ISC Practice Test 2 — 10 Questions

Question 1

During an incident, which document is used by the SOC to record evidence, timestamps, and actions taken to ensure admissibility in a legal proceeding?

Accepted Answer

Chain of Custody. The Chain of Custody document tracks the handling of evidence from discovery through to investigation.

Answer

Runbook

Answer

Lessons Learned Report

Answer

Risk Register

Question 2

A security manager at a U.S. publicly traded healthcare technology company is notified by a forensic firm that an attacker exfiltrated 40,000 patient records and also altered financial reporting data used for quarterly earnings. The security manager must decide how to sequence regulatory notifications under the HIPAA Breach Notification Rule and the SEC's material cybersecurity incident disclosure rules. Which action BEST aligns with the organization's legal and regulatory obligations?

Accepted Answer

Notify the SEC on Form 8-K within four business days of determining the incident is material, and notify affected individuals and HHS within 60 days of discovering the PHI breach.. When an incident implicates both protected health information and material financial data, HIPAA and SEC obligations run concurrently and independently. The HIPAA Breach Notification Rule requires notice to individuals without unreasonable delay and no later than 60 days after discovery, with HHS notification depending on breach size. The SEC requires Form 8-K disclosure within four business days of determining a cybersecurity incident is material. Coordinating legal, privacy, and disclosure counsel ensures neither timeline is missed.

Answer

Notify the SEC within 60 days to align with the HIPAA Breach Notification Rule timeline, consolidating both notifications into a single regulatory filing.

Answer

Notify HHS within 24 hours of discovery and delay all SEC reporting until the forensic investigation is fully complete to avoid inaccurate disclosures.

Answer

Notify affected patients first, then notify the SEC only if the Department of Health and Human Services (HHS) determines the breach is reportable under HIPAA.

Question 3

An organization wants to improve its security posture by adopting a continuous monitoring approach. Which approach is most effective for an ISSMP to champion?

Accepted Answer

Implementing integrated security telemetry and automated analysis.. Continuous monitoring requires integrated data collection, automated analysis, and real-time reporting to provide actionable insights, which is the definition of a robust monitoring strategy.

Answer

Relying on manual logs review on a monthly basis.

Answer

Implementing a firewall with default deny rules.

Answer

Conducting annual penetration tests.

Question 4

A security operations manager is designing a threat intelligence program to improve detection of advanced persistent threats (APTs). The organization wants to prioritize intelligence that is actionable and relevant. Which TWO characteristics of threat intelligence are MOST important for driving effective detection engineering? (Choose two.)

Accepted Answer

Intelligence that is mapped to the MITRE ATT&CK framework and describes adversary tactics, techniques, and procedures (TTPs).. Effective detection engineering benefits most from intelligence that describes adversary TTPs mapped to MITRE ATT&CK, and from intelligence that is timely and machine-readable for automation. TTPs provide durable behavioral context, while timeliness and structured formats ensure the intelligence can be operationalized quickly. IOCs are perishable, free sources may lack relevance, and high volume can be counterproductive.

Answer

Intelligence that includes a high volume of indicators to maximize coverage.

Answer

Intelligence that is free and sourced from open-source communities.

Answer

Intelligence that includes specific indicators of compromise (IOCs) such as file hashes and domain names.

Question 5

A security manager is drafting the organization's acceptable use policy and wants to address the ethical expectation that employees report observed security violations. Which statement best reflects a professionally recognized ethical obligation for information security practitioners?

Accepted Answer

Employees should report suspected violations through designated channels promptly and cooperate with authorized investigations. Recognized professional codes require practitioners to act honorably, protect the organization and public, and report concerns through proper channels. An acceptable use policy should therefore direct employees to report suspected violations promptly and cooperate with authorized investigations. Conditioning reports on personal risk, requiring self-verification, or encouraging direct confrontation all conflict with these ethical expectations and with sound investigative practice.

Answer

Employees should report violations only when doing so cannot harm their own performance ratings or team relationships

Answer

Employees should report violations only after independently confirming that a policy breach actually occurred

Answer

Employees should confront the suspected violator directly and attempt to resolve the matter informally before escalating

Question 6

A global manufacturing company is updating its crisis management plan. The plan must address the unique challenges of a cyber-related crisis, such as a ransomware attack that encrypts critical production systems. Which TWO of the following are the MOST important elements to include in the crisis management plan for this scenario? (Choose two.)

Accepted Answer

A communication strategy that includes pre-approved messages for internal staff, customers, and regulators.. For a ransomware crisis, the most important crisis management elements are a decision matrix for isolation and DR invocation, and a communication strategy with pre-approved messages. These address containment, recovery, and stakeholder communication. Asset inventory, vulnerability scanning, and access lists are important for prevention and recovery but are not core crisis management components.

Answer

A schedule for regular vulnerability scanning of the production network.

Answer

A list of all employees who have access to the production systems.

Answer

A detailed inventory of all hardware assets and their physical locations.

Question 7

When building an Enterprise Risk Management (ERM) program, which THREE factors must be considered to ensure integration with the organization?

Accepted Answer

Integration with existing business processes. ERM is successful when it aligns with the culture, business goals, and organizational structure.

Answer

Replacing all existing staff with security experts

Answer

Purchasing the most expensive security tool available

Question 8

During a system's operations and maintenance phase, the ISSMP learns that a critical vulnerability has been disclosed in a widely used library embedded in the application. The vendor confirms a patch is available. Which action should the ISSMP take FIRST?

Accepted Answer

Open a change request, assess the risk and patch impact, and route the change through the organization's change management process for approval and scheduling.. A vendor-supplied patch for a critical vulnerability is a change to the production environment and must be processed through change management, where impact analysis, testing, approval, and rollback planning are performed. Initiating the change request first preserves both security and availability, and the process can be expedited through an emergency change path if the risk warrants faster action. Applying the patch blindly, relying only on a compensating control, or merely logging the finding all fail to remediate the flaw properly.

Answer

Document the vulnerability in the risk register, assign it a residual risk rating, and defer remediation to the next scheduled release cycle.

Answer

Immediately apply the vendor patch directly to the production servers to eliminate the exposure as quickly as possible.

Answer

Add a compensating network control such as a virtual patching rule at the web application firewall and close the finding without patching the library.

Question 9

An organization is replacing its aging identity management system. The ISSMP must ensure that sensitive identity data from the legacy platform is handled securely during migration and that the old platform is properly retired. Which action BEST addresses the data lifecycle risk during this transition?

Accepted Answer

Define and execute a data migration and sanitization plan that classifies legacy identity data, migrates only what is required, and cryptographically erases or destroys the remainder before decommissioning the legacy platform.. Managing identity data across a platform replacement means applying the full data lifecycle: classify and minimize what is migrated, protect it in transit and at rest, and ensure the source data is irrecoverably removed before the legacy system is retired. Cryptographic erasure or physical destruction provides evidence that sensitive identity data cannot be recovered, satisfying privacy and retention requirements. Indefinite backups, ordinary file deletion, and leaving the old platform running all fail to close the lifecycle risk.

Answer

Migrate all legacy identity records to the new platform and delete the legacy database files using the operating system's standard file deletion command.

Answer

Keep the legacy identity platform running in read-only mode indefinitely so that users retain access to historical records while the new system is validated.

Answer

Perform a full backup of the legacy identity database and retain it indefinitely in the new platform's backup infrastructure in case historical records are needed.

Question 10

During a crisis simulation, the incident commander discovers that the crisis management team has no pre-agreed criteria for escalating from the operational incident response team to the executive crisis team. Decisions are being made ad hoc and communication is inconsistent. Which action best addresses this governance gap?

Accepted Answer

Define and document activation thresholds and escalation criteria in the crisis management plan, then validate them through exercises.. The simulation exposed the absence of pre-agreed escalation criteria, which caused ad hoc decisions and inconsistent communication. Documenting activation thresholds tied to impact severity, regulatory exposure, and duration, then rehearsing them, gives the organization a consistent and auditable basis for moving from operational response to executive crisis management. The other choices either remove escalation, over-activate it, or concentrate authority without addressing the missing criteria.

Answer

Assign the legal department sole authority to declare a crisis and convene the executive team.

Answer

Empower the operational incident response team to handle all incidents without executive involvement.

Answer

Require the executive crisis team to be activated for every incident regardless of severity.