ISC Practice Test 10 — 10 Questions

Question 1

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?

Accepted Answer

Revoke sessions. The 'Revoke sessions' action in the Entra ID user blade forces the user to re-authenticate and clears all current refresh tokens.

Answer

Disable the user account

Answer

Remove assigned licenses

Answer

Reset the password

Question 2

As an ISSMP developing a security governance program, which THREE of the following activities are essential to ensure the program remains effective and compliant?

Accepted Answer

Establishing a formal security steering committee. Option B is correct because a formal security steering committee provides executive-level oversight, strategic direction, and cross-functional decision-making that keeps the governance program aligned with business objectives and regulatory requirements. Option C is correct because assigning clear roles and responsibilities (e.g., via a RACI matrix) ensures accountability for security tasks, prevents gaps or overlaps in ownership, and is a foundational governance control. Option D is correct because regular audits of security policy compliance verify that controls are operating effectively, identify deviations, and drive corrective actions needed for continuous compliance. Option A is not essential to governance—manual firewall configuration is an operational task that should be automated and delegated, not performed by the ISSMP. Option E is irrelevant to security governance, as help desk ticket volume measures operational workload, not the effectiveness or compliance of the governance program.

Answer

Directly managing all firewall configurations manually

Answer

Increasing the number of help desk tickets handled daily

Question 3

Which TWO mechanisms are effective for preventing 'insecure direct object references' (IDOR) in a web application during the development phase?

Accepted Answer

Using non-enumerable, cryptographically strong identifiers (e.g., UUIDs). Preventing IDOR requires both server-side authorization checks and the use of indirect/randomized identifiers rather than sequential, predictable keys.

Answer

Client-side input validation

Answer

Disabling logging of access attempts

Answer

Using sequential database IDs in URLs

Question 4

Which document is considered the primary 'source of truth' for defining the SOC's roles, responsibilities, and communication paths during a major security incident?

Accepted Answer

Incident Response Plan (IRP). The Incident Response Plan (IRP) is the primary document that defines the SOC's roles, responsibilities, and communication paths during a major security incident. It provides a structured approach to incident handling, including escalation procedures, contact information, and step-by-step actions. The IRP is specifically designed to be the authoritative source during incident response.

Answer

Vulnerability Assessment Report

Answer

Standard Operating Procedure (SOP)

Answer

Asset Inventory

Question 5

During a cross-functional security planning session, the IT operations team argues that security controls are negatively impacting system performance. As an ISSMP, what is the most appropriate management approach to resolve this conflict?

Accepted Answer

Perform a joint business impact analysis to determine the optimal balance of security and performance. Effective security management involves balancing security needs with business operational requirements through a collaborative risk-based approach, ensuring security is integrated rather than imposed.

Answer

Enforce the security controls regardless of performance impacts

Answer

Escalate the issue to the CIO for a final decision without further analysis

Answer

Reduce security controls until performance targets are met

Question 6

Which THREE components should be included in an application security requirements document?

Accepted Answer

Authentication requirements (e.g., MFA). Authentication requirements (B) belong because the document must specify how users and services prove identity, including MFA, password policies, and session handling. Encryption standards (C) belong because they define how data is protected in transit and at rest, such as requiring TLS 1.3 and approved cipher suites. Authorization/access control definitions (D) belong because they establish who can access which resources and under what conditions, covering roles, permissions, and least privilege. The marketing tagline (A) is promotional content, not a security control, and the number of features (E) is a product scope decision, not a security requirement.

Answer

The marketing tagline for the product

Answer

The number of features to include

Question 7

An organization is adopting Infrastructure-as-Code (IaC) using Terraform. The ISSMP wants to ensure no insecure configurations (e.g., S3 buckets with public read) are deployed. What should be integrated into the CI/CD pipeline?

Accepted Answer

Static Analysis for IaC (e.g., tfsec/Checkov).. Integrating static analysis tools for IaC (like 'tfsec' or 'Checkov') into the pipeline identifies insecure configurations before the 'terraform apply' command is executed.

Answer

Manual Terraform code review logs.

Answer

Using AWS IAM policies only.

Answer

Disabling the Terraform 'plan' command.

Question 8

An ISSMP is reviewing the Business Continuity Plan (BCP) for a critical application. Which TWO of the following factors should be considered when defining the 'Maximum Tolerable Downtime' (MTD)?

Accepted Answer

Legal and regulatory compliance requirements.. Option A is correct because MTD must reflect any legal or regulatory obligations that cap how long the critical application may be unavailable; exceeding mandated recovery windows can trigger fines, sanctions, or breach-of-contract liability, so compliance requirements directly constrain the tolerable downtime. Option C is correct because MTD is fundamentally a business-driven threshold tied to how much revenue loss and financial impact the organization can absorb before the outage becomes unacceptable, making financial tolerance a primary input to the MTD calculation. Options B, D, and E are not defining factors for MTD: hardware replacement cost is a recovery cost consideration, spare-parts availability is a logistical recovery capability, and manual workaround staffing is an operational continuity tactic — none of these establish the maximum time the business can tolerate the application being down.

Answer

Total expected cost of hardware replacement.

Answer

The current availability of spare parts in the data center.

Answer

The number of employees required to perform manual workarounds.

Question 9

As a Chief Information Security Officer (CISO), you need to ensure that the security program is aligned with organizational business objectives. Which activity best demonstrates this alignment?

Accepted Answer

Aligning security projects and resource allocation with business objectives.. Mapping security initiatives to business goals demonstrates the direct impact and value of the security program, which is crucial for executive buy-in and resource allocation.

Answer

Focusing primarily on technical vulnerabilities and patch management.

Answer

Adopting the latest security technologies regardless of current business needs.

Answer

Establishing a comprehensive security policy and enforcing it strictly.

Question 10

An organization wants to monitor its compliance with CIS Benchmarks automatically. Which tool is best suited to provide an automated 'Compliance Score' against these benchmarks in a multi-cloud environment?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud includes a regulatory compliance dashboard that continuously assesses resources against built-in standards, including CIS Benchmarks, and produces a Compliance Score per standard across Azure, AWS, and GCP through its multicloud connectors. It is purpose-built for automated, continuous compliance posture assessment and scoring in multi-cloud environments.

Answer

Azure Resource Graph

Answer

Microsoft Purview Data Map

Answer

Azure Network Watcher