ISC Practice Test 15 — 15 Questions

Question 1

A regional utility has completed its business impact analysis and is now selecting recovery strategies for its supervisory control and data acquisition environment. The BIA shows that loss of grid monitoring beyond 30 minutes creates public safety risk. Which recovery strategy characteristic is most important when selecting the target environment for this system?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The strategy must provide geographically separated, continuously synchronized operational capability.. When a BIA identifies a maximum tolerable downtime of 30 minutes for a public safety function, the recovery strategy must deliver near-continuous, geographically separate capability. Only a continuously synchronized environment in a distinct location satisfies both the time constraint and the need to survive a regional event. Cost, offline archives, and co-location are all secondary or contradictory considerations once the recovery objective is this stringent.

Answer

The strategy must minimize recurring licensing and hardware refresh costs across the recovery environment.

Answer

The strategy must use the same physical facility as the primary control center to simplify operations.

Answer

The strategy must rely on offline tape archives stored in a third-party vault for data protection.

Question 2

A security manager discovers that a business unit deployed a customer analytics platform that transfers personal data from the EU to a US-based processor without a valid transfer mechanism. Executive leadership wants to continue the processing. Which action best aligns with GDPR Chapter V obligations?

Accepted Answer

Execute the current Standard Contractual Clauses with the processor and complete a transfer impact assessment. Legitimizing an ongoing EU-to-US transfer after Schrems II generally requires a valid Chapter V tool plus an assessment of third-country surveillance law and any supplementary measures. The updated Standard Contractual Clauses, combined with a documented transfer impact assessment, satisfy that expectation while allowing processing to continue. Consent derogations suit occasional transfers, Binding Corporate Rules cover approved intra-group flows, and invalidated frameworks provide no basis at all.

Answer

Obtain explicit consent from every affected data subject for the transfer to the United States

Answer

Rely on the processor's Privacy Shield certification listed in its public trust center

Answer

Rely on the processor's Binding Corporate Rules previously approved for intra-group transfers

Question 3

A security manager is building a compliance monitoring capability for a multinational retailer that accepts payment cards and operates in the EU. The legal team wants assurance that the program can demonstrate ongoing adherence to both PCI DSS 4.0 and GDPR. Which approach BEST provides continuous, auditable evidence of compliance across both regimes?

Accepted Answer

Map controls to a unified control framework, automate evidence collection from systems of record, and continuously monitor control effectiveness with alerts routed to control owners.. Continuous compliance across PCI DSS 4.0 and GDPR is best achieved by mapping requirements to a unified control set, automating evidence capture from authoritative systems, and monitoring control health with clear ownership. This produces timely, auditable artifacts that satisfy GDPR accountability and PCI DSS 4.0's expectation of ongoing security processes. Annual assessments and single-tool evidence sources leave gaps between cycles and across requirement domains.

Answer

Deploy a data loss prevention (DLP) tool across the enterprise and treat its alerts as the primary compliance evidence for both PCI DSS and GDPR obligations.

Answer

Rely on the Qualified Security Assessor (QSA) annual Report on Compliance (ROC) as the primary evidence for both PCI DSS and GDPR, since the ROC covers data protection controls.

Answer

Perform an annual internal audit against PCI DSS and a separate annual GDPR gap assessment, storing the reports in the governance, risk, and compliance (GRC) system.

Question 4

A financial services firm uses a risk matrix with likelihood and impact scales. During a risk assessment, the team identifies a new vulnerability in a core banking application. The likelihood is rated as 'Possible' (3 on a 1-5 scale) and the impact as 'Major' (4 on a 1-5 scale). The organization's risk appetite statement says that risks with a score of 12 or higher require immediate treatment. What is the risk score and what action should be taken?

Accepted Answer

Risk score = 12; immediate treatment required.. The correct answer is the product of likelihood and impact, which is 12. Since the risk appetite threshold is 12 or higher, immediate treatment is required. Risk matrices typically multiply the two factors to produce a risk score that reflects both probability and consequence. Using addition or ignoring one factor would misrepresent the risk and could result in inappropriate risk responses.

Answer

Risk score = 4; immediate treatment required.

Answer

Risk score = 12; monitor but no immediate treatment.

Answer

Risk score = 7; no immediate action required.

Question 5

A security manager is establishing a formal incident response capability and wants to ensure that lessons learned from major incidents are captured and used to improve future response. Which activity should be conducted after a significant incident to meet this goal?

Accepted Answer

A post-incident review (lessons learned) meeting. Conducting a post-incident review after significant incidents is the recognized practice for capturing lessons learned. It examines response actions, identifies gaps in plans and coordination, and produces recommendations that update the incident response plan, training, and tooling, thereby improving future response.

Answer

A vulnerability scan of the affected environment

Answer

A business impact analysis (BIA)

Answer

A penetration test of the production network

Question 6

You are the ISSMP at a healthcare provider preparing for a HIPAA security rule assessment. The CIO asks you to identify which activities are the responsibility of the security management process standard under administrative safeguards. (Choose two.)

Accepted Answer

Implementing security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.. The HIPAA security management process standard under administrative safeguards requires a risk analysis and risk management, along with a sanction policy and periodic evaluation. The risk analysis identifies exposures to ePHI, and risk management applies proportionate safeguards. Encryption, unique user identification, and emergency access procedures fall under other safeguard standards and specifications.

Answer

Implementing a mechanism to encrypt ePHI whenever deemed appropriate.

Answer

Assigning a unique name or number for identifying and tracking user identity.

Answer

Implementing procedures to authorize emergency access to ePHI during an emergency.

Question 7

A hospital's emergency department depends on a clinical documentation system. The BIA shows the department can function on paper forms for up to four hours, after which patient safety risk becomes unacceptable. The DR plan states the system will be restored within six hours. What should the contingency manager do FIRST?

Accepted Answer

Escalate the gap between the six-hour restoration target and the four-hour business tolerance to management for a risk decision.. A BIA-derived tolerance of four hours conflicts with a documented six-hour restoration capability, so the contingency manager must escalate the gap for a formal risk decision. Accepting the plan, altering the clinical tolerance, or falsifying the documented target all avoid accountability and could place patients at risk. Escalation ensures management chooses to accept, mitigate, or transfer the residual risk.

Answer

Extend the paper-form workaround to six hours so the documented tolerance matches the DR plan.

Answer

Accept the plan because the system can be restored within a single business day.

Answer

Update the DR plan to state a four-hour restoration time without changing the technical recovery capability.

Question 8

During a post-implementation review of a new enterprise resource planning (ERP) system, the ISSMP discovers that the project team did not perform a security risk assessment during the design phase. The system is now in production and handles sensitive financial data. What should the ISSMP do FIRST?

Accepted Answer

Initiate a full security risk assessment of the production ERP system and document the findings.. The first step is to perform a security risk assessment of the production ERP system. This will identify vulnerabilities, threats, and potential impacts, enabling the ISSMP to prioritize remediation and advise on risk treatment. Halting operations, assigning blame, or waiting for an audit do not address the immediate need to understand and manage the risk to sensitive financial data.

Answer

Report the oversight to the project manager's supervisor and request disciplinary action.

Answer

Immediately halt all ERP operations until a risk assessment can be completed.

Answer

Wait until the next scheduled audit to raise the issue and include it in the audit findings.

Question 9

A security manager is building a compliance monitoring capability for a regulated environment. Which TWO activities are essential to demonstrate that controls remain effective between formal audits? (Choose two.)

Accepted Answer

Tracking remediation of identified control deficiencies to closure with owners and due dates.. Effective compliance monitoring rests on two operational pillars: continuously gathering evidence that controls are operating as designed, and managing any deficiencies found until they are verifiably closed. Evidence collection detects drift and entitlement creep, while remediation tracking proves the organization acts on what it finds. Together they provide the between-audit assurance that regulators and certification bodies expect from a mature compliance program.

Answer

Scheduling the next external audit earlier than the regulatory deadline requires.

Answer

Publishing an annual compliance report on the corporate intranet for all employees to read.

Answer

Requiring all employees to complete annual security awareness training.

Question 10

When transitioning to an Agile development methodology, which security management approach best supports the 'Shift Left' security strategy?

Accepted Answer

Integrating automated security testing in the CI/CD pipeline. Integrating security activities (like threat modeling) into the design and development phases ensures vulnerabilities are identified and mitigated earlier in the lifecycle.

Answer

Performing security audits only after deployment

Answer

Requiring manual sign-off for every code commit

Answer

Limiting access to the development environment

Question 11

Which of the following is an example of a detective control in a risk management program?

Accepted Answer

Security Information and Event Management (SIEM) alerts. Detective controls, like logs or monitoring, identify that a risk event has occurred.

Answer

Encryption

Answer

Firewall rules

Answer

Disaster recovery plan

Question 12

In Splunk Enterprise Security, which dashboard should the SOC manager review to evaluate the effectiveness of the current correlation searches and the volume of notable events?

Accepted Answer

Content Management Dashboard. The Content Management dashboard provides insights into the performance, trigger volume, and status of correlation searches.

Answer

Threat Intelligence Dashboard

Answer

Asset Center

Answer

Incident Review Dashboard

Question 13

Which TWO techniques are effective for securing the software supply chain?

Accepted Answer

Automated dependency vulnerability scanning. Supply chain security is best achieved by signing artifacts to prevent tampering and using vulnerability scanners to detect known issues in third-party dependencies.

Answer

Restricting internet access to all developers

Answer

Avoiding all code reviews

Answer

Using only software written in-house

Question 14

Which TWO items must be documented in a Change Control Log after a successful production change?

Accepted Answer

The timestamp of the change. A change log must include the final outcome (status) and the timestamp to ensure traceability and audit accuracy.

Answer

The developer's personal home address

Answer

The names of all employees who saw the change code

Answer

The total budget of the organization

Question 15

Which THREE of the following are common indicators that a security program is failing to align with business objectives?

Accepted Answer

Increase in unauthorized technology use (Shadow IT). Lack of executive support, high levels of friction, and shadow IT are all strong indicators of a disconnect between security strategy and business goals.

Answer

Security budget is lower than the IT budget

Answer

The security team is located in the basement