ISC Practice Test 11 — 15 Questions

Question 1

A security manager is evaluating organizational security culture. Which indicator provides the most reliable evidence of a 'security-first' culture?

Accepted Answer

Volume of self-reported security near-misses. The reporting of near-misses by employees shows that staff are actively engaged in security awareness and feel safe identifying potential threats, which is a key trait of a mature security culture.

Answer

Budget allocated to security

Answer

Percentage of employees who completed training

Answer

Number of security policies written

Question 2

A Chief Risk Officer is utilizing the FAIR framework to quantify cyber risk. Which input is required to calculate the Loss Event Frequency?

Accepted Answer

Threat Event Frequency and Vulnerability. In the FAIR framework, Loss Event Frequency (LEF) is calculated from Threat Event Frequency (TEF) and Vulnerability (the probability that a threat event becomes a loss event). The formula is LEF = TEF × Vulnerability. Therefore, the required inputs are Threat Event Frequency and Vulnerability.

Answer

Primary Loss Magnitude and Secondary Loss Magnitude

Answer

Inherent Risk and Residual Risk

Answer

Control Strength and Asset Valuation

Question 3

For an organization to maintain compliance with the GLBA (Gramm-Leach-Bliley Act), which mechanism within Azure Key Vault is required to demonstrate evidence of 'Key Rotation' and 'Access History'?

Accepted Answer

Azure Monitor Diagnostic Settings. Azure Key Vault logs accessed via Azure Monitor and Log Analytics provide the necessary evidence for key management compliance.

Answer

Key Vault Backup

Answer

Key Vault Access Policies

Answer

Azure Active Directory B2C

Question 4

In Rapid7 InsightVM, what is the best way to categorize assets into groups based on their business function for targeted vulnerability reporting?

Accepted Answer

Dynamic Asset Groups. Dynamic Asset Groups in Rapid7 InsightVM automatically include assets based on filter criteria such as tags, operating system, or vulnerability attributes, so assets can be grouped by business function (e.g., 'PCI servers', 'HR workstations') and kept current as the environment changes. This enables targeted vulnerability reporting and remediation workflows without manual list maintenance. It is the intended mechanism for business-function-based categorization.

Answer

User role

Answer

Scan template

Answer

Site configuration

Question 5

Which THREE activities are included in the 'Preparation' phase of the IR life cycle?

Accepted Answer

Conducting incident drills and exercises. Preparation involves setting up tools, training the team, and defining the procedures necessary for effective response.

Answer

Eradicating an ongoing malware infection

Answer

Writing the post-incident summary report

Question 6

An ISSMP is overseeing the integration of security into a new DevOps pipeline using Jenkins. Which stage of the SDLC should the ISSMP enforce the execution of SAST tools to ensure security requirements are met early?

Accepted Answer

Development/Build phase. SAST (Static Application Security Testing) tools analyze source code or binaries for security vulnerabilities without executing the program. They are most effective when integrated into the Development/Build phase of the SDLC, where code is written and compiled. Enforcing SAST at this stage allows developers to identify and remediate security flaws early, reducing cost and effort compared to fixing issues later in production. This aligns with the shift-left security principle in DevOps, ensuring security requirements are met from the start.

Answer

Decommissioning phase

Answer

Post-deployment monitoring

Answer

Requirements gathering phase

Question 7

Which THREE of the following are challenges in transitioning to a secure DevSecOps model?

Accepted Answer

Lack of security training for developers. Transitioning requires overcoming cultural resistance, automating complex security gates, and ensuring developers have the right training to take ownership of security.

Answer

Using only manual security review processes

Answer

Replacing all developers with security professionals

Question 8

Following a ransomware attack, the organization must decide whether to invoke the DRP or remain in a degraded state while security teams perform forensics. What is the ISSMP's primary responsibility in this decision-making process?

Accepted Answer

Ensuring the decision is documented to align with the organization's risk appetite.. The ISSMP operates at the management and governance layer, not the hands-on technical layer. When deciding between invoking the DRP and staying degraded for forensics, the ISSMP's primary duty is to ensure the decision is made deliberately, documented, and aligned with the organization's stated risk appetite and business priorities. This preserves accountability and provides an auditable rationale for regulators, auditors, and executives.

Answer

Choosing the restore point from the offsite immutable backup.

Answer

Performing the initial forensic image of the infected servers.

Answer

Directing the IT team to disconnect the network immediately.

Question 9

Which TWO factors should be used to weigh the 'Impact' in a risk assessment?

Accepted Answer

The replacement cost of the asset. Impact is generally measured by the potential loss to the business, focusing on availability, confidentiality, and integrity.

Answer

The number of hours the system has been running

Answer

The font size used in internal memos

Answer

The age of the server hardware

Question 10

Which leadership style is most effective for building a strong security team during a period of rapid organizational growth?

Accepted Answer

Transformational leadership. Transformational leadership inspires and motivates team members to exceed expectations by fostering a shared vision, encouraging innovation, and providing individualized consideration. During rapid growth, this style is most effective for building a strong security team because it aligns diverse talents toward common goals and adapts to change.

Answer

Transaction-based leadership

Answer

Laissez-faire leadership

Answer

Autocratic leadership

Question 11

Your organization has adopted a cloud-native microservices architecture. Which strategy is most appropriate for maintaining business continuity in the event of a regional cloud provider outage?

Accepted Answer

Multi-region active-active deployment with global load balancing.. Multi-region deployment with active-active traffic distribution provides the highest level of resilience for cloud-native apps.

Answer

Cross-region cold standby snapshots.

Answer

On-premises hot-site failover.

Answer

Single-region immutable backups.

Question 12

An ISSMP is leading the secure acquisition of a commercial off-the-shelf (COTS) payroll system that will process employee PII. The vendor will not permit source code review but does provide a completed consensus assessment questionnaire. Which action BEST allows the ISSMP to establish assurance that the product meets the organization's security requirements before signing the contract?

Accepted Answer

Require the vendor to undergo a SOC 2 Type II examination and review the report's trust services criteria and complementary user entity controls.. When source code review and on-site assessment are not feasible, the strongest pre-contract assurance comes from an independent examination of the vendor's controls over a period of time. A SOC 2 Type II report, read together with its trust services criteria and complementary user entity controls, tells the ISSMP both what was tested and what the organization must do to rely on those controls. Self-attestations, point-in-time tests, and deferred audits do not close the assurance gap before PII is entrusted to the vendor.

Answer

Request the vendor's most recent penetration test executive summary and treat a passing result as evidence that the product satisfies the security requirements.

Answer

Accept the vendor's completed consensus assessment questionnaire as sufficient evidence because it is signed by the vendor's Chief Information Security Officer.

Answer

Insert a contractual right to audit into the master services agreement and defer all assurance activities until the first annual audit after go-live.

Question 13

A multinational manufacturer is updating its contingency management framework after a prolonged supplier outage disrupted production. Executive leadership wants assurance that future disruptions are detected early and that recovery priorities remain aligned with business objectives. (Choose two.)

Accepted Answer

Establishing early warning indicators and monitoring for critical suppliers and internal dependencies.. Early warning indicators address the detection requirement by surfacing supplier and dependency deterioration before failure, while a change-driven BIA refresh keeps recovery priorities matched to current business objectives. Together they close the two gaps leadership identified. Delegation, exercise frequency, and insurance each address different concerns and none directly provides early detection or sustained alignment of recovery priorities.

Answer

Delegating all contingency planning decisions to the supplier management team.

Answer

Purchasing additional cyber insurance to transfer the financial impact of supplier outages.

Answer

Increasing the frequency of full-scale disaster recovery exercises to monthly.

Question 14

You are the ISSMP for a multinational retailer that operates in the European Union and the United States. The Chief Human Resources Officer asks you to approve a new employee monitoring tool that captures screenshots, keystrokes, and application usage on all corporate endpoints. Legal counsel in the EU has not yet been consulted. As the ISSMP, which action best demonstrates alignment of security leadership with legal and privacy obligations before the tool is deployed?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) with legal counsel and the works council before approving the monitoring tool.. Employee monitoring is high-risk processing under GDPR, so a DPIA must be completed before deployment. Involving legal counsel and the works council ensures the security program respects privacy, employment law, and consultation requirements. The ISSMP's role is to integrate legal and privacy governance into security decisions rather than treat monitoring as a purely technical control.

Answer

Require the vendor to sign a data processing agreement and then proceed with full deployment.

Answer

Deploy the tool only on endpoints used by US-based employees to avoid EU regulatory exposure.

Answer

Approve the tool because endpoint monitoring is a standard security control covered by the acceptable use policy.

Question 15

A retail company is conducting a business impact analysis (BIA) for its point-of-sale (POS) system. The BIA team has identified that a 4-hour outage would result in $500,000 in lost sales and reputational damage. The company's risk appetite allows for a maximum of 2 hours of downtime for critical systems. Which of the following should be the PRIMARY output of this BIA for the POS system?

Accepted Answer

A recovery time objective (RTO) of 2 hours or less for the POS system.. The BIA determines the maximum tolerable downtime based on business impact and risk appetite. For the POS system, the risk appetite limits downtime to 2 hours, so the RTO must be 2 hours or less. This RTO drives the selection of recovery strategies. Cost-benefit analysis, backup schedules, and supplier lists are downstream activities, not the primary BIA output.

Answer

A detailed cost-benefit analysis for upgrading the POS hardware.

Answer

A schedule for daily backups of POS transaction data.

Answer

A list of alternate suppliers for POS terminals.