ISC Practice Test 18 — 15 Questions

Question 1

When executive leadership discusses 'Acceptable Risk', they are referring to:

Accepted Answer

Residual risk within the risk appetite. Acceptable risk is the remaining risk after controls are applied that remains within the organizational risk tolerance.

Answer

Inherent risk before controls

Answer

Zero risk tolerance

Answer

The total budget for security

Question 2

What is the primary difference between a 'Risk Assessment' and a 'Vulnerability Assessment'?

Accepted Answer

Risk assessment considers business context and impact. A vulnerability assessment finds technical flaws; a risk assessment determines the business impact and likelihood of those flaws being exploited.

Answer

There is no difference

Answer

Risk assessment is only for physical assets

Answer

Vulnerability assessment is only for executive level

Question 3

A US-based company is processing data of German citizens. To comply with the Schrems II ruling, which contractual mechanism must they document in their vendor risk management registry?

Accepted Answer

Data Processing Addendum (DPA) with SCCs. Standard Contractual Clauses (SCCs) are the primary legal mechanism required for the transfer of data from the EEA to third countries post-Schrems II.

Answer

An annual security audit report

Answer

A signed Non-Disclosure Agreement (NDA)

Answer

A simple Certificate of Origin

Question 4

Which THREE actions should be taken when performing an incident post-mortem according to industry best practices?

Accepted Answer

Review the effectiveness of the response timeline. Post-mortems focus on identifying root causes, improving processes, and ensuring documentation is captured.

Answer

Discipline the analyst who missed the alert

Answer

Delete all evidence to save storage space

Question 5

Which TWO of the following are primary components of an effective Incident Response (IR) program?

Accepted Answer

Incident Response Policy. An IR program requires both organizational support (Policy) and operational capability (Personnel/Training).

Answer

Software development lifecycle budget

Answer

Physical security badge access logs

Answer

Marketing strategy document

Question 6

Which of the following is the most effective method for testing the efficacy of a Business Continuity Plan without disrupting production operations?

Accepted Answer

Tabletop exercise.. A tabletop exercise is a discussion-based simulation that tests plan logic and communication without affecting production systems.

Answer

Parallel processing test.

Answer

Cutover test.

Answer

Full-scale simulation.

Question 7

Which TWO of the following are valid responses to a high-risk finding?

Accepted Answer

Purchase insurance (Transference). Risk treatment options are generally to mitigate, transfer, avoid, or accept.

Answer

Ask the auditor to leave

Answer

Delete all enterprise data

Answer

Ignore the finding until the next budget cycle

Question 8

Your organization uses a 'Warm Site' for its disaster recovery strategy. During a recent audit, you find that the site lacks the necessary bandwidth to support peak production traffic. What is the most appropriate management response?

Accepted Answer

Update the DRP to include a 'throttling' policy for non-critical services during failover.. A warm site is a partially equipped recovery facility that requires some configuration and data restoration before it can take over. If the site lacks bandwidth for peak traffic, the pragmatic management response is to update the DRP to define which services get priority bandwidth and which are throttled or deferred during failover. This preserves the warm-site investment, documents the operational constraint, and ensures critical services remain available.

Answer

Cancel the warm site contract and build a cold site.

Answer

Require all employees to work from home during a disaster to save bandwidth.

Answer

Accept the risk formally via the Risk Register without further mitigation.

Question 9

You are auditing a third-party disaster recovery service provider. Which metric provides the most accurate evidence that the provider can meet your organization's required recovery point for a database cluster?

Accepted Answer

Replication Lag monitoring logs showing synchronization latency.. Replication lag directly measures the time delay between a write on the primary database and its application on the replica. Since the recovery point objective (RPO) defines the maximum tolerable data loss measured in time, replication lag is the precise indicator of how much data could be lost in a failover scenario. Monitoring logs provide concrete evidence of actual synchronization latency, making it the most accurate metric for verifying RPO compliance.

Answer

Mean Time to Recovery (MTTR) reports from previous tests.

Answer

Service Level Agreement (SLA) uptime percentages.

Answer

Annual penetration test results.

Question 10

During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?

Accepted Answer

Develop a unified risk assessment framework for the combined entity. Harmonizing methodologies allows for a unified risk view across the enterprise, which is essential for consistent governance.

Answer

Ignore the methodologies and rely on external audits

Answer

Force the smaller entity to adopt the larger one's tool

Answer

Keep both and report separately

Question 11

In the context of the SDLC, what is the primary purpose of a 'Software Bill of Materials' (SBOM)?

Accepted Answer

To identify and manage open-source component risks.. An SBOM provides a comprehensive list of all components, libraries, and modules used in an application, which is crucial for managing supply chain security risks (e.g., identifying vulnerable dependencies).

Answer

To outline the project timeline.

Answer

To track the financial cost of software licenses.

Answer

To document the application architecture.

Question 12

Which THREE pieces of information should be included in an 'Incident Notification' for executive stakeholders?

Accepted Answer

Next steps for mitigation and remediation. Executives need the business impact, the current status, and the next planned actions.

Answer

The raw packet captures of the attack

Answer

The specific login credentials used

Question 13

Which THREE of the following strategies should be included in a 'Disaster Recovery Program Oversight' function to ensure long-term viability?

Accepted Answer

Annual validation of the BIA to ensure it reflects current business priorities.. Oversight involves continuous validation through testing, alignment with changing business goals, and periodic audits of the documentation.

Answer

Mandating the use of specific hardware vendors for all offices.

Answer

Standardization of server naming conventions across all data centers.

Question 14

An ISSMP is conducting a security awareness program. What is the primary metric for measuring the success of this program?

Accepted Answer

Change in behavior evidenced by incident reduction or simulation data. A reduction in actual security incidents or improved response to simulated phishing tests are direct indicators of improved security behavior, which is the program's goal.

Answer

The cost per employee for training

Answer

Number of training slides created

Answer

Percentage of employees who attended sessions

Question 15

When designing the Crisis Communication Plan, why is it essential to establish pre-approved communication templates?

Accepted Answer

To ensure consistent and rapid messaging during high-stress situations.. During a crisis, speed and accuracy are critical. Templates reduce cognitive load and prevent errors in messaging.

Answer

To allow marketing teams to create brand-focused content.

Answer

To bypass legal review during the crisis.

Answer

To fulfill regulatory requirements for daily status reports.