbook directly satisfies the stem requirement to coordinate and execute scripts across multiple disparate third-party integrations sequentially or in parallel. This eliminates manual intervention, allowing security analysts to streamline incident response lifecycles through deterministic automation logic rather than relying solely on isolated point-to-point API scripts.

sourceIPAddress

The `sourceIPAddress` field captures the originating network address for every API request logged within CloudTrail, directly satisfying the requirement to identify the source of lateral movement. Unlike internal service-to-service calls that may mask identities, this field records the public or private IP address from which the IAM role’s principal invoked the action. This provides the forensic trail necessary to correlate suspicious activity with specific network origins, a mechanism distinct from the identity-focused logs found in Microsoft Entra ID.

The agent must maintain an active connection to the Falcon Cloud

Network containment is executed as a cloud-issued command, so the Falcon agent must hold an active channel to the Falcon Cloud to receive and acknowledge the isolation instruction. A disconnected or network-isolated sensor cannot be commanded remotely, leaving the host uncontrolled during the incident.

Vulnerability Priority Rating (VPR)

Vulnerability Priority Rating (VPR) dynamically synthesises threat intelligence data with vulnerability severity to quantify the actual risk of exploitation. Unlike static CVSS scores that focus solely on technical impact, VPR leverages real-time evidence from the dark web and threat feeds to predict the likelihood of an attack. By prioritising threats based on active exploitability in the wild, this metric satisfies the stem’s requirement for actionable remediation guidance, allowing security teams to focus resources on vulnerabilities that pose an immediate, tangible danger to their infrastructure.

Mandatory user acknowledgment signature

Mandatory user acknowledgment signatures satisfy the legal enforceability constraint by providing non-repudiation. By requiring an explicit digital or physical affirmation, an organisation creates a verifiable audit trail proving the employee received, read, and consented to the policy terms. This evidence is essential for disciplinary actions or litigation, as it demonstrates informed consent. Modern identity management platforms, such as Microsoft Entra ID, facilitate this by enforcing Terms of Use workflows that require users to accept policies before gaining access to corporate resources.

Microsoft Purview DLP policies

Microsoft Purview Data Loss Prevention (DLP) policies directly satisfy the HIPAA 'Minimum Necessary' standard by scanning email content and attachments in transit for Protected Health Information (PHI) patterns, such as social security or medical record numbers. When a user attempts to send non-essential data beyond permitted scopes, the technical mechanism automatically intercepts the message, blocking transmission, encrypting the payload, or prompting the sender with policy tips to prevent accidental disclosure and maintain regulatory compliance.

Cloud Storage Lifecycle Management rules

Lifecycle Management rules automatically delete or transition objects once defined age or condition criteria are met, enforcing deletion without manual intervention. This satisfies CCPA/CPRA Right to Delete obligations at scale across Cloud Storage buckets, where object-by-object manual removal is impractical and unauditable.

Microsoft Defender for Cloud

Microsoft Defender for Cloud natively evaluates resource configurations across multi-cloud environments, including AWS and GCP, against established CIS Benchmarks. It continuously assesses security postures and aggregates these findings into a quantified Secure Score, directly satisfying the multi-cloud monitoring constraint. By leveraging cloud connectors and continuous assessment engines, it removes the need for manual audits, automatically translating complex telemetry into actionable compliance metrics within a unified dashboard.

Defining the compliance scope and regulatory requirements

Establishing the regulatory baseline directly satisfies the temporal constraint of being the 'first step' in the lifecycle, as no monitoring or remediation tooling can function without a predefined policy perimeter. By mapping applicable frameworks, industry standards, and statutory mandates to specific enterprise assets before implementing automated controls, security architects construct the foundational parameters required for subsequent validation phases. Without this initial scoping boundary, continuous monitoring engines lack the context needed to evaluate telemetry against governance thresholds effectively.

Data Processing Addendum (DPA) with SCCs

Following the Schrems II ruling, transferring personal data of German citizens from the US requires a mechanism that addresses EU-US data adequacy invalidation and foreign surveillance laws. A Data Processing Addendum incorporating Standard Contractual Clauses (SCCs) satisfies this strict cross-border regulatory constraint by legally binding the vendor to European data protection standards and mandating supplementary technical and organisational measures—such as robust encryption—to mitigate the risk of US intelligence access.

Requiring a separate release team to deploy changes approved by a Change Advisory Board (CAB).

Utilising an independent release team to deploy modifications authorized by a Change Advisory Board directly satisfies the separation of duties constraint in the stem by ensuring that the personnel who design or test the database schema changes are not the same individuals with production deployment privileges. This structural division prevents unilateral alterations and mitigates insider threat risks during the maintenance phase by enforcing independent authorisation checkpoints between staging verification and production implementation.

To ensure security activities were completed before moving to the next phase.

Security gates function as mandatory validation checkpoints within the software development life cycle, ensuring that all predefined security requirements and testing activities are finalised before code progresses to subsequent stages. By enforcing this procedural constraint, the gate prevents the premature deployment of vulnerable software into production environments. This mechanism directly satisfies the objective of maintaining rigorous quality assurance by verifying that developers have successfully completed all necessary security tasks, thereby mitigating risk through systematic compliance at each critical transition point.

System Security Plan (SSP)

The System Security Plan serves as the foundational repository for defining security requirements and mapping specific controls to a system’s architecture during the initial SDLC phases. By formalising these specifications early, it satisfies the requirement to document applicable security controls before implementation begins. This document acts as the primary vehicle for ensuring that organisational security policies are integrated into the system design, providing a verifiable baseline that auditors use to assess compliance throughout the subsequent development and operational lifecycle.

Require all security requirements to be embedded into the definition of done (DoD) and documented as security user stories.

Embedding security requirements directly into the Definition of Done (DoD) and individual user stories ensures traceability remains intact without necessitating a formal, static SRTM. This approach satisfies the constraint of transitioning to Agile methodologies while maintaining rigorous security governance. By formalising security criteria within the sprint backlog, the Information Systems Security Management Professional (ISSMP) ensures that every increment is verified against security standards, effectively replacing legacy documentation with continuous, iterative validation that aligns with the rapid pace of Agile development cycles.

Development/Build phase

Enforcing Static Application Security Testing during the Development/Build phase of a Jenkins-driven CI/CD pipeline satisfies the requirement to integrate security early by analysing raw source code before compilation or packaging occurs. This technical placement enables automated checkers to evaluate abstract syntax trees and detect insecure coding patterns, hardcoded credentials, and logic flaws immediately when developers commit code, directly fulfilling the constraint to validate security requirements at the earliest possible stage of the Software Development Life Cycle.

Kubernetes Admission Controllers

Admission Controllers intercept API requests before persistence, enforcing policies such as Pod Security Standards across every cluster. This satisfies the stem's consistency constraint by rejecting non-compliant workloads at creation, rather than detecting drift afterwards through scanning or manual review.

Update the DRP to include a 'throttling' policy for non-critical services during failover.

Throttling non-critical services directly addresses the bandwidth shortfall by reducing contention during failover, prioritising essential traffic within the warm site's limited capacity. Updating the DRP documents this as a deliberate operational control, satisfying the audit finding without costly infrastructure upgrades.

Ensuring the decision is documented to align with the organization's risk appetite.

Documenting the decision against the organisation's risk appetite directly satisfies the stem's constraint: choosing between invoking the DRP and remaining degraded is a risk-acceptance judgement, not a technical one. The ISSMP records the rationale so the trade-off between forensic evidence preservation and service restoration is formally authorised at the correct tolerance level.

Replication Lag monitoring logs showing synchronization latency.

Replication lag directly measures the delay between primary commit and replica synchronisation, quantifying the actual data loss window. Logs showing latency within the required recovery point objective provide auditable evidence that the provider's recovery point is achievable.

Crisis Management Plan (CMP)

The Crisis Management Plan (CMP) directly satisfies the structural constraint for an authoritative governance document by formally operationalising the triggers, escalation paths, and communication roles required during a declared crisis event. While other documents like business continuity or disaster recovery plans focus on technical recovery steps or operational resumption, the CMP specifically orchestrates the overarching strategic response and stakeholder coordination channels necessary when an incident surpasses normal operational thresholds.

Tabletop exercise.

A tabletop exercise satisfies the crucial operational constraint of zero production disruption by replacing live environmental manipulation with a facilitated, discussion-based walkthrough of disaster scenarios. This method allows technical and management teams to scrutinise decision-making pathways, communication protocols, and recovery role assignments in a controlled conference setting. Because no actual systems, networks, or data flows are manipulated or interrupted, critical business operations continue seamlessly while stakeholders comprehensively evaluate the procedural efficacy of the Business Continuity Plan.

Multi-region active-active deployment with global load balancing.

Multi-region active-active deployment with global load balancing satisfies the regional outage constraint by running identical workloads in independent regions simultaneously, with traffic distributed across healthy endpoints. When one region fails, global load balancing redirects requests to surviving regions, avoiding the recovery delay inherent in active-passive failover and meeting the continuity requirement for cloud-native microservices.

Risk Appetite Statement

The Risk Appetite Statement satisfies the stem's specific constraint as the definitive governance artifact that explicitly quantifies the boundary conditions and aggregate level of risk an organisation is willing to accept in pursuit of its strategic objectives. Unlike operational risk registers or technical vulnerability assessments that focus on tactical mitigation, this executive-level instrument establishes the immutable threshold parameters required by senior leadership to properly calibrate enterprise-wide governance, compliance, and strategic decision-making frameworks.

Govern

The NIST CSF 2.0 Govern function explicitly mandates the assessment and establishment of organisational cybersecurity governance, risk management policies, and legal compliance. By directly targeting the enterprise risk management programme's Governance component, this function satisfies the exact constraint specified in the stem, providing the structural framework necessary to evaluate policies, oversight, and risk strategy rather than purely technical implementation.

Threat Event Frequency and Vulnerability

Loss Event Frequency in the FAIR model is mathematically derived by combining Threat Event Frequency with Vulnerability, satisfying the specific constraint in the stem regarding the calculation of frequency-based risk components. Threat Event Frequency quantifies the probable rate at which a threat agent attempts to act against an asset, while Vulnerability measures the probability that an asset will be successfully compromised should such an event occur. Multiplying these two independent variables produces the annualised frequency of actual loss events, fulfilling the foundational mechanics required for quantitative cyber risk analysis.

Threat Modeling

Threat modelling embodies the 'Shift-Left' approach by analysing system architecture during the preliminary design phase, directly satisfying the stem's requirement to mitigate design-level risk before coding begins. By systematically decomposing trust boundaries, data flows, and entry points, security professionals can identify structural vulnerabilities and architectural flaws upfront. This proactive mechanism allows development teams to remediate systemic design weaknesses cost-effectively long before implementation, avoiding the exponentially higher expenses associated with patching architectural defects during late-stage testing or production.

Transference

Purchasing cyber insurance shifts the financial burden of a potential security breach from the organisation to a third-party provider. This mechanism satisfies the risk transference constraint by contractually reallocating the impact of a threat rather than eliminating the vulnerability or reducing the likelihood of an incident. By paying a premium, the company effectively offloads the monetary consequences of residual risk, ensuring that the insurer assumes responsibility for specified losses should a compromise occur within the firm's digital infrastructure.

Determine the effectiveness of controls

Determining the effectiveness of controls directly satisfies the requirement to validate security implementations within the RMF Assess step. This phase focuses on verifying that selected security and privacy controls are implemented correctly, operating as intended, and producing the desired outcome regarding security requirements. By conducting rigorous security assessments, organisations confirm that safeguards—such as conditional access policies managed via Microsoft Entra ID—function as expected to mitigate identified risks, ensuring the system maintains its authorised security posture before transitioning to the Authorise step.

Matrix Management

A matrix management structure directly resolves the constraint of geographically dispersed and independent business units by establishing dual-reporting lines. This mechanism enables the CISO to maintain central strategic oversight while embedding functional security personnel directly into local operations. Consequently, security policies are consistently enforced across autonomous regions without disrupting localized business agility, as employees answer to both regional business leaders and central information security authority simultaneously.

Integrating automated security testing in the CI/CD pipeline

Automated security testing within the CI/CD pipeline directly satisfies the 'Shift Left' requirement by embedding vulnerability scanning, static analysis, and dependency checks into the earliest stages of the software development lifecycle. By triggering these tests automatically upon every code commit, the organisation identifies and remediates security flaws before deployment, rather than relying on reactive, manual audits. This continuous integration approach ensures that security governance remains intrinsic to the development workflow, effectively reducing the cost and complexity of addressing vulnerabilities later in the release process.

Single Loss Expectancy (SLE)

Single Loss Expectancy (SLE) directly satisfies the quantitative requirement for a single, significant security event by calculating the absolute monetary value expected from the materialisation of a single threat. By multiplying the asset value (AV) by the exposure factor (EF), SLE isolates the exact financial exposure for one discrete incident, perfectly matching the board's mandate to quantify exposure without yet factoring in annualised frequency rates.

Volume of self-reported security near-misses

An elevated volume of self-reported security near-misses demonstrates psychological safety and active employee engagement, directly satisfying the reliability constraint for evaluating a true 'security-first' culture. In environments dominated by compliance-driven fear, incident reporting plummets due to blame cultures; conversely, proactive reporting reveals that personnel internalise security policies and consistently scrutinise operational workflows. This metric bypasses superficial awareness training completion rates by measuring actual behavioural adherence, proving that staff prioritise threat mitigation over convenience when identifying vulnerabilities.

Implementing a federated identity solution

Implementing a federated identity solution leverages trust relationships such as SAML or OIDC between disparate identity providers, satisfying the constraint of integrating two organizations without migrating or deprecating their existing directories. This mechanism allows users to authenticate against their native provider while gaining authorised access to resources across the merged enterprise. Such a protocol-based trust framework mitigates identity-related risk by centralising policy enforcement, eliminating credential synchronization vulnerabilities, and maintaining seamless operational continuity during the transitional merger phase.

Aligning security project outcomes with business goals

Securing necessary funding and headcount for cross-functional security initiatives requires translating technical risk metrics into financial value to satisfy the finite resource constraint inherent in multi-departmental environments. By explicitly mapping security outcomes—such as threat mitigation and compliance enhancement—to overarching business objectives like revenue growth or operational uptime, security leaders provide non-technical executives with a quantifiable justification for budget allocation. This direct alignment bridges the communication gap, transforming security from an unyielding cost centre into an essential enabler of strategic enterprise goals.