ISC Practice Test 12 — 15 Questions

Question 1

During a declared major incident, the incident commander needs to preserve volatile evidence on a compromised Linux server before the platform team rebuilds it. The server hosts a critical billing application and cannot be taken offline for more than 30 minutes. Which action BEST satisfies both the evidentiary requirement and the availability constraint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture a full physical memory image using LiME, record running processes with ps aux, and save network connection state from /proc/net, then proceed with the rebuild.. Volatile evidence such as RAM contents, running processes, and network connections is lost the instant a system is powered off or rebuilt. Capturing these artifacts first with a tool like LiME preserves the most perishable and often most probative evidence. Because the acquisition can be performed quickly, the 30-minute rebuild window remains achievable, balancing forensic obligations with the availability requirement of the billing application.

Answer

Power off the server immediately and remove the disk drives for forensic imaging at the lab, accepting the extended downtime as necessary for evidence integrity.

Answer

Run a full antivirus scan and collect the resulting quarantine log, then rebuild the server once the scan confirms the malware has been removed.

Answer

Take a forensic snapshot of the virtual machine through the hypervisor management console and continue running the production workload on the original VM.

Question 2

You are the ISSMP leading development of a security strategy that must support a three-year business transformation involving cloud migration and new digital products. Executive leadership expects the strategy to be both risk-based and measurable. Which two actions are most appropriate to include in the strategy? (Choose two.)

Accepted Answer

Establish a governance and reporting cadence that ties security performance metrics to the same executive dashboard used for transformation delivery.. A risk-based, measurable strategy aligns security objectives and indicators with business transformation milestones and executive risk appetite, and reports them through the same governance cadence as delivery. This keeps security integrated, visible, and adjustable as threats and business priorities evolve, rather than treating it as a separate or deferred workstream.

Answer

Adopt a fixed three-year security budget and roadmap that cannot be adjusted regardless of changes in the threat landscape or business priorities.

Answer

Defer all security architecture changes until the cloud migration and digital product launches are complete, to avoid slowing delivery.

Answer

Measure strategy success primarily by the number of security tools deployed and the volume of policies published during the transformation.

Question 3

An ISSMP is leading the security integration for a new software development project that will use agile methodologies. The project team is distributed across multiple time zones. Which TWO practices are MOST effective for ensuring security requirements are not overlooked in this environment? (Choose two.)

Accepted Answer

Embedding a security champion within each development team to advocate for and review security practices.. The most effective practices are embedding security champions in each team and defining security requirements as user stories with acceptance criteria. Champions provide local advocacy and expertise, while user stories make security visible and trackable in the agile backlog. Together, they ensure continuous security integration in a distributed environment, unlike late reviews, centralized decision-making, or passive documentation.

Answer

Using a shared document repository for security policies that developers can consult as needed.

Answer

Conducting a comprehensive security review only at the end of the project before release.

Answer

Requiring all security decisions to be made by the central security team to ensure consistency.

Question 4

A financial services firm has a primary data center and a cold DR site 120 miles away. A risk assessment reveals that the maximum tolerable downtime (MTD) for the core banking application is 8 hours, but the DR plan requires 24 hours to restore from tape backups at the cold site. The business continuity manager must close this gap. Which action is the MOST effective immediate step?

Accepted Answer

Upgrade the cold site to a warm site with pre-staged hardware and replicated data.. The core banking application's MTD is 8 hours, but the cold site requires 24 hours to restore. A warm site with pre-staged hardware and replicated data can be activated within the MTD, directly closing the gap. Increasing backup frequency addresses RPO, not RTO. Reciprocal agreements are unreliable. Altering the MTD to fit current capabilities undermines the BIA's purpose and leaves the business exposed.

Answer

Update the BIA to reflect a more realistic MTD of 24 hours for the core banking application.

Answer

Increase the backup frequency from daily to hourly and store tapes offsite.

Answer

Negotiate a reciprocal agreement with a nearby business partner to use their data center.

Question 5

A security manager is leading the response to a confirmed ransomware outbreak on a file server. The malware is still actively encrypting files and spreading laterally via SMB. Executive leadership asks the manager to authorize immediate containment. Which action BEST satisfies the containment objective while preserving forensic evidence?

Accepted Answer

Disconnect the file server's network cable and leave the system powered on to preserve volatile memory and active encryption state.. Containment must stop the spread immediately without destroying evidence. Physically disconnecting the network cable isolates the host while keeping memory and running processes available for forensic analysis. Powering off destroys volatile evidence, scanning in place allows continued encryption, and network-layer tricks are too slow. The manager should authorize the physical disconnection as the fastest, evidence-preserving containment step.

Answer

Immediately power off the file server to halt encryption and prevent further data loss.

Answer

Revoke the file server's DNS registration and wait for DHCP lease expiration to remove it from the network.

Answer

Run a full antivirus scan on the file server and quarantine any detected malware while keeping it on the network.

Question 6

You are the ISSMP at a financial services firm that has just acquired a smaller competitor. The acquisition brings 400 new employees, a different identity provider, and an unintegrated security operations center. Executive leadership wants a single security governance model within twelve months. Which action should you prioritize first to establish effective governance across the combined organization?

Accepted Answer

Define a unified security governance charter that assigns decision rights, accountability, and reporting lines for the merged security function.. Post-merger security integration succeeds when governance is defined first. A charter specifying decision rights, accountability, and reporting lines gives the combined security function a clear operating model. Only then can policy harmonization, identity consolidation, and SOC integration proceed coherently. Starting with technical merges without governance invites conflict and gaps in accountability.

Answer

Extend the acquiring company's security policies to the acquired entity without modification.

Answer

Immediately migrate all acquired employees to the acquiring company's identity provider.

Answer

Consolidate both security operations centers into one physical location within the first quarter.

Question 7

A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The risk team has identified that the platform's encryption at rest uses a deprecated algorithm. The vendor cannot upgrade the algorithm for another six months due to contractual constraints. Which of the following is the BEST risk response?

Accepted Answer

Mitigate the risk by implementing compensating controls such as tokenization of PHI until the algorithm is upgraded.. Implementing compensating controls like tokenization mitigates the risk by protecting PHI even if the encryption is compromised. This approach allows the organization to continue operations while addressing the vulnerability until a permanent fix is available. It balances security, business needs, and regulatory compliance, making it the most appropriate risk response.

Answer

Avoid the risk by delaying the telehealth platform launch until the vendor upgrades the encryption.

Answer

Accept the risk because the platform is protected by network segmentation and access controls.

Answer

Transfer the risk by purchasing cyber insurance that covers data breaches.

Question 8

Your organization is restructuring its security team after a merger. Two legacy security operations centers use different escalation paths, and executives complain that incident decisions are inconsistent. As the ISSMP, you must design a governance structure that clarifies authority, accountability, and decision rights across the combined security function. Which action best accomplishes this?

Accepted Answer

Publish a security governance charter and RACI matrix that define decision rights, escalation thresholds, and accountable roles for the unified security organization.. A governance charter with a RACI matrix establishes documented decision rights, accountability, and escalation thresholds. This directly resolves inconsistent escalation across merged security operations and gives executives a single, transparent model for how security decisions are made, reviewed, and escalated.

Answer

Transfer all security decision-making authority to the IT operations director, since that role already manages the largest technical team.

Answer

Adopt the escalation process from the larger legacy organization without modification and require the smaller team to comply immediately.

Answer

Allow each legacy security operations center to keep its existing escalation path and resolve conflicts case by case through informal manager discussions.

Question 9

A security operations manager is reviewing the SOC's use of threat intelligence and wants to ensure that indicators are automatically ingested and matched against event data with minimal latency. Which capability should be prioritized to meet this objective?

Accepted Answer

Automated threat intelligence platform integration with the SIEM using structured formats. Automated integration between a threat intelligence platform and the SIEM using structured formats like STIX/TAXII allows indicators to be ingested and matched against event data continuously with minimal delay. This is the mechanism that turns threat intelligence into actionable detections in near-real time.

Answer

Quarterly distribution of a PDF threat report to SOC analysts

Answer

Manual review of intelligence reports by senior analysts before ingestion

Answer

Manual entry of indicators into a spreadsheet shared by the team

Question 10

A multinational corporation is reviewing its business continuity plan (BCP). The BCP includes a recovery strategy for its primary ERP system that relies on a hot site with synchronous replication. During a tabletop exercise, participants discover that the hot site is in the same seismic zone as the primary data center. Which of the following is the MOST critical risk to address?

Accepted Answer

The hot site may be unavailable during a regional earthquake, defeating the purpose of geographic redundancy.. The hot site and primary data center are in the same seismic zone, so a single earthquake could destroy both. This eliminates geographic redundancy and is the most critical risk. Latency, capacity, and cost are secondary concerns that can be managed after ensuring the recovery site is in a different region. The BCP must be revised to relocate the hot site or implement a multi-region strategy.

Answer

Synchronous replication may introduce latency that degrades ERP performance for users.

Answer

Synchronous replication requires a dedicated high-bandwidth connection, which may be cost-prohibitive.

Answer

The hot site may not have sufficient hardware capacity to run the ERP system at full load.

Question 11

A security manager discovers that a business unit has been storing customer payment card data in a legacy on-premises application that was never brought into the PCI DSS assessment scope. The business unit argues the data is 'just for reporting.' Which action should the security manager take FIRST?

Accepted Answer

Document the discovery, determine the data's classification and legal retention requirements, and bring the application into the compliance scope or remove the data through an approved process.. When cardholder data is found outside the assessed environment, the security manager's first duty is to establish the facts: what data, where it flows, how long it must be kept, and what legal holds apply. That assessment determines whether the correct path is to bring the system into scope under PCI DSS or to securely remove the data. Documenting the discovery and decision protects the organization with regulators, acquirers, and auditors.

Answer

Add the legacy application to the next annual PCI DSS assessment and continue normal operations until then.

Answer

Report the business unit to the acquiring bank and request that the unit's manager be disciplined for non-compliance.

Answer

Immediately decommission the legacy application and delete all associated data without further analysis.

Question 12

You are the ISSMP at a mid-sized manufacturing company. The CEO asks you to explain how the security program supports the organization's strategic goal of expanding into new international markets. Which response best demonstrates strategic alignment of the security program with business objectives?

Accepted Answer

Security will map regulatory, contractual, and customer assurance requirements in each target market and build a roadmap that enables compliant market entry.. Strategic alignment means security actively supports business goals. Mapping regulatory, contractual, and customer assurance requirements for target markets lets security remove barriers and inform expansion planning. This positions the ISSMP as a business enabler, giving leadership a roadmap that ties controls and investments to market entry success rather than treating security as an isolated cost.

Answer

Security will defer all planning until the business finalizes its expansion locations and timelines.

Answer

Security will request additional budget to purchase more tools before any expansion decision is made.

Answer

Security will implement the same controls used in the domestic market to keep costs predictable during expansion.

Question 13

A healthcare organization is developing its crisis management plan. The plan must address how the organization will coordinate with external entities during a public health emergency. Which of the following is the PRIMARY purpose of including a call tree and contact list in the crisis management plan?

Accepted Answer

To ensure rapid and reliable communication with internal and external stakeholders during an incident.. The call tree and contact list are designed to enable rapid, reliable communication with stakeholders during a crisis. In a public health emergency, notifying internal teams, external partners, and regulators quickly is essential for coordinated response. Chain of command, financial assessment, and technical recovery are handled by other plan components. Therefore, communication is the primary purpose.

Answer

To document the chain of command and delegation of authority during a crisis.

Answer

To outline the technical recovery steps for IT systems affected by the emergency.

Answer

To provide a checklist for assessing the financial impact of the emergency.

Question 14

A software development company is integrating risk management into its DevOps pipeline. The security team wants to implement a control that automatically scans code for vulnerabilities before deployment. Which of the following best describes this type of control in the context of risk management?

Accepted Answer

Preventive control. The automated code scan before deployment is a preventive control. It stops vulnerabilities from entering production, thereby reducing the likelihood of exploitation. In risk management terms, controls are classified by their function: preventive controls block undesirable events, detective controls discover them, and corrective controls respond after they occur. Integrating such scans into the DevOps pipeline exemplifies a preventive, shift-left approach to security.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 15

An organization is retiring a customer relationship management system that stored personally identifiable information. The system is scheduled for shutdown in 30 days, and the ISSMP must ensure the decommissioning aligns with lifecycle management and data protection obligations. Which action should the ISSMP prioritize?

Accepted Answer

Perform a data inventory across all environments, apply the retention schedule, and execute verified secure destruction of personal data with formal certification.. Decommissioning must account for personal data wherever it resides, not just in the production database. A full inventory identifies backups, replicas, and derived datasets, and the retention schedule determines what may be kept lawfully. Verified destruction with certification gives the organization defensible evidence that privacy obligations were met, closing the lifecycle properly rather than leaving orphaned copies behind.

Answer

Delete the production database records and decommission the servers, then document the shutdown in the change management system.

Answer

Archive the production database to a lower-cost cold storage tier and retain it indefinitely in case of future litigation or audit needs.

Answer

Anonymize the production records by removing the customer name column, then retain the remaining data indefinitely for business analytics.