ISC Practice Test 17 — 15 Questions

Question 1

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Accepted Answer

Known Command and Control (C2) IP address. Option B is correct because a known Command and Control (C2) IP address is a classic network-based IOC: it is an observable artifact (an IP address) that indicates communication with attacker infrastructure, and it can be used in SIEM rules, firewalls, or IDS/IPS signatures to detect or block malicious traffic. Option C is correct because a malicious file hash (e.g., SHA-256) is a host/file-based IOC: the cryptographic hash uniquely identifies a known malicious file and can be searched for across endpoints, sandboxes, and threat-intelligence feeds to detect the same malware without needing to inspect the file contents. The other options are not IOC types: A (employee performance review) and D (company fiscal year budget) are internal business/HR documents with no security-observable artifact value, and E (new printer firmware update) is a legitimate maintenance activity rather than an indicator of compromise, though a malicious firmware update could theoretically be an attack vector, the option as written describes a normal update, not an IOC.

Answer

Employee performance review

Answer

Company fiscal year budget

Answer

New printer firmware update

Question 2

Which THREE technical controls are effective for limiting the impact of lateral movement?

Accepted Answer

Network micro-segmentation. Network micro-segmentation (C) is correct because it divides the network into granular zones with strict east-west firewall/ACL policies, so a compromised host cannot freely reach other internal systems, directly containing lateral movement. Removing local administrative privileges (D) is correct because it enforces least privilege, preventing attackers from using stolen credentials to perform pass-the-hash, remote service creation, or admin-share access (e.g., C$, ADMIN$) on other hosts. Enforced MFA (E) is correct because it blocks lateral movement that relies on compromised passwords or NTLM hashes for interactive/RDP/remote logons, since a second factor is required and stolen credentials alone are insufficient. Increasing external bandwidth (A) is unrelated to containment—it only affects throughput for external traffic and does nothing to stop internal pivoting. Public domain name registration (B) is an administrative/branding function with no bearing on restricting attacker movement inside the environment.

Answer

Increasing external bandwidth

Answer

Public domain name registration

Question 3

Which TWO metrics are essential for evaluating the performance of a SOC team in identifying and containing threats?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) (A) is essential because it measures the average elapsed time between a threat's occurrence and its detection by the SOC, directly quantifying the team's monitoring, alerting, and triage effectiveness. Mean Time to Contain (MTTC) (C) is equally essential because it measures how long it takes to isolate or stop a detected threat from spreading, reflecting the SOC's response and containment capability. Together, MTTD and MTTC are standard SOC KPIs that cover both the identification and containment phases named in the question. Total server downtime during updates (B) is an availability/patch-management metric, not a threat detection or containment measure. Number of coffee breaks taken (D) is irrelevant to security operations performance. Total number of users on the network (E) is an environmental sizing statistic, not a SOC performance metric.

Answer

Total server downtime during updates

Answer

Number of coffee breaks taken

Answer

Total number of users on the network

Question 4

Which TWO actions are part of the 'Risk Monitoring' process?

Accepted Answer

Tracking Key Risk Indicators (KRIs). Risk Monitoring is the ongoing process of tracking identified risks, watching for new risks, and evaluating how well risk responses are working, so option A (tracking Key Risk Indicators, or KRIs) is correct because KRIs are the defined metrics used to provide early warning that risk exposure is changing and to trigger escalation when thresholds are breached. Option C (reviewing effectiveness of existing controls) is also correct because Risk Monitoring includes assessing whether the controls and risk responses already in place continue to reduce risk to an acceptable level, which may lead to re-planning or corrective action. The remaining options do not belong: hiring administrative assistants (B) and developing new software from scratch (D) are operational or project-execution activities unrelated to monitoring risk, and changing the company name (E) is a branding decision with no bearing on tracking risks or evaluating controls.

Answer

Hiring new administrative assistants

Answer

Developing new software from scratch

Answer

Changing the company name

Question 5

When designing a Disaster Recovery Program, which THREE of the following represent common 'single points of failure' that must be addressed?

Accepted Answer

Key-person dependency for initiating the disaster declaration.. Option A is correct because key-person dependency for initiating the disaster declaration is a classic single point of failure: if only one individual knows the criteria, has the authority, or can reach the call tree, the disaster declaration is delayed or never made, so DR plans require alternate declarers, documented thresholds, and out-of-band contact methods. Option B is correct because dependence on a single, non-redundant telecommunications provider for data replication means a carrier outage, fiber cut, or provider failure halts replication entirely, leaving the recovery site with stale data; mitigation requires diverse carriers, diverse physical paths, and replication monitoring. Option C is correct because reliance on a single physical location for primary and backup storage defeats geographic separation, so one fire, flood, or power event destroys both copies; backups must be stored at an alternate site or in a separate region/cloud with independent power and network. Option D is not a single point of failure: standardized ERP software is a common, supportable platform and does not by itself create an unrecoverable dependency, though it may need HA configuration. Option E is not a single point of failure either: automated patching tools are operational management software, and their failure delays patching rather than causing a disaster or preventing recovery.

Answer

Use of standardized enterprise resource planning software.

Answer

The use of automated server patching tools.

Question 6

A security manager is drafting a security policy. Which element is essential for ensuring executive support and establishing the policy's organizational authority?

Accepted Answer

Executive sponsorship and signature. An executive signature or sponsorship is required to demonstrate that the policy has the backing of the organization's leadership and is not just a departmental suggestion.

Answer

A list of vendors

Answer

A list of all employees

Answer

Detailed technical configuration standards

Question 7

An organization is deploying a globally distributed application. The ISSMP needs to ensure that code changes are signed to prevent tampering. Which process should be implemented in the build pipeline?

Accepted Answer

Implementing artifact signing in the CI/CD pipeline.. Code signing (e.g., using Sigstore or GPG) ensures the integrity of artifacts from build to deployment, ensuring that only signed/authorized code reaches production.

Answer

Encrypting the entire source repository.

Answer

Using HTTPS for all internal traffic.

Answer

Running the build on a dedicated hardened server.

Question 8

Which THREE criteria are essential for establishing a successful 'Risk Committee'?

Accepted Answer

Representation from multiple business units. A successful committee needs diverse perspectives, executive support, and a defined mandate.

Answer

Limiting membership to only IT security staff

Answer

Conducting meetings at midnight for secrecy

Question 9

Which document establishes the high-level security objectives and the roles/responsibilities of senior management within an organization?

Accepted Answer

Security Charter. The Security Charter or Security Governance Framework outlines the scope, mandate, and leadership roles required to oversee the security program.

Answer

Standard Operating Procedure (SOP)

Answer

Acceptable Use Policy (AUP)

Answer

Incident Response Plan

Question 10

Which THREE of the following are critical for successfully managing cross-functional security initiatives?

Accepted Answer

Demonstrating clear alignment with business benefits. Success in cross-functional work requires stakeholder involvement, clear communication of the business value, and shared ownership of the outcomes.

Answer

Focusing solely on the technical specifications

Answer

Excluding IT management from the planning phase

Question 11

In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?

Accepted Answer

Vulnerability Priority Rating (VPR). The Vulnerability Priority Rating (VPR) incorporates threat intelligence and exploit code availability, making it more accurate for risk-based prioritization than CVSS alone.

Answer

Plugin Family

Answer

Asset Criticality Rating

Answer

CVSS Base Score

Question 12

Which document describes the specific steps an analyst should take when a 'Phishing' alert is triggered in the SIEM?

Accepted Answer

Playbook. A Playbook or Runbook provides step-by-step guidance for specific, repeatable incident types.

Answer

System Architecture Diagram

Answer

Service Level Agreement

Answer

Incident Response Plan

Question 13

Which TWO of the following are effective communication strategies for a CISO interacting with senior executives?

Accepted Answer

Focusing on the business impact of security risks. Executives need concise, business-focused information that allows them to make informed decisions about risk and resource allocation.

Answer

Providing hour-long technical deep dives on every vulnerability

Answer

Using complex, obscure security acronyms

Answer

Writing 50-page reports for every meeting

Question 14

During a waterfall-to-Agile transition, the development team wants to bypass formal Security Requirements Traceability Matrix (SRTM) documentation in favor of user stories. How should the ISSMP reconcile this?

Accepted Answer

Require all security requirements to be embedded into the definition of done (DoD) and documented as security user stories.. The ISSMP should reconcile Agile adoption with security governance by embedding security requirements into the Definition of Done and expressing them as security user stories (A). This preserves traceability and accountability without forcing waterfall artifacts, aligning with frameworks like NIST SSDF and OWASP SAMM that support Agile-native security requirements.

Answer

Mandate that the project manager create a manual SRTM separately from the development tasks.

Answer

Deny the transition until full waterfall documentation is restored.

Answer

Allow the team to omit security requirements to speed up deployment.

Question 15

An ISSMP needs to ensure compliance with global data privacy regulations in a multinational environment. Which governance strategy provides the most consistent approach?

Accepted Answer

Adopting the strictest regulatory standard as the global baseline. Implementing a global privacy framework that defaults to the strictest common denominator ensures compliance across all jurisdictions, simplifying operational management.

Answer

Excluding high-risk regions from business operations

Answer

Maintaining separate policies for every country

Answer

Relying on legal counsel to interpret local laws for every access request