ISC Practice Exam 1 — 20 Questions

Question 1

An ISSMP is revising the BCP to account for 'Supply Chain Resiliency'. Which approach is best for verifying that critical third-party vendors can meet the organization's recovery requirements?

Accepted Answer

Reviewing vendor-provided Disaster Recovery test reports and performance metrics.. Contractual RTO/RPO requirements must be validated via audit or simulation results.

Answer

Sending a self-assessment questionnaire to the vendor.

Answer

Performing an independent penetration test on the vendor's network.

Answer

Requiring vendors to sign an updated Service Level Agreement.

Question 2

During a BCP planning session, the executive team is debating the 'Maximum Tolerable Downtime' (MTD) for a legacy internal application. What is the correct way to define this metric?

Accepted Answer

The total duration of time that an organization can tolerate a business process being unavailable.. MTD is the total time a process can be down before the organization suffers catastrophic/irreversible harm.

Answer

The maximum acceptable age of data in the event of a system crash.

Answer

The time taken to fail over to the secondary site during a disaster.

Answer

The time required to restore the application from the latest tape backup.

Question 3

When classifying business processes for BCP, what is the 'Recovery Time Objective' (RTO) most effectively used for?

Accepted Answer

Determining the technology and infrastructure requirements for restoration.. RTO informs the investment and technology choices for the recovery strategy to ensure service restoration occurs within the business-defined window.

Answer

Identifying the critical staff needed for recovery.

Answer

Assessing the data loss tolerance.

Answer

Calculating the financial impact of the event.

Question 4

Which TWO of the following are effective ways to improve 'Crisis Management Leadership' effectiveness during an incident?

Accepted Answer

Ensuring a dedicated communications officer manages stakeholder messaging.. Leadership requires clear delegation and effective, structured communication to prevent panic and ensure well-informed decisions.

Answer

Removing all documentation to force teams to think creatively.

Answer

Ignoring external media requests to focus only on technical repair.

Answer

Requiring all employees to attend weekly disaster drills.

Question 5

Which TWO aspects of the NIST Cybersecurity Framework (CSF) are most relevant when establishing a 'Compliance Program Management' function?

Accepted Answer

Identify (ID) function. The CSF provides structure; 'Govern' and 'Identify' are the pillars for compliance management.

Answer

Recover (RC) function

Answer

Detect (DE) function

Answer

Protect (PR) function

Question 6

A security manager is drafting a security policy. Which element is essential for ensuring executive support and establishing the policy's organizational authority?

Accepted Answer

Executive sponsorship and signature. An executive signature or sponsorship is required to demonstrate that the policy has the backing of the organization's leadership and is not just a departmental suggestion.

Answer

A list of vendors

Answer

A list of all employees

Answer

Detailed technical configuration standards

Question 7

Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?

Accepted Answer

Maintain comprehensive audit logs for all financial system changes. SOX focuses on financial reporting integrity, specifically requiring access controls and audit trails.

Answer

Conduct quarterly physical server room inspections

Answer

Encrypt all data at rest using AES-256

Answer

Ensure all employees receive annual ethics training

Question 8

When conducting a compliance audit, what is the purpose of a 'Gap Analysis'?

Accepted Answer

To identify the delta between current state and compliance requirements. A gap analysis identifies the difference between current controls and the required regulatory standard.

Answer

To rewrite the security policy

Answer

To perform a vulnerability scan

Answer

To punish departments for non-compliance

Question 9

What is the primary objective of a Business Impact Analysis (BIA)?

Accepted Answer

To determine the impact of disruptions on business operations. The BIA identifies critical business processes and the impact of their disruption, which informs the BCP/DR plan.

Answer

To calculate the cost of a data breach

Answer

To identify all system vulnerabilities

Answer

To configure firewalls for recovery

Question 10

In Okta, to restrict administrative access to a specific geographic region during an active session, which policy should be modified?

Accepted Answer

Global Session Policy. The 'Global Session Policy' or specific 'Authentication Policy' rules control access based on location-based conditions.

Answer

Password Policy

Answer

MFA Enrollment Policy

Answer

Group Rule

Question 11

When reporting to the board of directors, which presentation method is most effective for communicating security performance?

Accepted Answer

Dashboards correlating security metrics to business objectives. Using dashboards with KPIs that correlate security activity to business objectives (e.g., risk reduction, compliance status) provides the context necessary for informed board decision-making.

Answer

A list of all blocked malicious IP addresses

Answer

Detailed technical logs and packet captures

Answer

A full copy of the latest penetration test report

Question 12

In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?

Accepted Answer

Vulnerability Priority Rating (VPR). The Vulnerability Priority Rating (VPR) incorporates threat intelligence and exploit code availability, making it more accurate for risk-based prioritization than CVSS alone.

Answer

Plugin Family

Answer

Asset Criticality Rating

Answer

CVSS Base Score

Question 13

When managing cross-functional security projects, which stakeholder communication strategy is most effective for securing project resources?

Accepted Answer

Aligning security project outcomes with business goals. Linking security initiatives to business outcomes, such as reduced downtime or faster time-to-market, ensures that non-technical stakeholders understand the necessity of resource allocation.

Answer

Focusing strictly on threat lists and vulnerability counts

Answer

Escalating all requests to the CEO

Answer

Using technical jargon to emphasize the severity of risks

Question 14

Which THREE of the following are important considerations for an ISSMP when outsourcing security functions?

Accepted Answer

Retaining the ultimate accountability for security. Outsourcing requires careful legal review, performance monitoring (SLAs), and ensuring that the provider is properly integrated into the organization's overall risk management.

Answer

Requiring the vendor to use only your internal tools

Answer

Choosing the vendor with the lowest price

Question 15

A CISO is aligning the organizational information security strategy with the NIST Cybersecurity Framework (CSF) 2.0. Which specific function should the CISO prioritize to ensure that the organizational security culture promotes the identification of risks before they impact business operations?

Accepted Answer

Govern. The 'Govern' function in NIST CSF 2.0 is specifically designed to establish the organizational context, risk management strategy, and cybersecurity supply chain risk management, which are foundational for aligning security culture with business objectives.

Answer

Identify

Answer

Protect

Answer

Recover

Question 16

An organization is conducting a risk assessment and identifies a critical vulnerability in a legacy system that cannot be patched. Which of the following is the most appropriate risk management strategy to address this vulnerability?

Accepted Answer

Implement compensatory controls to reduce the risk.. When patching is not possible, implementing compensatory controls (such as network segmentation or enhanced monitoring) is the standard approach to reduce the residual risk to an acceptable level.

Answer

Transfer the risk to a third-party vendor without further assessment.

Answer

Decommission the system immediately regardless of business impact.

Answer

Accept the risk without implementing any additional controls.

Question 17

When designing the Crisis Communication Plan, why is it essential to establish pre-approved communication templates?

Accepted Answer

To ensure consistent and rapid messaging during high-stress situations.. During a crisis, speed and accuracy are critical. Templates reduce cognitive load and prevent errors in messaging.

Answer

To allow marketing teams to create brand-focused content.

Answer

To bypass legal review during the crisis.

Answer

To fulfill regulatory requirements for daily status reports.

Question 18

When designing a Disaster Recovery Program, which THREE of the following represent common 'single points of failure' that must be addressed?

Accepted Answer

Key-person dependency for initiating the disaster declaration.. Resilience requires removing dependencies on single, irreplaceable entities (people, physical locations, or specific gateway devices).

Answer

Use of standardized enterprise resource planning software.

Answer

The use of automated server patching tools.

Question 19

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

Accepted Answer

Microsoft Purview DLP policies. Data Loss Prevention (DLP) policies in Microsoft 365 can be configured to detect PHI patterns and block or encrypt emails accordingly.

Answer

Exchange Online Protection (EOP) malware filtering

Answer

Microsoft Defender for Endpoint

Answer

Retention labels in the Compliance Center

Question 20

Which principle of 'Ethics in Security Leadership' dictates that a manager should prioritize the safety and privacy of the user over organizational convenience?

Accepted Answer

Duty of care / Stewardship. The principle of stewardship and duty of care requires leaders to act in the best interest of the data subject.

Answer

Transparency

Answer

Principle of least privilege

Answer

Separation of duties