ISC Practice Test 13 — 15 Questions

Question 1

Which TWO data sources are most critical for detecting lateral movement within a corporate network?

Accepted Answer

Authentication logs (e.g., Kerberos/LDAP). Lateral movement is characterized by network traffic between internal hosts and authentication logs indicating access attempts.

Answer

External DNS query logs

Answer

Public web server logs

Answer

VPN gateway logs

Question 2

Which TWO of the following are valid responses to a high-risk finding?

Accepted Answer

Purchase insurance (Transference). Risk treatment options are generally to mitigate, transfer, avoid, or accept.

Answer

Ask the auditor to leave

Answer

Delete all enterprise data

Answer

Ignore the finding until the next budget cycle

Question 3

What is the primary objective of a 'Security Gate' in an SDLC?

Accepted Answer

To ensure security activities were completed before moving to the next phase.. Security gates are checkpoints placed at the end of SDLC phases to verify that security requirements have been satisfied before proceeding to the next stage.

Answer

To automate the removal of legacy hardware.

Answer

To stop all software development until the budget is approved.

Answer

To provide a location for developers to submit their resignation.

Question 4

A project manager wants to bypass a security vulnerability finding because 'the patch will break the application'. What is the correct ISSMP response?

Accepted Answer

Document a formal Risk Acceptance with the business owner.. The ISSMP must initiate a formal Risk Acceptance process, requiring the business owner to acknowledge the residual risk and documenting it in the risk register.

Answer

Rewrite the application code personally.

Answer

Ignore the finding as it is non-critical.

Answer

Force the patch regardless of impact.

Question 5

Which TWO metrics are essential for evaluating the performance of a SOC team in identifying and containing threats?

Accepted Answer

Mean Time to Detect (MTTD). MTTD and MTTC are standard industry metrics used to measure SOC efficiency.

Answer

Total server downtime during updates

Answer

Number of coffee breaks taken

Answer

Total number of users on the network

Question 6

Which THREE technical controls are effective for limiting the impact of lateral movement?

Accepted Answer

Network micro-segmentation. Network segmentation, identity restrictions, and endpoint security prevent attackers from moving freely.

Answer

Increasing external bandwidth

Answer

Public domain name registration

Question 7

When configuring CrowdStrike Falcon to isolate a host during an active incident, what is the prerequisite requirement for the agent's communication state?

Accepted Answer

The agent must maintain an active connection to the Falcon Cloud. The Falcon agent must have an active heartbeat to the Falcon Cloud to receive the 'Isolate' command.

Answer

The agent must be in 'Aggressive' sensor mode

Answer

The host must have full disk encryption disabled

Answer

The host must be in a 'Managed' group with full administrative rights

Question 8

Which SOC metric is most appropriate to present to executive leadership to demonstrate the business value of security investments?

Accepted Answer

Reduction in Mean Time to Remediate (MTTR). Executive leadership cares about the reduction in risk and the financial impact of incidents, not technical metrics like 'events per second'.

Answer

Total number of firewall rules

Answer

Disk space usage of the SIEM

Answer

Number of dropped packets per day

Question 9

When configuring a Qualys scanner to perform authenticated scans on Windows, what is the 'Windows Authentication Record' primarily used for?

Accepted Answer

To perform deep local configuration checks. It provides the scanner with the credentials and privileges necessary to log into the target system and inspect local registry/file configurations.

Answer

To perform a packet capture

Answer

To deploy patches to the host

Answer

To bypass the local firewall

Question 10

When implementing FIM (File Integrity Monitoring) in Tripwire Enterprise, what is the specific purpose of a 'Promotion' action?

Accepted Answer

To update the baseline with the current file state. Promotion updates the 'Known Good' baseline with the state of the monitored file from a current scan.

Answer

To revert a file to its previous version

Answer

To deploy the file to all servers

Answer

To archive the file for legal hold

Question 11

Which SOC process ensures that all security tools are configured to log at the same time standard to prevent confusion during timeline analysis?

Accepted Answer

Time Synchronization (NTP). NTP (Network Time Protocol) synchronization is essential for accurate event correlation.

Answer

Data Normalization

Answer

Log Rotation

Answer

Access Control

Question 12

During an incident, which document is used by the SOC to record evidence, timestamps, and actions taken to ensure admissibility in a legal proceeding?

Accepted Answer

Chain of Custody. The Chain of Custody document tracks the handling of evidence from discovery through to investigation.

Answer

Runbook

Answer

Lessons Learned Report

Answer

Risk Register

Question 13

What is the primary role of a Change Advisory Board (CAB)?

Accepted Answer

To evaluate the risk and impact of proposed changes.. The CAB's primary role is to evaluate the technical and business impact of proposed changes, ensuring that all risks are identified and mitigated before approval.

Answer

To write the code for new features.

Answer

To perform automated penetration testing.

Answer

To manage the server hardware procurement budget.

Question 14

Which THREE items are typically verified in a Security Gate check before a production deployment?

Accepted Answer

Formal change request approval is documented. Production gates check for vulnerability remediation, passing functional/security tests, and the presence of required documentation (like the change request).

Answer

The marketing campaign has been approved

Answer

The developer has finished their vacation

Question 15

Which THREE activities are included in the 'Preparation' phase of the IR life cycle?

Accepted Answer

Conducting incident drills and exercises. Preparation involves setting up tools, training the team, and defining the procedures necessary for effective response.

Answer

Eradicating an ongoing malware infection

Answer

Writing the post-incident summary report