ISC Practice Test 13 — 15 Questions

Question 1

A multinational corporation is implementing an Enterprise Risk Management (ERM) program. The Chief Risk Officer wants to ensure that risk management is integrated into strategic planning. Which of the following activities best demonstrates this integration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Including risk-adjusted return on capital (RAROC) in the evaluation of all major investment proposals.. The activity that best demonstrates integration of risk management into strategic planning is the use of risk-adjusted return on capital (RAROC) in investment decisions. RAROC forces decision-makers to consider risk alongside return, ensuring that risk is a factor in strategic capital allocation. This aligns with ERM principles, where risk management is not a standalone function but is woven into the fabric of strategic decision-making.

Answer

Purchasing cyber insurance to transfer the financial impact of data breaches.

Answer

Conducting annual risk assessments for each business unit and compiling a risk register.

Answer

Establishing a risk committee that meets quarterly to review the top ten risks.

Question 2

A healthcare organization is integrating risk management into its enterprise architecture practice. The Chief Risk Officer (CRO) wants to ensure that new technology initiatives are evaluated for risk before funding is approved. Which activity best demonstrates that risk management is embedded in the architecture governance process?

Accepted Answer

Including a documented risk assessment with identified mitigations as a mandatory gate in the architecture review board's approval criteria.. Embedding risk management in architecture governance means risk evaluation becomes a required input to the approval decision, not an after-the-fact review. A mandatory risk assessment gate ensures that identified risks and mitigations are considered while design changes are still feasible and before funding is committed. This creates accountability and aligns architecture decisions with the organization's risk appetite.

Answer

Asking project managers to report risk status monthly to the project management office after the initiative has launched.

Answer

Requiring the security team to perform a penetration test after each new system is deployed to production.

Answer

Delegating all risk decisions to the security operations center so that architecture teams can focus on delivery timelines.

Question 3

A security manager is developing a risk treatment plan for a critical vulnerability in a web application. The vulnerability allows remote code execution and has a high likelihood of exploitation. The organization has a low risk appetite. Which TWO of the following are the MOST appropriate risk treatment options to consider? (Choose two.)

Accepted Answer

Apply a vendor patch as soon as it becomes available.. Applying the vendor patch and implementing a WAF rule are both mitigation strategies that reduce the likelihood or impact of exploitation. They align with a low risk appetite by actively addressing the vulnerability. Patching eliminates the flaw, while a WAF provides immediate protection. Other options like acceptance, transfer, or avoidance are less appropriate given the high risk and available mitigations.

Answer

Accept the risk because the application is behind a VPN.

Answer

Transfer the risk by outsourcing the application to a third party.

Answer

Avoid the risk by shutting down the web application.

Question 4

A global financial services firm is expanding its enterprise risk management (ERM) program to include third-party risk. The CISO wants to ensure that the risk appetite for third-party relationships is consistently applied across all business units. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Establish a centralized third-party risk management office that reviews and approves all vendor engagements.. Centralizing third-party risk management ensures that all vendor engagements are assessed against the same risk appetite and thresholds. This governance structure prevents business units from making inconsistent risk decisions and provides a clear escalation path. It also enables aggregate reporting to the board, demonstrating that third-party risk is managed within the enterprise risk framework.

Answer

Delegate third-party risk decisions to each business unit to increase agility and ownership.

Answer

Implement a vendor risk rating system that scores each vendor based on financial stability and security posture.

Answer

Require all business units to use the same risk assessment questionnaire for third-party vendors.

Question 5

An organization is adopting a DevSecOps model and wants to ensure that security requirements are continuously validated throughout the CI/CD pipeline. The ISSMP is asked to define the security control gates. Which approach BEST integrates security into the pipeline while maintaining development velocity?

Accepted Answer

Automated static and dynamic application security testing (SAST/DAST) integrated into the build and test stages, with quality gates that fail the build on critical findings.. The best approach is to integrate automated SAST and DAST into the CI/CD pipeline with quality gates that fail the build on critical findings. This provides continuous security validation, shifts security left, and maintains development velocity by automating checks. Manual reviews, training, or periodic penetration tests do not offer the same level of continuous, integrated assurance.

Answer

Manual security reviews at the end of each sprint before deployment to production.

Answer

Performing a full penetration test once per quarter and addressing findings in the next release.

Answer

Requiring developers to attend annual secure coding training and sign a security policy acknowledgment.

Question 6

An ISSMP is reviewing a project that will replace the organization's customer relationship management (CRM) system. The project manager proposes to reuse the existing security test plan from the legacy CRM to save time and cost. The new CRM is a cloud-based SaaS solution with different data flows and integrations. What should the ISSMP recommend?

Accepted Answer

Require a new security test plan tailored to the SaaS CRM's architecture, data flows, and threat model.. The correct approach is to develop a security test plan specific to the new SaaS CRM. Because the system architecture, data flows, and threat model differ from the legacy on-premises CRM, the old test plan would not cover cloud-specific risks. The ISSMP must ensure that security testing is aligned with the current system and its risk profile, as part of effective systems lifecycle management.

Answer

Delegate the decision to the SaaS vendor's security team since they own the platform.

Answer

Approve the reuse of the legacy test plan because the functional requirements are similar.

Answer

Reuse the legacy plan but add a penetration test after go-live to cover any gaps.

Question 7

A financial services firm has a primary data center in a flood plain and a contractual obligation to resume trading operations within two hours of any disruption. The CIO proposes replacing the current cold site with a mirrored hot site in a different seismic zone, but the CFO objects to the recurring cost. Which action best supports a defensible decision while preserving the two-hour commitment?

Accepted Answer

Perform a business impact analysis to quantify the financial and regulatory cost of exceeding two hours, then compare that against hot site and alternative recovery options.. The decision hinges on translating the two-hour contractual obligation into quantified business impact so leadership can compare that exposure against the recurring cost of a hot site or other recovery architectures. A BIA supplies the financial, regulatory, and reputational figures that make the trade-off explicit and auditable. Without that analysis, the choice becomes a budget argument rather than a risk-based decision, and the organization cannot demonstrate due diligence to regulators or clients.

Answer

Purchase a warm site and document that trading operations will resume within four hours instead of two.

Answer

Retain the cold site and rely on cyber insurance to cover losses from any disruption exceeding two hours.

Answer

Accept the cold site but shorten the disaster declaration window so restoration starts sooner.

Question 8

A security manager is evaluating the effectiveness of the SOC's detection capabilities. The SOC has a high volume of alerts, but many are false positives, and analysts are overwhelmed. Which metric BEST indicates that the SOC needs to tune its detection rules to reduce noise?

Accepted Answer

False positive rate (FPR) for alerts.. The false positive rate directly measures the proportion of alerts that are not genuine threats. A high FPR explains why analysts are overwhelmed and indicates that detection rules are too noisy. Tuning rules to reduce false positives will improve SOC efficiency. Other metrics like MTTD, MTTR, and alert volume do not specifically identify noise from false alerts.

Answer

Number of alerts generated per day.

Answer

Mean time to respond (MTTR) for all alerts.

Answer

Mean time to detect (MTTD) for confirmed incidents.

Question 9

During an internal investigation, a security manager learns that an employee copied proprietary source code to personal cloud storage before resigning. Legal counsel requests that the security team preserve evidence without tipping off the former employee. Which action best supports potential civil litigation while maintaining investigative integrity?

Accepted Answer

Issue a litigation hold notice to relevant custodians and capture forensic images of the involved systems and cloud logs. Once litigation is reasonably anticipated, the organization has a duty to preserve potentially relevant evidence. Issuing a litigation hold and capturing forensic images and logs accomplishes that while keeping the investigation discreet. Deleting data risks spoliation sanctions, notifying the subject undermines the investigation, and informal collection by a manager jeopardizes both admissibility and chain of custody.

Answer

Ask the former employee's manager to retrieve any copies of the code the employee may have retained on personal devices

Answer

Delete the former employee's mailbox and home directory to prevent further unauthorized access from outside the organization

Answer

Immediately suspend the former employee's accounts and notify them in writing that an investigation has begun

Question 10

A security manager at a U.S. publicly traded company is preparing for the annual external financial audit. The IT team wants to grant the external auditor temporary access to the ERP system to verify access controls. Which action best satisfies both the audit requirement and security governance principles?

Accepted Answer

Provision named, time-bound read-only accounts for each auditor, with activity logged and reviewed by the security team.. External auditors need sufficient, appropriate evidence that controls operate as described, and that requires access that is attributable, minimal, and monitored. Named read-only accounts limited to the audit period give the auditor what they need while preserving non-repudiation and least privilege. The security manager can then review logs to confirm no inappropriate activity occurred, which itself becomes audit evidence of governance over the financial reporting environment.

Answer

Create a privileged shared auditor account with a password that is rotated and emailed to the audit team daily.

Answer

Provide the auditors with a database backup so they can restore and query it inside their own environment.

Answer

Grant the auditors the existing administrator credentials used by the IT operations team for the duration of the audit.

Question 11

A global financial services firm has completed a quantitative risk analysis for its primary trading platform. The analysis shows an annualized loss expectancy (ALE) of $4.2 million. The platform owner proposes a $1.1 million annual security program that would reduce the ALE to $900,000. The Chief Information Security Officer (CISO) must decide whether to recommend funding. The organization's risk appetite statement permits a maximum residual ALE of $1.5 million for critical systems. Which decision is most appropriate?

Accepted Answer

Recommend funding the program because the residual ALE of $900,000 is below the $1.5 million risk appetite threshold and the control cost is less than the risk reduction.. The treatment is justified because the $1.1M control reduces ALE by $3.3M annually, and the resulting residual ALE of $900,000 falls within the $1.5M appetite. Effective risk management compares the cost of the control to the risk reduction achieved, not to the residual ALE alone, and ensures the residual position aligns with documented tolerance. This option satisfies both economic and governance criteria.

Answer

Recommend funding only if the program can eliminate all residual risk, because any residual ALE above zero violates the risk appetite statement.

Answer

Reject funding because the $1.1 million annual cost exceeds the $900,000 residual ALE, making the program economically unjustified.

Answer

Defer the decision indefinitely because quantitative analysis cannot be used to justify security spending when a risk appetite statement exists.

Question 12

A security manager is presenting a risk register to the executive committee. One risk item shows a high likelihood and high impact, but the risk owner has proposed a treatment plan that requires significant funding. The executive committee asks for justification. Which of the following is the BEST approach to justify the investment?

Accepted Answer

Present the annualized loss expectancy (ALE) and compare it to the cost of the control.. Using ALE to compare expected loss with control cost provides a clear financial justification. It quantifies the risk in monetary terms, enabling executives to evaluate the investment's value. This approach aligns security spending with business objectives and demonstrates that the control is cost-effective, making it the most persuasive method.

Answer

Highlight the regulatory penalties that could result if the risk materializes.

Answer

Explain that the risk is high on the risk matrix and therefore must be treated.

Answer

Reference industry benchmarks showing that similar organizations have implemented the control.

Question 13

A multinational corporation is integrating its risk management program with its supply chain management. The CISO wants to ensure that risk assessments are performed consistently for all suppliers. Which of the following is the MOST important factor to consider when defining the risk assessment criteria?

Accepted Answer

The criticality of the goods or services provided to the organization's operations.. The criticality of the goods or services determines the potential impact on the organization if the supplier fails or is compromised. This factor ensures that risk assessments prioritize suppliers that are essential to operations or handle sensitive data. By focusing on criticality, the organization can allocate resources effectively and apply appropriate controls based on risk severity.

Answer

The geographic location of the supplier's headquarters.

Answer

The supplier's annual revenue and financial stability.

Answer

The length of the contract with the supplier.

Question 14

A global manufacturing company has a federated governance model in which each regional business unit owns its own security budget and risk register. The corporate CISO is accountable to the board for enterprise-wide risk but has no direct authority over regional security spending. The board has asked the CISO to produce one consolidated risk view that can be audited. Which action should the ISSMP take FIRST to establish an effective enterprise-wide security governance structure?

Accepted Answer

Charter a security governance council with named regional and corporate representatives, and agree on decision rights, a common risk taxonomy, and a consolidated reporting cadence.. In a federated organization, the CISO often has accountability without line authority, so governance must be constructed through negotiation rather than command. A chartered council with explicit decision rights, a shared risk taxonomy, and a defined reporting cadence converts fragmented regional risk data into a single auditable enterprise view. Centralizing budgets, issuing unilateral policy, or outsourcing assessment each fail to create the durable, repeatable governance mechanism the board requires, and each risks alienating the regional owners whose participation is essential.

Answer

Consolidate all regional security budgets under the corporate CISO and reassign regional security staff to a centralized reporting line.

Answer

Publish a corporate security policy that mandates a single enterprise risk register owned and updated solely by the corporate security office.

Answer

Engage an external audit firm to assess each region's security posture and deliver the findings directly to the board on the CISO's behalf.

Question 15

A security manager is reviewing the organization's incident response plan and wants to ensure that evidence collected during an incident is handled in a manner that preserves its integrity for potential legal proceedings. Which TWO practices should be included in the evidence handling procedures? (Choose two.)

Accepted Answer

Using write blockers during forensic imaging of storage media. Maintaining a documented chain of custody and using write blockers during forensic imaging are both essential to preserving evidence integrity. The chain of custody proves continuous, accountable control, while write blockers ensure the original media is not altered, together supporting admissibility in legal proceedings.

Answer

Allowing only senior management to access the evidence storage area

Answer

Storing evidence on the same workstation used for analysis

Answer

Deleting duplicate evidence files to save storage space