ISC Practice Test 10 — 10 Questions

Question 1

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

Accepted Answer

The vendor's secure software development lifecycle (SSDLC) practices. Vendor financial stability and their own security development lifecycle (SDL) are paramount for long-term supply chain risk.

Answer

The physical location of their headquarters

Answer

The number of employees at the vendor

Answer

The vendor's marketing budget

Question 2

Which TWO factors should be used to weigh the 'Impact' in a risk assessment?

Accepted Answer

The replacement cost of the asset. Impact is generally measured by the potential loss to the business, focusing on availability, confidentiality, and integrity.

Answer

The number of hours the system has been running

Answer

The font size used in internal memos

Answer

The age of the server hardware

Question 3

Which THREE actions are necessary when preparing to decommission a cloud-based Virtual Machine (VM)?

Accepted Answer

Deleting associated snapshots and backups. Decommissioning in the cloud involves ensuring data is wiped, access rights are removed, and the resources are actually terminated to prevent billing and security exposure.

Answer

Taking a final full-disk backup to a public S3 bucket

Answer

Updating the local hardware inventory

Question 4

When aligning security with organizational goals, how should an ISSMP address a conflict between security controls and user productivity?

Accepted Answer

Conduct a risk-benefit analysis for alternative controls. Conduct a risk-benefit analysis to determine if the security control is truly necessary and if alternative, less intrusive controls exist that provide the same level of protection.

Answer

Remove the security control to favor productivity

Answer

Delegate the decision to the IT support manager

Answer

Enforce the security control regardless of impact

Question 5

Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?

Accepted Answer

Containment, Eradication, and Recovery. Recovery includes restoring systems to normal operation and confirming they are secure.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Preparation

Question 6

Which THREE pieces of information should be included in an 'Incident Notification' for executive stakeholders?

Accepted Answer

Next steps for mitigation and remediation. Executives need the business impact, the current status, and the next planned actions.

Answer

The raw packet captures of the attack

Answer

The specific login credentials used

Question 7

Which THREE of the following are critical for successfully managing cross-functional security initiatives?

Accepted Answer

Demonstrating clear alignment with business benefits. Success in cross-functional work requires stakeholder involvement, clear communication of the business value, and shared ownership of the outcomes.

Answer

Focusing solely on the technical specifications

Answer

Excluding IT management from the planning phase

Question 8

An ISSMP is leading a strategic security planning initiative using the balanced scorecard approach. Which perspective should be used to track metrics related to the workforce's proficiency and security awareness training success?

Accepted Answer

Learning and Growth. In the balanced scorecard framework, the 'Learning and Growth' perspective focuses on the human capital, infrastructure, and culture necessary to achieve the organization's security goals.

Answer

Financial

Answer

Customer

Answer

Internal Business Processes

Question 9

Which THREE of the following are key indicators of a mature security governance program?

Accepted Answer

The board receives regular, meaningful updates on security posture. Mature programs are characterized by metrics-driven processes, integration with enterprise functions, and active, informed oversight by the board.

Answer

The security team works in total isolation from the rest of the company

Answer

The CISO reports to the Help Desk manager

Question 10

Which THREE factors are required to calculate the 'Risk' of a vulnerability for reporting purposes?

Accepted Answer

Asset Criticality. Risk is typically calculated as Likelihood x Impact, where Likelihood is influenced by Threat and Vulnerability, and Impact is determined by Asset Criticality.

Answer

Number of employees in the SOC

Answer

The cost of the security appliance