ISC Practice Test 14 — 15 Questions

Question 1

A security manager is building a compliance monitoring program for a multinational insurer subject to state breach notification laws, the Gramm-Leach-Bliley Act, and internal audit requirements. Which TWO activities best establish continuous compliance visibility across these obligations? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mapping regulatory requirements to specific security controls and assigning control owners with defined review cadences. Continuous compliance visibility depends on traceability and repeatable evidence collection. Mapping legal obligations to controls with named owners and review cadences shows what must be monitored, while scheduled evidence collection with reminders and exception tracking shows whether controls actually operate. Annual tests, delegation to internal audit, and framework adoption without mapping each fail to produce ongoing, auditable visibility across the insurer's overlapping regulatory obligations.

Answer

Adopting a control framework such as NIST SP 800-53 and assuming framework alignment automatically satisfies all applicable regulations

Answer

Delegating compliance monitoring entirely to the internal audit function so security can focus on technical operations

Answer

Running an annual penetration test and filing the report with the board of directors as evidence of due diligence

Question 2

An ISSMP is reviewing the system development lifecycle (SDLC) for a new payroll application. The organization must comply with PCI DSS because the application will process employee salary payments. At which phase should the ISSMP ensure that PCI DSS requirements are identified and documented?

Accepted Answer

Requirements phase. PCI DSS requirements should be identified and documented during the requirements phase. This ensures that compliance controls are designed into the system from the start, avoiding costly rework and ensuring that the payroll application meets regulatory obligations. Later phases are for designing, testing, and deploying those requirements, not for discovering them.

Answer

Design phase

Answer

Testing phase

Answer

Deployment phase

Question 3

A security manager is developing a business continuity plan (BCP) for the security operations center (SOC). The plan must ensure that critical monitoring and response capabilities continue during a disaster that disables the primary SOC. Which strategy BEST addresses this requirement?

Accepted Answer

Establish a redundant SOC at an alternate site with replicated tools, data, and trained staff.. A redundant SOC with replicated tools, data, and trained staff is the most robust strategy for ensuring continuity of critical monitoring and response during a disaster. It provides full failover capability. Mobile alerts, MSSP outsourcing without prior arrangements, and increased automation are insufficient or unreliable for maintaining comprehensive SOC operations.

Answer

Increase the use of automation to reduce the need for human analysts.

Answer

Outsource all SOC functions to a managed security service provider (MSSP) during the disaster.

Answer

Rely on automated tools to send alerts to on-call analysts via mobile devices.

Question 4

A security manager is reviewing the organization's incident response plan. The plan requires that after a major incident, lessons learned are captured and used to improve future response. Which activity BEST ensures that lessons learned are effectively integrated into the security operations program?

Accepted Answer

Conduct a post-incident review meeting with all stakeholders and document actionable recommendations with assigned owners and deadlines.. Lessons learned are most effectively integrated through a formal post-incident review that produces actionable recommendations with assigned owners and deadlines. This creates accountability and ensures changes are implemented and tracked. Simply updating documents, filing reports, or conducting generic training lacks the structured follow-through needed to improve the security operations program.

Answer

Increase the frequency of security awareness training for all employees.

Answer

Update the incident response plan with new technical controls and distribute it to the team via email.

Answer

File a detailed incident report with senior management and archive it for compliance purposes.

Question 5

A security manager is asked to approve a vendor contract for a cloud service that will process regulated data. The vendor refuses any changes to its standard terms and offers only a self-attestation of security. Which action is most appropriate?

Accepted Answer

Reject the engagement unless the vendor provides independent assurance and accepts contractual security, audit, and breach notification obligations.. When a processor handles regulated data, the organization remains accountable for protecting it and must be able to show due diligence. That requires independent assurance of the vendor's controls and contract language that makes security, audit, and breach notification enforceable. A vendor that refuses both leaves the organization without the means to meet its regulatory duties, so the engagement should not proceed on those terms.

Answer

Approve the contract and rely on cyber insurance to cover any losses if the vendor suffers a breach.

Answer

Approve the contract because the vendor's self-attestation is sufficient evidence of security for regulated data.

Answer

Approve the contract but require the organization's own security team to perform a penetration test of the vendor's environment.

Question 6

Your organization runs its order-management platform in an active-active configuration across two data centers, with a third site reserved for disaster recovery. During a quarterly BCP exercise, the CIO asks you to define the maximum acceptable time that transaction data may be irretrievably lost if the primary site fails before replication completes. Which contingency metric should you present?

Accepted Answer

Recovery Point Objective (RPO). The metric that bounds acceptable data loss measured in time is the Recovery Point Objective. It tells the CIO how frequently data must be replicated or backed up so that a primary-site failure does not lose more transactions than the business can tolerate. MTD, RTO, and SDO address outage duration, restoration speed, and interim service level respectively, none of which quantifies lost transaction data.

Answer

Recovery Time Objective (RTO)

Answer

Service Delivery Objective (SDO)

Answer

Maximum Tolerable Downtime (MTD)

Question 7

A financial services firm is acquiring a SaaS-based fraud analytics platform. During the due diligence phase of the system lifecycle, the vendor provides a SOC 2 Type II report covering the last 12 months, a completed security questionnaire, and a penetration test summary dated 18 months ago. The ISSMP must decide whether to accept the vendor for integration into the production environment. Which action best satisfies the ISSMP's responsibility at this lifecycle stage?

Accepted Answer

Request a current penetration test report scoped to the integration interface and verify remediation of prior findings before granting conditional acceptance.. A stale penetration test cannot validate the current security posture of a vendor or the new integration interface, so the ISSMP must obtain fresh, scoped testing and confirm remediation before acceptance. Conditional acceptance preserves the business timeline while satisfying lifecycle due diligence. The SOC 2 Type II report is valuable for control assurance but does not substitute for technical testing of the specific integration.

Answer

Defer the decision entirely to the legal team, because vendor risk acceptance is a contractual matter rather than an ISSMP lifecycle responsibility.

Answer

Reject the vendor immediately because the penetration test is older than 12 months, since any test older than one year is automatically disqualifying under the SDLC security policy.

Answer

Accept the vendor based on the SOC 2 Type II report, because it covers a full 12-month period and supersedes the need for a current penetration test.

Question 8

A security manager is defining the scope of the organization's incident response program and needs to ensure that the program addresses all phases of the incident handling lifecycle. Which sequence of phases should the manager use as the framework for the program?

Accepted Answer

Preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. The incident handling lifecycle consists of preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Using this sequence ensures the program covers readiness, identification, response actions, restoration, and lessons learned, which is exactly what the scenario requires.

Answer

Identification, protection, detection, response, and recovery

Answer

Planning, implementation, operation, and maintenance

Answer

Assessment, authorization, monitoring, and continuous improvement

Question 9

You are the ISSMP for a mid-sized financial services firm. The CIO asks you to build a repeatable process for evaluating and onboarding new vendors that handle regulated data. You must ensure the process produces defensible evidence of due diligence and aligns with the firm's risk appetite. Which approach best satisfies this requirement?

Accepted Answer

Establish a formal third-party risk management program with tiered due diligence, standardized security questionnaires, contractual security requirements, and periodic reassessments based on risk tier.. A structured, tiered third-party risk management program is the most defensible approach because it standardizes due diligence, scales oversight to risk, embeds contractual security obligations, and includes ongoing reassessment. This produces auditable evidence and ensures vendor risk decisions reflect the organization's risk appetite rather than ad hoc judgments.

Answer

Require every vendor to complete the same exhaustive security questionnaire annually, regardless of the data they handle or the services they provide.

Answer

Delegate vendor security review entirely to the procurement department and accept their recommendation without security team involvement.

Answer

Rely on the vendor's public marketing materials and self-attestations as the sole source of security assurance before onboarding.

Question 10

A security manager is building the incident response program for a financial services firm and needs to define the criteria that determine when an event must be escalated to a formally declared incident. Which artifact should be created to document these criteria, the required responders, and the approval chain for escalation?

Accepted Answer

Incident response plan (IRP). Defining when an event becomes a declared incident, who must respond, and who approves escalation is the core purpose of the incident response plan. It provides the classification thresholds and authority structure that guide the SOC's triage decisions and ensures consistent, accountable escalation across the organization.

Answer

Business continuity plan (BCP)

Answer

Service level agreement (SLA)

Answer

Disaster recovery plan (DRP)

Question 11

As the ISSMP, you are advising the executive team on how to embed security requirements into the organization's enterprise architecture practice. Business units frequently deploy new cloud services without security review, creating unmanaged risk. Which action best integrates security into enterprise architecture governance?

Accepted Answer

Mandate that security architecture review be a required gate in the enterprise architecture approval workflow for new solutions, with defined security criteria and exception handling.. Making security architecture review a defined gate in the enterprise architecture approval workflow integrates security into existing governance rather than adding a parallel process. Clear criteria and exception handling keep the gate practical, auditable, and aligned with business delivery, which addresses unmanaged cloud deployments at the point of decision.

Answer

Require business units to submit a security questionnaire after each cloud service is deployed and remediate any findings within thirty days.

Answer

Ask the enterprise architecture team to consult the security team informally whenever they believe a new solution may have security implications.

Answer

Issue a policy stating that cloud services are prohibited unless the security team approves them, without defining approval criteria or an exception process.

Question 12

A global retailer is expanding its risk management program to include third-party vendors. The Chief Information Security Officer (CISO) is concerned about supply chain risks. Which TWO of the following are the most effective controls to mitigate third-party risk? (Choose two.)

Accepted Answer

Including right-to-audit clauses in all vendor contracts.. The most effective controls to mitigate third-party risk are requiring a security questionnaire before onboarding and including right-to-audit clauses in contracts. The questionnaire provides an initial risk assessment, while right-to-audit clauses enable ongoing verification of the vendor's security controls. Together, they establish a preventive and detective framework that is standard in supply chain risk management.

Answer

Requiring vendors to use the organization's preferred cloud service provider.

Answer

Transferring all third-party risk to the vendor through indemnification clauses.

Answer

Conducting annual penetration testing of the vendor's external network.

Question 13

During an internal investigation, a security manager learns that an employee may have exfiltrated proprietary source code to a personal cloud account. Legal counsel has issued a litigation hold. Which action should the security manager take to preserve evidence while respecting legal constraints?

Accepted Answer

Image the employee's workstation and preserve relevant logs and email under documented chain of custody, coordinating with legal counsel before any further action.. When litigation is reasonably anticipated, the organization has a duty to preserve potentially relevant evidence and must avoid spoliation. Forensic imaging with documented chain of custody captures volatile and deleted data that ordinary copying would lose, and counsel coordination ensures the collection respects privilege, privacy, and jurisdictional limits. Containment steps may follow, but only in a sequence that does not destroy evidence.

Answer

Ask the employee's manager to confront the employee and request that they delete the copied files from their personal account.

Answer

Log into the employee's personal cloud account using credentials found on the workstation and remove the copied source code.

Answer

Immediately disable the employee's account and delete the mailbox contents to prevent further data loss.

Question 14

A security manager at a publicly traded US retailer is preparing for the first year of SOX Section 404 IT general controls testing. The external auditor requests evidence that access to the financial reporting database is revoked within 24 hours of an employee's termination. Which control artifact best satisfies the auditor's request?

Accepted Answer

Automated deprovisioning logs correlated with HR termination records showing timestamps for both events. Auditors testing SOX IT general controls require evidence that a control operated effectively across the period, not just that it was designed. Correlating HR termination records with automated deprovisioning timestamps proves both completeness and timeliness for each event. Policies, periodic reviews, and network segmentation each address different risks and cannot substitute for event-level proof that terminated users lost access within the mandated window.

Answer

A quarterly user access review report showing all active accounts and their last login dates

Answer

The IT access management policy signed by the CIO stating that access is revoked within 24 hours of termination

Answer

A firewall rule set export showing the financial database subnet is restricted from the general corporate network

Question 15

A security manager is reviewing the organization's log management program. An auditor notes that several critical servers retain logs for only 7 days, while the incident response policy requires the ability to investigate incidents up to 90 days after detection. The servers generate approximately 50 GB of logs per day. Which action BEST addresses the audit finding while controlling storage cost?

Accepted Answer

Configure a centralized log management platform to ingest the server logs, retain full-fidelity data for 90 days, and store compressed archives for a longer period on lower-cost storage.. The audit finding requires the ability to investigate incidents up to 90 days after detection, which means logs must be retained, protected from tampering, and searchable for that period. A centralized platform with tiered retention satisfies the requirement by keeping recent data readily searchable while archiving older data on cheaper storage. This balances investigative needs with storage cost at 50 GB per day.

Answer

Reduce the logging level on the servers so that only error events are recorded, allowing 90 days of retention within the existing local disk capacity.

Answer

Increase the local log rotation on each server to keep 90 days of logs on the server's own disk, expanding storage as needed on each host.

Answer

Enable log forwarding to a syslog server with default retention settings and rely on the syslog server's built-in compression to meet the 90-day requirement.