ISC Practice Exam 2 — 20 Questions

Question 1

Which TWO factors must a security officer consider when performing a 'Privacy Impact Assessment' (PIA) for a new cloud application?

Accepted Answer

The potential impact on data subjects if a breach occurs. PIAs must account for the nature of the data and the risks to the data subjects.

Answer

The cost of the cloud storage subscription

Answer

The number of CPU cores required

Answer

The uptime SLA of the provider

Question 2

A CISO is presenting a security program roadmap. Which approach is best for managing expectations regarding security maturity?

Accepted Answer

Defining security maturity as a set of phased milestones. Providing a phased implementation plan with measurable milestones allows the CISO to demonstrate progress while acknowledging that maturity is a journey.

Answer

Linking maturity to the total security budget

Answer

Promising 100% security coverage by the end of the year

Answer

Focusing only on the latest security technologies

Question 3

What is the primary objective of a 'lessons learned' meeting conducted after a disaster recovery exercise?

Accepted Answer

Identify gaps in the plan and define remediation actions.. The objective is to identify gaps in the plan based on the exercise results and assign ownership for remediation.

Answer

Update the organizational chart.

Answer

Verify the status of the offsite backup tapes.

Answer

Evaluate the performance of the IT staff for disciplinary purposes.

Question 4

Which THREE of the following strategies should be included in a 'Disaster Recovery Program Oversight' function to ensure long-term viability?

Accepted Answer

Annual validation of the BIA to ensure it reflects current business priorities.. Oversight involves continuous validation through testing, alignment with changing business goals, and periodic audits of the documentation.

Answer

Mandating the use of specific hardware vendors for all offices.

Answer

Standardization of server naming conventions across all data centers.

Question 5

Your organization uses a 'Hot Site' with hardware-level replication. During a disaster, the primary site becomes unavailable, but the failover fails due to a 'Split-Brain' scenario. What is the fundamental cause of this?

Accepted Answer

Loss of the heartbeat connection/quorum service.. Split-brain happens when both sites think they are the primary due to loss of the quorum or heartbeat mechanism.

Answer

Mismatched firmware versions between servers.

Answer

Inadequate storage capacity for incoming logs.

Answer

Insufficient cooling at the hot site.

Question 6

Which TWO of the following are primary risks associated with an 'asynchronous' data replication strategy?

Accepted Answer

The RPO will always be greater than zero.. Asynchronous replication introduces a lag, meaning if the primary fails, the latest data might not have reached the secondary, risking data loss.

Answer

Excessive consumption of bandwidth during peak hours.

Answer

Total system failure due to incompatible storage protocols.

Answer

Increased network latency on the primary application.

Question 7

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

Accepted Answer

A formal documented non-retaliation policy. Whistleblower protection requires anonymity and a non-retaliation policy.

Answer

Automatic termination for all suspected security policy violations

Answer

Mandatory disclosure of employee salaries

Answer

Public posting of all employee disciplinary files

Question 8

To ensure security requirements are integrated into the System Development Life Cycle (SDLC), what is the most effective approach for the security team?

Accepted Answer

Embedding security champions within development teams. Embed security champions within development teams to act as liaisons, ensuring security is considered throughout the development process rather than treated as a final check.

Answer

Requiring developers to attend annual security seminars

Answer

Automating the code deployment process

Answer

Mandating a security review before production release

Question 9

When managing a global security team, what is the primary challenge in maintaining a uniform security posture?

Accepted Answer

Cultural differences and local regulations. Cultural differences and local regulatory requirements make it difficult to enforce a single, global standard, requiring a balance between global directives and local adaptation.

Answer

Lack of global email systems

Answer

Time zone differences

Answer

Language barriers

Question 10

A security manager is conducting a third-party risk assessment using the NIST Cybersecurity Framework. Which tool in the AWS Artifact portal is most appropriate for obtaining the necessary SOC 2 Type II reports to fulfill compliance auditing requirements?

Accepted Answer

AWS Artifact Reports. AWS Artifact provides on-demand access to AWS compliance reports, including SOC 2 Type II, for auditing purposes.

Answer

AWS Trusted Advisor

Answer

AWS Config rules

Answer

AWS Security Hub

Question 11

Which of the following is a key component of a successful security awareness training program?

Accepted Answer

Regular, engaging, and relevant content. Regular, relevant, and engaging content is necessary to keep security top-of-mind for employees and to ensure long-term retention of good security practices.

Answer

Focusing only on threats to external users

Answer

Using outdated training videos to save costs

Answer

Mandating attendance once every five years

Question 12

Which TWO of the following are metrics that provide insight into the effectiveness of security leadership?

Accepted Answer

Trend in risk reduction over time. Leadership effectiveness is best measured by the organization's ability to minimize risk over time and the efficiency with which resources are converted into security posture improvements.

Answer

Number of firewall blocks per second

Answer

The color of the security team's uniforms

Answer

The number of security certifications held by the CISO

Question 13

As an ISSMP, you are defining the organizational security culture. Which activity is the most effective way to demonstrate executive commitment to security?

Accepted Answer

Actively chairing the cross-functional Security Steering Committee. The tone at the top is the most significant factor in shaping security culture. Direct executive participation in security steering committees signals that security is a business priority.

Answer

Sending an automated email newsletter regarding password policies

Answer

Appointing a dedicated Security Awareness Officer

Answer

Increasing the budget for the security operations center

Question 14

When establishing a security governance framework, what is the most critical element for ensuring long-term program success?

Accepted Answer

Securing ongoing executive sponsorship and clear accountability.. Executive sponsorship and clear accountability are the pillars of effective governance; without them, policies and frameworks lack the authority and resources needed for implementation.

Answer

Ensuring the framework is fully automated.

Answer

Outsourcing security oversight to a third-party audit firm.

Answer

Selecting the most robust technical security tools available.

Question 15

You are implementing a disaster recovery strategy for a database that uses synchronous replication. What is the most significant trade-off you must accept by enforcing this configuration?

Accepted Answer

Increased latency for write operations.. Synchronous replication guarantees zero data loss (RPO=0) but introduces latency overhead on write operations because the commit must wait for the acknowledgment from the secondary site.

Answer

Higher risk of data corruption.

Answer

Increased probability of backup failure.

Answer

Limited scalability of the database cluster.

Question 16

During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?

Accepted Answer

Interviews with business process owners.. The BIA requires both understanding of the process importance and the technical dependencies (what systems are actually used).

Answer

Current data center power consumption logs.

Answer

The organization's current IT procurement strategy.

Answer

Employee performance review records.

Question 17

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

Accepted Answer

Vertex AI Explainable AI (XAI). Vertex AI Explainable AI provides insights into how models make predictions, satisfying transparency requirements.

Answer

Vertex AI Model Monitoring

Answer

Vertex AI Feature Store

Answer

Vertex AI Pipelines

Question 18

An organization is expanding into a new region. What is the most important first step for the ISSMP?

Accepted Answer

Conducting a regulatory and legal gap analysis. Conducting a regulatory and legal gap analysis ensures that the organization understands the compliance requirements of the new jurisdiction before initiating operations.

Answer

Updating the corporate security policy

Answer

Deploying security monitoring tools

Answer

Hiring a local security manager

Question 19

An ISSMP is evaluating a Cloud Access Security Broker (CASB) implementation. Which management goal is most effectively addressed by this tool?

Accepted Answer

Enforcing security policies for cloud application usage. A CASB provides visibility and control over cloud usage, enabling the enforcement of corporate security policies on data stored or accessed in cloud applications.

Answer

Automating the patching of local workstations

Answer

Managing user access to local databases

Answer

Securing the physical data center

Question 20

A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?

Accepted Answer

Require Multi-Factor Authentication. Requiring MFA and device compliance is the core component of explicit verification in Zero Trust.

Answer

Require Password Change

Answer

Enable Identity Protection alerts

Answer

Disable legacy authentication