ISC Practice Test 1 — 10 Questions

Question 1

An ISSMP is revising the BCP to account for 'Supply Chain Resiliency'. Which approach is best for verifying that critical third-party vendors can meet the organization's recovery requirements?

Accepted Answer

Reviewing vendor-provided Disaster Recovery test reports and performance metrics.. Contractual RTO/RPO requirements must be validated via audit or simulation results.

Answer

Sending a self-assessment questionnaire to the vendor.

Answer

Performing an independent penetration test on the vendor's network.

Answer

Requiring vendors to sign an updated Service Level Agreement.

Question 2

During a BCP planning session, the executive team is debating the 'Maximum Tolerable Downtime' (MTD) for a legacy internal application. What is the correct way to define this metric?

Accepted Answer

The total duration of time that an organization can tolerate a business process being unavailable.. MTD is the total time a process can be down before the organization suffers catastrophic/irreversible harm.

Answer

The maximum acceptable age of data in the event of a system crash.

Answer

The time taken to fail over to the secondary site during a disaster.

Answer

The time required to restore the application from the latest tape backup.

Question 3

When classifying business processes for BCP, what is the 'Recovery Time Objective' (RTO) most effectively used for?

Accepted Answer

Determining the technology and infrastructure requirements for restoration.. RTO informs the investment and technology choices for the recovery strategy to ensure service restoration occurs within the business-defined window.

Answer

Identifying the critical staff needed for recovery.

Answer

Assessing the data loss tolerance.

Answer

Calculating the financial impact of the event.

Question 4

Which TWO of the following are effective ways to improve 'Crisis Management Leadership' effectiveness during an incident?

Accepted Answer

Ensuring a dedicated communications officer manages stakeholder messaging.. Leadership requires clear delegation and effective, structured communication to prevent panic and ensure well-informed decisions.

Answer

Removing all documentation to force teams to think creatively.

Answer

Ignoring external media requests to focus only on technical repair.

Answer

Requiring all employees to attend weekly disaster drills.

Question 5

Which TWO aspects of the NIST Cybersecurity Framework (CSF) are most relevant when establishing a 'Compliance Program Management' function?

Accepted Answer

Identify (ID) function. The CSF provides structure; 'Govern' and 'Identify' are the pillars for compliance management.

Answer

Recover (RC) function

Answer

Detect (DE) function

Answer

Protect (PR) function

Question 6

A security manager is drafting a security policy. Which element is essential for ensuring executive support and establishing the policy's organizational authority?

Accepted Answer

Executive sponsorship and signature. An executive signature or sponsorship is required to demonstrate that the policy has the backing of the organization's leadership and is not just a departmental suggestion.

Answer

A list of vendors

Answer

A list of all employees

Answer

Detailed technical configuration standards

Question 7

Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?

Accepted Answer

Maintain comprehensive audit logs for all financial system changes. SOX focuses on financial reporting integrity, specifically requiring access controls and audit trails.

Answer

Conduct quarterly physical server room inspections

Answer

Encrypt all data at rest using AES-256

Answer

Ensure all employees receive annual ethics training

Question 8

When conducting a compliance audit, what is the purpose of a 'Gap Analysis'?

Accepted Answer

To identify the delta between current state and compliance requirements. A gap analysis identifies the difference between current controls and the required regulatory standard.

Answer

To rewrite the security policy

Answer

To perform a vulnerability scan

Answer

To punish departments for non-compliance

Question 9

What is the primary objective of a Business Impact Analysis (BIA)?

Accepted Answer

To determine the impact of disruptions on business operations. The BIA identifies critical business processes and the impact of their disruption, which informs the BCP/DR plan.

Answer

To calculate the cost of a data breach

Answer

To identify all system vulnerabilities

Answer

To configure firewalls for recovery

Question 10

In Okta, to restrict administrative access to a specific geographic region during an active session, which policy should be modified?

Accepted Answer

Global Session Policy. The 'Global Session Policy' or specific 'Authentication Policy' rules control access based on location-based conditions.

Answer

Password Policy

Answer

MFA Enrollment Policy

Answer

Group Rule