ISC Practice Test 14 — 15 Questions

Question 1

Which document is primarily responsible for documenting the security controls applicable to a system during the SDLC's requirements phase?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the foundational document that defines the security controls selected and implemented for a system.

Answer

Acceptable Use Policy (AUP)

Answer

Service Level Agreement (SLA)

Answer

Business Impact Analysis (BIA)

Question 2

Which TWO of the following are critical components of a secure SDLC (Software Development Life Cycle) implementation?

Accepted Answer

Continuous Threat Modeling. A secure SDLC requires both proactive security requirements (Threat Modeling) and detective security validation (Automated Testing) to be integrated into the process.

Answer

Manual annual security reviews

Answer

Standardized desktop operating systems

Answer

Outsourcing all security to a vendor

Question 3

Which TWO of the following are potential risks if an ISSMP fails to integrate security into the 'Requirements Management' phase?

Accepted Answer

Inherent architectural design flaws. Failing to integrate security early results in 'bolted-on' security which is often flawed, expensive to fix, and leaves the system vulnerable to architectural design defects.

Answer

Better developer morale

Answer

Automatic regulatory compliance

Answer

Faster deployment velocity

Question 4

Which phase of the SDLC is most appropriate for conducting a formal Threat Modeling exercise?

Accepted Answer

Design phase. Threat modeling is most effective during the design phase because it allows architects to identify and mitigate design-level security flaws before implementation begins.

Answer

Release phase

Answer

Operations and Maintenance

Answer

Initiation phase

Question 5

Which THREE factors should an ISSMP consider when selecting security controls for a new system?

Accepted Answer

The organization's threat landscape. Selecting controls involves balancing business requirements, regulatory compliance, and the actual threat landscape to ensure a proportionate risk response.

Answer

The vendor's marketing materials

Answer

The number of employees in the company

Question 6

During a software audit, it is found that developers have administrative access to the production database to troubleshoot errors. What change should the ISSMP implement?

Accepted Answer

Implement Just-In-Time (JIT) privileged access for troubleshooting.. The ISSMP should implement a 'break-glass' access policy where developers can request temporary, audited access via a tool like HashiCorp Boundary or AWS IAM Identity Center, rather than having persistent standing access.

Answer

Remove all access and require developers to submit tickets for DBAs to perform changes.

Answer

Create a shared 'admin' account for all developers.

Answer

Only allow access during business hours.

Question 7

Which TWO mechanisms are effective for preventing 'insecure direct object references' (IDOR) in a web application during the development phase?

Accepted Answer

Using non-enumerable, cryptographically strong identifiers (e.g., UUIDs). Preventing IDOR requires both server-side authorization checks and the use of indirect/randomized identifiers rather than sequential, predictable keys.

Answer

Client-side input validation

Answer

Disabling logging of access attempts

Answer

Using sequential database IDs in URLs

Question 8

Your organization uses a 'Warm Site' for its disaster recovery strategy. During a recent audit, you find that the site lacks the necessary bandwidth to support peak production traffic. What is the most appropriate management response?

Accepted Answer

Update the DRP to include a 'throttling' policy for non-critical services during failover.. A warm site must be periodically validated against current production loads to ensure the SLA can be met.

Answer

Cancel the warm site contract and build a cold site.

Answer

Require all employees to work from home during a disaster to save bandwidth.

Answer

Accept the risk formally via the Risk Register without further mitigation.

Question 9

Which THREE of the following are essential components of a robust Crisis Management Plan?

Accepted Answer

Clearly defined crisis team roles and responsibilities.. Crisis management requires clear authority, defined communication channels, and a pre-identified team with specific roles.

Answer

An inventory of all software licenses held by the organization.

Answer

Granular technical steps for server restoration.

Question 10

An ISSMP is reviewing the Business Continuity Plan (BCP) for a critical application. Which TWO of the following factors should be considered when defining the 'Maximum Tolerable Downtime' (MTD)?

Accepted Answer

Legal and regulatory compliance requirements.. MTD is defined by financial and operational thresholds, often dictated by contractual obligations or total loss of revenue potential.

Answer

Total expected cost of hardware replacement.

Answer

The current availability of spare parts in the data center.

Answer

The number of employees required to perform manual workarounds.

Question 11

Your organization has decided to use a 'Cloud Disaster Recovery' service. The vendor provides a 'Pilot Light' strategy. What does this mean for your organization's recovery capability?

Accepted Answer

Core services are running, and the remaining infrastructure can be scaled up on demand.. A pilot light maintains critical core components (e.g., database) in a running state, while application tiers are spun up on-demand during a disaster.

Answer

A complete replica of the production environment is running 24/7.

Answer

The environment only exists as data snapshots in cold storage.

Answer

The environment is hosted on-premises and fails over to a secondary data center.

Question 12

You are managing third-party risk. Which tool or method is most appropriate for a continuous assessment of a cloud service provider (CSP)?

Accepted Answer

Real-time CSPM monitoring. Cloud security posture management (CSPM) provides continuous monitoring against compliance and risk frameworks.

Answer

Review of the CSP's website

Answer

One-time penetration test

Answer

Annual SOC 2 Type II review

Question 13

An ISSMP is reviewing the 'Change Control' process for a critical system. Which of the following is an essential element for every change request?

Accepted Answer

A detailed backout/rollback plan.. A formal change request must include a 'backout plan' (rollback procedure) to ensure service continuity if the change fails or causes unexpected issues.

Answer

The marketing department's approval.

Answer

A list of all software installed on the server.

Answer

A complete list of developer names.

Question 14

Which document serves as the primary governing authority to define the triggers, escalation paths, and communication roles during a declared crisis event?

Accepted Answer

Crisis Management Plan (CMP). The Crisis Management Plan provides the governance for decision-making during a crisis, whereas the DRP focuses on technical restoration.

Answer

Business Impact Analysis (BIA)

Answer

Standard Operating Procedure (SOP)

Answer

Disaster Recovery Plan (DRP)

Question 15

Following a ransomware attack, the organization must decide whether to invoke the DRP or remain in a degraded state while security teams perform forensics. What is the ISSMP's primary responsibility in this decision-making process?

Accepted Answer

Ensuring the decision is documented to align with the organization's risk appetite.. The ISSMP must facilitate the risk-based decision between recovery speed (DRP) and evidence preservation (Forensics).

Answer

Choosing the restore point from the offsite immutable backup.

Answer

Performing the initial forensic image of the infected servers.

Answer

Directing the IT team to disconnect the network immediately.