ISC Practice Exam 2 — 20 Questions

Question 1

An ISSMP is establishing the security requirements baseline for a system that must comply with a regulatory framework. The framework is updated annually and the system will operate for at least five years. Which approach BEST ensures the system remains compliant across its full lifecycle?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establish a process to monitor regulatory changes, perform periodic control assessments against the current framework version, and feed identified gaps into the change management process.. A system that must remain compliant for years needs a continuous compliance capability: watch for regulatory changes, reassess controls against the current framework, and remediate gaps through change management. This ensures the security baseline tracks both the evolving framework and the system's changing risk profile. One-time certification, over-engineering, and delegating the watch function to an external auditor all leave the organization unable to demonstrate ongoing compliance.

Answer

Delegate ongoing compliance responsibility to the external auditor who performs the annual assessment, relying on the auditor to notify the organization of any new requirements.

Answer

Certify the system against the framework version in effect at go-live and document that certification as the basis for compliance for the system's lifetime.

Answer

Build the system to the strictest interpretation of every control in the framework so that future updates cannot introduce a compliance gap.

Question 2

You are the ISSMP at a global logistics company. The board has adopted a risk appetite statement that tolerates moderate operational risk but demands very low tolerance for safety and regulatory compliance failures. A business unit proposes bypassing a mandatory security control to accelerate a new routing platform launch. Which action best reflects the ISSMP's responsibility in enforcing the board's risk appetite?

Accepted Answer

Evaluate the control's purpose against the risk appetite, document residual risk, and require a time-bound remediation plan with executive acceptance if the bypass proceeds.. The ISSMP enforces risk appetite by evaluating whether a proposed exception breaches the board's tolerances, documenting the residual risk, and requiring accountable executive acceptance with a remediation timeline. This balances business speed with governance. Outright approval or denial, or deferring to audit, fails to apply the board's stated risk criteria to the decision.

Answer

Approve the bypass because the risk appetite allows moderate operational risk and the launch is time-sensitive.

Answer

Deny the bypass outright and instruct the business unit to delay the launch until full compliance is achieved.

Answer

Refer the decision to the internal audit function and take no further action until audit issues a finding.

Question 3

A healthcare insurer is preparing for a regulatory examination and must demonstrate to examiners that its security program is driven by documented leadership commitment rather than by the security team alone. The CISO reports to the CIO, and security topics rarely reach the board. Which action should the ISSMP recommend to best satisfy the examiners' expectation of visible executive ownership?

Accepted Answer

Establish a board-level risk committee that receives security risk reporting, approves risk appetite, and documents its oversight decisions in formal minutes.. Regulators and examiners distinguish between a well-run security function and a governed one. The decisive evidence is leadership setting risk appetite, receiving risk information, and being accountable for decisions, all documented. A board-level risk committee with formal reporting, risk-appetite approval, and minuted decisions provides that evidence directly. Operational improvements, awareness training, and framework mappings are useful, but each remains an artifact of the security team and does not show that executives own and direct the program.

Answer

Increase the frequency of vulnerability scans and include the results in the monthly security operations report sent to the CIO.

Answer

Require all executives to complete the same annual security awareness training that is assigned to general staff.

Answer

Adopt an industry-recognized security framework and map existing controls to it so the program can be presented as mature and comprehensive.

Question 4

Which TWO of the following are common challenges in quantitative risk analysis?

Accepted Answer

High complexity and resource intensity of modeling. Quantitative risk analysis suffers from lack of reliable data and the complexity of modeling.

Answer

It is not allowed by regulatory standards

Answer

The models are too simple to understand

Answer

Quantitative data is always free

Question 5

Which THREE of the following are key indicators of a mature security governance program?

Accepted Answer

The board receives regular, meaningful updates on security posture. Mature programs are characterized by metrics-driven processes, integration with enterprise functions, and active, informed oversight by the board.

Answer

The security team works in total isolation from the rest of the company

Answer

The CISO reports to the Help Desk manager

Question 6

You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?

Accepted Answer

Single Loss Expectancy. The Single Loss Expectancy (SLE) is the monetary value of a single loss event.

Answer

Security Loss Estimate

Answer

System Level Exposure

Answer

Serious Loss Evaluation

Question 7

An organization must comply with CCPA/CPRA requirements regarding 'Right to Delete'. In a hybrid environment utilizing Google Cloud Platform, which mechanism is best suited for implementing automated lifecycle policies to satisfy deletion requests across Cloud Storage buckets?

Accepted Answer

Cloud Storage Lifecycle Management rules. Cloud Storage Lifecycle Management rules are the native GCP mechanism for automating object deletion based on conditions such as age, creation date, or storage class. They operate at the bucket level and can be configured to automatically delete objects after a defined retention period, directly satisfying CCPA/CPRA 'Right to Delete' obligations without manual intervention. This makes them the correct fit for automated lifecycle-based deletion across Cloud Storage buckets.

Answer

Cloud IAM condition policies

Answer

VPC Service Controls

Answer

Data Loss Prevention (DLP) API scan-only mode

Question 8

Which TWO of the following are core components of a business-aligned security strategy?

Accepted Answer

Prioritization of security investments based on business impact. Alignment requires understanding the business's current state and risk profile, and ensuring that security projects are prioritized to support the most important business functions.

Answer

A requirement for all employees to have PhDs

Answer

A complete list of every software vulnerability in the firm

Answer

A mandate that all security tools must be from one vendor

Question 9

A CISO is managing a security budget with high pressure for cost optimization. Which strategy provides the best balance between security and cost efficiency?

Accepted Answer

Implementing risk-based resource allocation. Risk-based resource allocation allows the security team to prioritize investments on the highest-impact threats, ensuring maximum ROI on security spending.

Answer

Delaying all security projects by 12 months

Answer

Reducing headcount in security operations

Answer

Switching to only open-source security tools

Question 10

To ensure security requirements are integrated into the System Development Life Cycle (SDLC), what is the most effective approach for the security team?

Accepted Answer

Embedding security champions within development teams. Embed security champions within development teams to act as liaisons, ensuring security is considered throughout the development process rather than treated as a final check.

Answer

Requiring developers to attend annual security seminars

Answer

Automating the code deployment process

Answer

Mandating a security review before production release

Question 11

Which organizational structure is most effective for a CISO to influence security behavior across geographically dispersed and independent business units?

Accepted Answer

Matrix Management. A matrix management structure allows the CISO to exert influence through both functional and operational lines, ensuring security standards are consistent while respecting business unit autonomy.

Answer

Centralized Command and Control

Answer

Outsourced Security Operations

Answer

Decentralized/Siloed Management

Question 12

During the maintenance phase, a production database needs a schema change. The ISSMP requires that this change be tested in a staging environment that mirrors production. Which process best demonstrates compliance with the 'Separation of Duties' principle?

Accepted Answer

Requiring a separate release team to deploy changes approved by a Change Advisory Board (CAB).. Separation of Duties (SoD) requires that no single individual controls all phases of a critical transaction — the person who writes or approves a change should not be the same person who deploys it. Option D satisfies this by splitting responsibilities: the CAB approves the change, and a separate release team executes the deployment, ensuring independent verification and accountability. This creates a documented, auditable chain of custody that demonstrates compliance with ISSMP governance expectations.

Answer

The ISSMP personally reviewing every SQL script.

Answer

Allowing the automated CI/CD tool to deploy without human review.

Answer

Having the DBA perform the deployment in staging and production.

Question 13

Which THREE factors must be considered during the 'Compliance Program Management' phase when evaluating whether to adopt a new cloud-based tool?

Accepted Answer

The availability of audit logs for compliance verification. Option B is correct because audit logs provide the evidentiary trail needed to verify that the cloud tool meets regulatory requirements and to support audits, so their availability is a core compliance consideration. Option C is correct because data residency determines where data is stored and processed, which directly affects adherence to laws such as GDPR or other jurisdictional privacy mandates. Option D is correct because the tool must align with the organization's existing security and privacy policies to avoid introducing control gaps or policy violations. Option A is not relevant because marketing budget does not affect regulatory compliance or control effectiveness. Option E is not relevant because a vendor's social media following has no bearing on compliance, security, or privacy obligations.

Answer

The tool's marketing budget

Answer

The number of social media followers of the vendor

Question 14

Your organization uses a 'Hot Site' with hardware-level replication. During a disaster, the primary site becomes unavailable, but the failover fails due to a 'Split-Brain' scenario. What is the fundamental cause of this?

Accepted Answer

Loss of the heartbeat connection/quorum service.. Split-brain happens when both sites think they are the primary due to loss of the quorum or heartbeat mechanism.

Answer

Mismatched firmware versions between servers.

Answer

Inadequate storage capacity for incoming logs.

Answer

Insufficient cooling at the hot site.

Question 15

Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?

Accepted Answer

Containment, Eradication, and Recovery. Recovery includes restoring systems to normal operation and confirming they are secure.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Preparation

Question 16

Which THREE factors are required to calculate the 'Risk' of a vulnerability for reporting purposes?

Accepted Answer

Asset Criticality. Risk is typically calculated as Likelihood x Impact, where Likelihood is influenced by Threat and Vulnerability, and Impact is determined by Asset Criticality.

Answer

Number of employees in the SOC

Answer

The cost of the security appliance

Question 17

Which phase of the SDLC is most appropriate for conducting a formal Threat Modeling exercise?

Accepted Answer

Design phase. Threat modeling is most effective during the design phase because it allows security architects to identify potential threats and design mitigations before code is written or systems are deployed. Conducting it early avoids costly rework and ensures security controls are built into the architecture. The design phase is where data flows, trust boundaries, and components are defined, which are the inputs threat modeling requires.

Answer

Release phase

Answer

Operations and Maintenance

Answer

Initiation phase

Question 18

Which document is primarily responsible for documenting the security controls applicable to a system during the SDLC's requirements phase?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the formal document that describes the system boundary, the security controls implemented or planned, and how those controls meet the applicable security requirements. It is developed during the requirements phase of the SDLC and evolves through the lifecycle, making it the primary artifact for documenting applicable security controls.

Answer

Acceptable Use Policy (AUP)

Answer

Service Level Agreement (SLA)

Answer

Business Impact Analysis (BIA)

Question 19

When drafting an organizational 'Acceptable Use Policy' (AUP), which element is most critical to ensure legal enforceability in a professional environment?

Accepted Answer

Mandatory user acknowledgment signature. A mandatory user acknowledgment signature is critical for legal enforceability because it provides documented proof that the user has read, understood, and agreed to the AUP. Without such evidence, enforcing the policy in disciplinary or legal actions becomes difficult.

Answer

Inclusion of the entire ISO 27001 standard

Answer

A list of blocked websites

Answer

Detailed technical specifications of the firewall

Question 20

An organization is migrating to a hybrid cloud environment and is updating its security architecture. Which of the following is the MOST effective way to ensure consistent security policy enforcement across both on-premises and cloud environments?

Accepted Answer

Implementing a unified security policy framework across all environments.. Implementing a unified security policy framework ensures that security requirements are standardized and consistently applied regardless of the underlying infrastructure. This approach reduces complexity and human error in policy management.

Answer

Managing separate security policies for on-premises and cloud environments.

Answer

Prioritizing the security of on-premises assets over cloud assets.

Answer

Allowing individual departments to define their own security policies.