ISC Practice Test 21 — 15 Questions

Question 1

An information security manager discovers that a penetration tester, hired under a signed contract with a defined scope and rules of engagement, accessed a production database containing customer records that were explicitly excluded from the scope. The tester claims the access was accidental during a pivot. The organization is now deciding whether to pursue legal action. Which legal principle is most relevant in determining the tester's liability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The tester may be liable under computer misuse laws because access exceeded the defined scope, regardless of intent.. The tester's actions exceeded the contractual scope, which defines the boundaries of authorized access. Computer misuse laws typically penalize access that exceeds authorization, and intent is not always a required element for liability. The organization should assess the specific statute and the tester's conduct, but the unauthorized access to excluded systems is the key factor in determining potential liability.

Answer

The tester is immune from liability because the organization granted initial access to the network, making all subsequent access impliedly authorized.

Answer

The tester is protected by the 'authorized access' defense because a contract existed, even if the specific system was out of scope.

Answer

The tester's liability is determined solely by whether the organization suffered actual financial loss from the access.

Question 2

A financial services firm is expanding its risk management program to include cyber risk quantification. The CISO wants to express cyber risk in monetary terms to compare it with other business risks. Which approach best aligns with this objective?

Accepted Answer

Implement a FAIR (Factor Analysis of Information Risk) methodology to model loss event frequency and loss magnitude.. Quantitative risk analysis methods like FAIR are specifically designed to express risk in monetary terms by modeling loss event frequency and loss magnitude. This allows the CISO to compare cyber risk with other business risks and make informed investment decisions. Qualitative approaches and frameworks like NIST CSF or BIA do not provide the monetary quantification needed for this objective.

Answer

Conduct a business impact analysis (BIA) to determine recovery time objectives for critical systems.

Answer

Adopt a qualitative risk assessment using a 5x5 likelihood and impact matrix to prioritize risks.

Answer

Use the NIST Cybersecurity Framework to categorize risks and map them to controls.

Question 3

An ISSMP is reviewing the organization's business continuity plan (BCP). The plan defines recovery time objectives (RTOs) and recovery point objectives (RPOs) for critical business processes. The internal audit team has asked for evidence that the BCP will actually work during a disruption. Which action provides the MOST reliable evidence that the BCP is effective?

Accepted Answer

Perform a full-scale exercise that activates recovery sites and measures actual recovery times against RTO/RPO. A full-scale exercise is the most rigorous test because it activates recovery sites, restores systems, and measures actual performance against RTO and RPO. It exposes technical and procedural gaps that document reviews, interviews, and tabletops cannot. For audit evidence, actual measured recovery times provide objective proof that the BCP can meet its objectives during a real disruption.

Answer

Review the BCP document for completeness and sign-off by all department heads

Answer

Interview key personnel to confirm they understand their roles during a disruption

Answer

Conduct a tabletop exercise with senior management and document the discussion

Question 4

A security manager at a mid-sized financial firm discovers that a privileged database administrator account was used at 02:00 UTC to export 40 GB of customer records to an external IP address. The account was not locked out, no alert fired, and the export completed over 47 minutes. Which action should the manager take FIRST to align with the ISC2 ISSMP incident management lifecycle?

Accepted Answer

Trigger the containment phase by disabling the account and blocking the destination IP at the perimeter firewall.. The incident management lifecycle requires that once a compromise is confirmed, containment precedes eradication, recovery, and lessons learned. Disabling the privileged account and blocking the destination endpoint halts active data loss while preserving evidence. Reimaging, reviewing lessons learned, or notifying regulators before containment would allow the exfiltration to continue and could destroy forensic artifacts needed for scoping.

Answer

Notify the board and external regulators immediately before taking any technical action.

Answer

Initiate the lessons-learned review to determine why no SIEM alert fired for the large export.

Answer

Begin the eradication phase by reimaging the database server and resetting all domain credentials.

Question 5

You are the ISSMP for a regional hospital network. The CIO wants assurance that the emergency department's clinical information system can be recovered within its maximum tolerable downtime (MTD) of 30 minutes. The system runs on a three-tier architecture with a relational database. Which recovery strategy BEST satisfies the MTD requirement?

Accepted Answer

Active-active database cluster across two data centers with synchronous replication and automated failover. The hospital's 30-minute MTD demands a solution with near-zero recovery time and minimal data loss. An active-active cluster with synchronous replication and automated failover provides continuous availability and rapid recovery, meeting the MTD. Warm, cold, and reciprocal strategies involve manual steps and longer recovery times that would exceed the MTD and risk patient safety.

Answer

Cold site with tape backups stored offsite and a documented restoration procedure

Answer

Warm site with nightly database backups and 4-hour hardware delivery SLA

Answer

Reciprocal agreement with a neighboring hospital to use their systems during a disaster

Question 6

An ISSMP is developing a contingency plan for a critical e-commerce platform. The organization wants to ensure that the plan addresses both business process recovery and technology recovery. Which TWO of the following components are essential to include in the contingency plan? (Choose two.)

Accepted Answer

Disaster recovery plan (DRP) procedures for restoring technology infrastructure and applications. A complete contingency plan integrates business and technology recovery. The BIA identifies critical processes and their recovery requirements, while the DRP details how to restore the technology that supports those processes. Together, they ensure that recovery efforts are prioritized and executed effectively. Network diagrams, marketing plans, and hardware budgets are supporting artifacts but are not essential components of the contingency plan itself.

Answer

Marketing plan for communicating with customers after a disaster

Answer

Annual budget for IT hardware refresh

Answer

Detailed network diagrams of the primary data center only

Question 7

A multinational corporation is integrating its risk management program with its enterprise risk management (ERM) framework. The ISSMP is tasked with ensuring that risk appetite and tolerance are effectively communicated and applied across all business units. Which TWO actions are most critical to achieve this integration? (Choose two.)

Accepted Answer

Establish a risk governance structure with clear roles and responsibilities for risk management across the organization.. Integrating risk appetite and tolerance into ERM requires clear, board-approved statements that align with strategy, and a governance structure that assigns accountability for applying them. These two actions provide the direction and oversight needed for consistent risk-taking. Training, centralized registers, and scorecards are supportive but do not by themselves ensure integration.

Answer

Integrate risk indicators into business unit performance scorecards to monitor adherence to risk appetite.

Answer

Conduct regular risk awareness training for all employees to ensure they understand the risk management process.

Answer

Implement a centralized risk register that captures all risks from every business unit in a single repository.

Question 8

A global financial services firm has experienced three major security incidents in the past year, each traced to a different business unit ignoring security policies during rapid project delivery. The CISO wants to embed security accountability into the performance management system rather than relying on after-the-fact audits. Which approach is MOST effective for achieving this goal?

Accepted Answer

Integrate specific security objectives and metrics into each business unit manager's performance scorecard and compensation structure.. The most effective way to embed security accountability is to make it part of how managers are evaluated and rewarded. Integrating security objectives into performance scorecards and compensation aligns business unit incentives with security outcomes, directly addressing why units ignored policies. Attestations, monitoring tools, and audits are supporting controls, but they do not change the performance management system that drives behavior.

Answer

Deploy an automated policy compliance monitoring tool that flags deviations and sends weekly reports to the security operations center.

Answer

Require all business unit managers to sign an annual security attestation form acknowledging they have read the security policy.

Answer

Increase the frequency of internal security audits from annually to quarterly and publish findings to the audit committee.

Question 9

A healthcare organization is building a Security Operations Center and must define how it will measure and govern detection and response performance. The CISO asks the security manager to select metrics that directly reflect the SOC's ability to detect and respond to threats. Which TWO metrics best meet this requirement? (Choose two.)

Accepted Answer

Mean time to detect (MTTD) security incidents. Mean time to detect and mean time to respond directly quantify the SOC's detection and response capabilities. MTTD exposes how quickly monitoring and correlation identify malicious activity, while MTTR shows how efficiently the team contains and resolves confirmed incidents. Training counts, attestation rates, and firewall review counts measure program activity or compliance rather than operational SOC performance.

Answer

Percentage of employees who completed annual security policy attestation

Answer

Number of security awareness training sessions delivered per quarter

Answer

Total number of firewall rules reviewed during the quarter

Question 10

An ISSMP is leading the development of a new security governance framework for a multinational manufacturing company. The framework must ensure that security decisions are made at the right level and that the program remains aligned with business strategy over time. Which TWO of the following are essential components of this governance framework? (Choose two.)

Accepted Answer

A documented process for periodically reviewing and updating security policies to reflect changes in the threat landscape and business operations.. Essential governance components include a cross-functional steering committee to set direction and a process for keeping policies current. The steering committee ensures decisions are made at the right level with business input, while policy review maintains alignment over time. Operational elements like SOCs, technical standards, and training are important but are executed within the governance framework, not part of its core structure.

Answer

A centralized security operations center (SOC) that monitors all network traffic and responds to incidents 24/7.

Answer

A mandatory annual security awareness training program for all employees.

Answer

A comprehensive set of technical security standards specifying approved encryption algorithms and firewall configurations.

Question 11

A security manager is drafting the business continuity plan for a payment processing platform. The CIO asks which element establishes the maximum tolerable time that the payment service can be unavailable before the organization suffers unacceptable financial and regulatory harm. Which concept should the manager document?

Accepted Answer

Maximum tolerable downtime (MTD). Maximum tolerable downtime defines the longest a business process can be unavailable before the impact becomes unacceptable. The recovery time objective is then set within that limit, and the recovery point objective governs acceptable data loss. An SLA uptime figure is contractual, and RTO and RPO are subordinate targets, so MTD is the concept that answers the CIO's question.

Answer

Service level agreement (SLA) uptime percentage

Answer

Recovery point objective (RPO)

Answer

Recovery time objective (RTO)

Question 12

An organization is initiating a project to develop a new mobile banking application. The ISSMP is tasked with ensuring that security requirements are identified and integrated from the very beginning of the systems development life cycle (SDLC). Which action should the ISSMP take FIRST to achieve this?

Accepted Answer

Conduct a threat modeling workshop with the development team and key stakeholders during the requirements phase.. Threat modeling during the requirements phase is the most effective first step because it systematically identifies threats and informs the security requirements that must be built into the mobile banking app. This proactive approach ensures that security is considered from the outset, reducing the risk of vulnerabilities and costly redesigns later in the SDLC.

Answer

Create a security awareness training program for all developers before any coding begins.

Answer

Develop a comprehensive security test plan to be executed during the testing phase.

Answer

Perform a penetration test on the application's prototype after the design phase is complete.

Question 13

A security manager is developing an incident response plan that must comply with legal and regulatory requirements for evidence handling. The organization operates in a jurisdiction that follows common law and may need to present digital evidence in court. Which two principles must the manager ensure are followed to maintain the admissibility of digital evidence? (Choose two.)

Accepted Answer

Maintain a strict chain of custody documenting every person who handled the evidence and when.. To be admissible, digital evidence must be authentic, reliable, and complete. A strict chain of custody and preservation of the original state with thorough documentation are the two core principles that establish these qualities. They demonstrate that the evidence has not been altered and can be trusted in legal proceedings. Other factors like encryption or tool choice do not directly affect admissibility.

Answer

Obtain a warrant before collecting any digital evidence, even for internal investigations.

Answer

Use only open-source forensic tools to ensure transparency and reproducibility of results.

Answer

Ensure that all evidence is stored in an encrypted format to prevent unauthorized access.

Question 14

An ISSMP is defining the disposal requirements for a new system that will process regulated financial data. The system uses a combination of on-premises servers with self-encrypting drives, cloud object storage, and encrypted backup tapes. Which action best ensures that data remanence is addressed across ALL media during the disposal phase?

Accepted Answer

Implement a cryptographic erasure process by destroying the keys for self-encrypting drives and cloud storage, and sanitize backup tapes according to NIST SP 800-88 guidelines.. Cryptographic erasure is the most effective method for self-encrypting drives and cloud storage because it destroys the keys, making data unrecoverable without the need for physical destruction. For backup tapes, following NIST SP 800-88 ensures proper sanitization. This combined approach addresses all media types in the scenario, ensuring regulatory compliance and preventing data remanence across the entire system.

Answer

Overwrite all storage with a single pass of random data and then delete the cloud storage buckets.

Answer

Degauss all magnetic media and shred all optical media before disposal.

Answer

Delete all data using the native tools of each platform and obtain a certificate of destruction from the cloud provider.

Question 15

A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The ISSMP must ensure that the assessment adequately addresses regulatory requirements. Which of the following should be the PRIMARY focus of the risk assessment?

Accepted Answer

Identifying and evaluating threats and vulnerabilities that could lead to unauthorized disclosure of PHI.. For a telehealth platform storing PHI, the risk assessment must prioritize identifying threats and vulnerabilities that could lead to unauthorized access or disclosure, as required by regulations like HIPAA. Financial, usability, and scalability considerations are secondary and do not directly address the protection of PHI. Thus, the primary focus should be on safeguarding the confidentiality, integrity, and availability of PHI.

Answer

Assessing the scalability of the platform to handle peak patient loads during flu season.

Answer

Evaluating the user interface design to ensure it is intuitive for patients and providers.

Answer

Determining the total cost of ownership for the telehealth platform over the next five years.