ISC Practice Exam 3 — 20 Questions

Question 1

You are performing a qualitative risk assessment. Which factor must be prioritized to ensure the assessment is aligned with the organizational risk appetite?

Accepted Answer

The business impact of asset unavailability. The risk appetite, defined by leadership, dictates the tolerance for deviations from security standards.

Answer

The vendor's recommended patch cycle

Answer

The threat actor's motivation

Answer

The technical complexity of the vulnerability

Question 2

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?

Accepted Answer

Revoke sessions. The 'Revoke sessions' action in the Entra ID user blade forces the user to re-authenticate and clears all current refresh tokens.

Answer

Disable the user account

Answer

Remove assigned licenses

Answer

Reset the password

Question 3

When managing a security incident, what is the primary role of the CISO in a large enterprise?

Accepted Answer

Ensuring communication and strategic coordination. The CISO should focus on strategic decision-making, stakeholder communication, and resource management, leaving the tactical investigation to the incident response team.

Answer

Updating firewall rules manually

Answer

Performing forensic analysis on the compromised server

Answer

Drafting the initial incident response report

Question 4

Which THREE of the following are common indicators that a security program is failing to align with business objectives?

Accepted Answer

Increase in unauthorized technology use (Shadow IT). Lack of executive support, high levels of friction, and shadow IT are all strong indicators of a disconnect between security strategy and business goals.

Answer

Security budget is lower than the IT budget

Answer

The security team is located in the basement

Question 5

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

Accepted Answer

Defining the compliance scope and regulatory requirements. Identification of regulatory requirements (scope) is the foundation of any compliance program.

Answer

Performing a penetration test

Answer

Auditing existing logs

Answer

Deploying security controls

Question 6

In an environment governed by SOX (Sarbanes-Oxley), which feature of AWS IAM must be utilized to maintain strict 'Segregation of Duties' for account administrative tasks?

Accepted Answer

AWS IAM Roles with Service Control Policies (SCPs). IAM Policies with explicit denies or restricted permission sets (like Service Control Policies) enforce segregation of duties in AWS.

Answer

AWS CloudTrail insights

Answer

IAM User Access Keys

Answer

AWS Directory Service

Question 7

Which organizational structure is most effective for a CISO to influence security behavior across geographically dispersed and independent business units?

Accepted Answer

Matrix Management. A matrix management structure allows the CISO to exert influence through both functional and operational lines, ensuring security standards are consistent while respecting business unit autonomy.

Answer

Centralized Command and Control

Answer

Outsourced Security Operations

Answer

Decentralized/Siloed Management

Question 8

Which feature in Okta is essential for meeting compliance requirements regarding 'Identity Assurance' and 'Strong Authentication' mandated by financial regulations?

Accepted Answer

Okta Adaptive MFA. Okta's Adaptive Multi-Factor Authentication (MFA) uses risk-based policies to ensure identity assurance.

Answer

Okta Lifecycle Management

Answer

Okta Single Sign-On (SSO)

Answer

Okta Directory Integration

Question 9

When evaluating a third-party SaaS provider, which activity is most critical for assessing the vendor's security commitment?

Accepted Answer

Reviewing independent audit reports like SOC 2 Type II. Reviewing independent audit reports (such as SOC 2 Type II) provides verified evidence of the vendor's controls, which is more reliable than self-assessments.

Answer

Checking the vendor's marketing materials

Answer

Asking for the vendor's internal password policy

Answer

Verifying the vendor's office location

Question 10

What is the primary purpose of an Incident Response (IR) plan?

Accepted Answer

To provide a structured approach to incident handling. An IR plan provides a structured, predefined approach to handling security incidents to minimize impact and ensure business continuity.

Answer

To identify all vulnerabilities in the network

Answer

To punish employees who cause incidents

Answer

To replace the need for security policies

Question 11

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

Accepted Answer

Pod Security Admission policies. Pod Security Admissions (formerly Pod Security Policies) can explicitly forbid privileged containers to maintain security benchmarks.

Answer

Cluster Autoscaler settings

Answer

Namespace resource quotas

Answer

Kube-proxy configuration

Question 12

When transitioning to an Agile development methodology, which security management approach best supports the 'Shift Left' security strategy?

Accepted Answer

Integrating automated security testing in the CI/CD pipeline. Integrating security activities (like threat modeling) into the design and development phases ensures vulnerabilities are identified and mitigated earlier in the lifecycle.

Answer

Performing security audits only after deployment

Answer

Requiring manual sign-off for every code commit

Answer

Limiting access to the development environment

Question 13

A CISO is managing a security budget with high pressure for cost optimization. Which strategy provides the best balance between security and cost efficiency?

Accepted Answer

Implementing risk-based resource allocation. Risk-based resource allocation allows the security team to prioritize investments on the highest-impact threats, ensuring maximum ROI on security spending.

Answer

Delaying all security projects by 12 months

Answer

Reducing headcount in security operations

Answer

Switching to only open-source security tools

Question 14

When presenting a security budget request to the Board of Directors, which THREE of the following elements should be included to ensure the request is compelling and understood?

Accepted Answer

A comprehensive analysis of the return on investment (ROI) or risk-reduction value.. Board members prioritize risk-based arguments over technical jargon. They need to understand the impact on business outcomes, the current risk level, and the return on investment (or cost of inaction).

Answer

A summary of the latest cybersecurity job market trends.

Answer

Detailed list of every firewall rule and server configuration.

Question 15

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

Accepted Answer

User-accessible consent management portals. Privacy by design requires technical controls, governance, and user rights management.

Answer

Public internet routing policies

Answer

Hardware security module (HSM) deployment

Question 16

Which of the following is a 'Key Risk Indicator' (KRI) for an organization's email security program?

Accepted Answer

Phishing simulation failure rate. A KRI provides an early signal of increasing risk exposure. Phishing click-through rates measure effectiveness and exposure.

Answer

Total number of employees

Answer

Cost of the email license

Answer

Number of emails received

Question 17

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

Accepted Answer

Govern. The 'Govern' function was elevated in CSF 2.0 to encompass enterprise risk management, strategy, and policy.

Answer

Protect

Answer

Respond

Answer

Recover

Answer

Identify

Question 18

When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?

Accepted Answer

Playbook. The XSOAR 'Playbook' engine manages the logic flow and script execution across various integrated products.

Answer

Classifier

Answer

Integration Instance

Answer

Indicator Field

Question 19

Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?

Accepted Answer

Technique. The 'Technique' ID is the core component that describes the 'how' of an adversary's action.

Answer

Tactic

Answer

Platform

Answer

Group

Question 20

Which document establishes the high-level security objectives and the roles/responsibilities of senior management within an organization?

Accepted Answer

Security Charter. The Security Charter or Security Governance Framework outlines the scope, mandate, and leadership roles required to oversee the security program.

Answer

Standard Operating Procedure (SOP)

Answer

Acceptable Use Policy (AUP)

Answer

Incident Response Plan