ISC Practice Test 19 — 15 Questions

Question 1

An organization uses a microservices architecture. How can the ISSMP ensure that inter-service communication is encrypted and that services are authenticated to one another?

Accepted Answer

Using a Service Mesh (e.g., Istio) to enforce mTLS.. A Service Mesh (e.g., Istio) provides a dedicated infrastructure layer that can enforce mutual TLS (mTLS) for all inter-service communication, ensuring encryption and mutual authentication between services. It abstracts security concerns from the application code and provides centralized policy management. This is the most effective way to secure microservices communication at scale.

Answer

Hardcoding API keys into environment variables.

Answer

Installing an antivirus agent on every container.

Answer

Using a standard VPN between all services.

Question 2

Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?

Accepted Answer

Maintain comprehensive audit logs for all financial system changes. SOX focuses on financial reporting integrity, specifically requiring access controls and audit trails.

Answer

Conduct quarterly physical server room inspections

Answer

Encrypt all data at rest using AES-256

Answer

Ensure all employees receive annual ethics training

Question 3

When performing a risk assessment on a new SaaS implementation, which document is most useful for understanding the vendor's risk profile?

Accepted Answer

A SOC 2 Type II report. A SOC 2 Type II report provides an independent auditor's assessment of the vendor's security controls over time.

Answer

The vendor's sales brochure

Answer

The vendor's stock ticker symbol

Answer

The vendor's customer list

Question 4

An ISSMP is reviewing an organizational risk register. Which field is essential for effective risk prioritization?

Accepted Answer

Inherent risk rating. The inherent risk rating is essential for effective risk prioritization because it represents the level of risk before any controls are applied, allowing the organization to compare risks on a consistent scale and decide which ones require treatment first. Without an inherent risk rating, the risk register cannot meaningfully rank risks by severity or likelihood.

Answer

Name of the auditor

Answer

Asset owner's email address

Answer

Last modified date

Question 5

You are implementing a disaster recovery strategy for a database that uses synchronous replication. What is the most significant trade-off you must accept by enforcing this configuration?

Accepted Answer

Increased latency for write operations.. Synchronous replication guarantees zero data loss (RPO=0) but introduces latency overhead on write operations because the commit must wait for the acknowledgment from the secondary site.

Answer

Higher risk of data corruption.

Answer

Increased probability of backup failure.

Answer

Limited scalability of the database cluster.

Question 6

When evaluating the effectiveness of a risk mitigation strategy, which stakeholder is most critical to involve in the sign-off process?

Accepted Answer

The Business Process Owner. The Business Process Owner (C) is the stakeholder who owns the business process and its risk, has authority to accept residual risk, and can confirm that the mitigation aligns with business objectives. Risk sign-off must come from the risk owner — the person accountable for the process — not from technical or support functions.

Answer

The IT helpdesk manager

Answer

The external auditor

Answer

The HR department

Question 7

Which TWO of the following are primary risks associated with an 'asynchronous' data replication strategy?

Accepted Answer

The RPO will always be greater than zero.. Option C is correct because asynchronous replication acknowledges writes at the primary site before they are committed at the remote site, so any failure between the write and its replication leaves a gap in the replicated data, meaning the recovery point objective (RPO) is inherently greater than zero. Option D is correct because, since the secondary copy lags behind the primary, a failover can expose data divergence or loss of the most recent transactions that were never transmitted or applied. Option A is not a primary risk of asynchronous replication specifically, since bandwidth consumption depends on change rate and scheduling rather than the asynchronous model itself, and replication is typically throttled or batched. Option B is incorrect because incompatible storage protocols are an interoperability/misconfiguration concern, not an inherent risk of asynchronous replication. Option E is incorrect because asynchronous replication is designed to avoid adding latency to the primary application's write path, unlike synchronous replication.

Answer

Excessive consumption of bandwidth during peak hours.

Answer

Total system failure due to incompatible storage protocols.

Answer

Increased network latency on the primary application.

Question 8

What is the primary objective of a 'Security Gate' in an SDLC?

Accepted Answer

To ensure security activities were completed before moving to the next phase.. Security gates are checkpoints placed at the end of SDLC phases to verify that security requirements have been satisfied before proceeding to the next stage.

Answer

To automate the removal of legacy hardware.

Answer

To stop all software development until the budget is approved.

Answer

To provide a location for developers to submit their resignation.

Question 9

Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?

Accepted Answer

Commitment that the processor only processes data on documented instructions. GDPR Article 28 lists mandatory items for DPAs, including security obligations and rights of the data subject.

Answer

Marketing agreements for joint promotions

Answer

The price list for cloud services

Question 10

The board of directors requests a quantitative risk assessment for a new cloud-based initiative. Which metric provides the best representation of potential financial exposure to the organization for a single, significant security event?

Accepted Answer

Single Loss Expectancy (SLE). Single Loss Expectancy (SLE) is the monetary loss expected from a single security incident, making it the most direct metric for board-level financial exposure discussions.

Answer

Residual Risk

Answer

Annualized Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)

Question 11

When designing a security program, which TWO of the following factors should be considered to ensure the program can successfully scale with organizational growth?

Accepted Answer

Designing security controls that are modular and can be easily integrated.. Scalability depends on automating processes where possible and ensuring the security architecture is modular and flexible to adapt to new business units or technologies.

Answer

Limiting the organization to only one type of operating system.

Answer

Requiring all security configurations to be manually audited daily.

Answer

Maintaining all security data in a single, local spreadsheet.

Question 12

Which THREE of the following represent the primary responsibilities of executive leadership in fostering a strong organizational security culture?

Accepted Answer

Holding business units accountable for security outcomes. Executive leadership is responsible for setting the tone, providing resources, and ensuring accountability, which directly shapes the security culture of the organization.

Answer

Writing technical documentation for network architecture

Answer

Installing software patches on all end-user workstations

Question 13

Which document serves as the primary governing authority to define the triggers, escalation paths, and communication roles during a declared crisis event?

Accepted Answer

Crisis Management Plan (CMP). The Crisis Management Plan provides the governance for decision-making during a crisis, whereas the DRP focuses on technical restoration.

Answer

Business Impact Analysis (BIA)

Answer

Standard Operating Procedure (SOP)

Answer

Disaster Recovery Plan (DRP)

Question 14

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

Accepted Answer

Pod Security Admission policies. Pod Security Admissions (formerly Pod Security Policies) can explicitly forbid privileged containers to maintain security benchmarks.

Answer

Cluster Autoscaler settings

Answer

Namespace resource quotas

Answer

Kube-proxy configuration

Question 15

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

Accepted Answer

Govern. The 'Govern' function was elevated in CSF 2.0 to encompass enterprise risk management, strategy, and policy.

Answer

Protect

Answer

Respond

Answer

Recover

Answer

Identify