ISC Practice Test 2 — 25 Questions

Question 1

Which TWO of the following are primary risks associated with an 'asynchronous' data replication strategy?

Accepted Answer

The RPO will always be greater than zero.. Asynchronous replication introduces a lag, meaning if the primary fails, the latest data might not have reached the secondary, risking data loss.

Answer

Excessive consumption of bandwidth during peak hours.

Answer

Total system failure due to incompatible storage protocols.

Answer

Increased network latency on the primary application.

Question 2

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

Accepted Answer

A formal documented non-retaliation policy. Whistleblower protection requires anonymity and a non-retaliation policy.

Answer

Automatic termination for all suspected security policy violations

Answer

Mandatory disclosure of employee salaries

Answer

Public posting of all employee disciplinary files

Question 3

To ensure security requirements are integrated into the System Development Life Cycle (SDLC), what is the most effective approach for the security team?

Accepted Answer

Embedding security champions within development teams. Embed security champions within development teams to act as liaisons, ensuring security is considered throughout the development process rather than treated as a final check.

Answer

Requiring developers to attend annual security seminars

Answer

Automating the code deployment process

Answer

Mandating a security review before production release

Question 4

When managing a global security team, what is the primary challenge in maintaining a uniform security posture?

Accepted Answer

Cultural differences and local regulations. Cultural differences and local regulatory requirements make it difficult to enforce a single, global standard, requiring a balance between global directives and local adaptation.

Answer

Lack of global email systems

Answer

Time zone differences

Answer

Language barriers

Question 5

A security manager is conducting a third-party risk assessment using the NIST Cybersecurity Framework. Which tool in the AWS Artifact portal is most appropriate for obtaining the necessary SOC 2 Type II reports to fulfill compliance auditing requirements?

Accepted Answer

AWS Artifact Reports. AWS Artifact provides on-demand access to AWS compliance reports, including SOC 2 Type II, for auditing purposes.

Answer

AWS Trusted Advisor

Answer

AWS Config rules

Answer

AWS Security Hub

Question 6

Which of the following is a key component of a successful security awareness training program?

Accepted Answer

Regular, engaging, and relevant content. Regular, relevant, and engaging content is necessary to keep security top-of-mind for employees and to ensure long-term retention of good security practices.

Answer

Focusing only on threats to external users

Answer

Using outdated training videos to save costs

Answer

Mandating attendance once every five years

Question 7

Which TWO of the following are metrics that provide insight into the effectiveness of security leadership?

Accepted Answer

Trend in risk reduction over time. Leadership effectiveness is best measured by the organization's ability to minimize risk over time and the efficiency with which resources are converted into security posture improvements.

Answer

Number of firewall blocks per second

Answer

The color of the security team's uniforms

Answer

The number of security certifications held by the CISO

Question 8

As an ISSMP, you are defining the organizational security culture. Which activity is the most effective way to demonstrate executive commitment to security?

Accepted Answer

Actively chairing the cross-functional Security Steering Committee. The tone at the top is the most significant factor in shaping security culture. Direct executive participation in security steering committees signals that security is a business priority.

Answer

Sending an automated email newsletter regarding password policies

Answer

Appointing a dedicated Security Awareness Officer

Answer

Increasing the budget for the security operations center

Question 9

When establishing a security governance framework, what is the most critical element for ensuring long-term program success?

Accepted Answer

Securing ongoing executive sponsorship and clear accountability.. Executive sponsorship and clear accountability are the pillars of effective governance; without them, policies and frameworks lack the authority and resources needed for implementation.

Answer

Ensuring the framework is fully automated.

Answer

Outsourcing security oversight to a third-party audit firm.

Answer

Selecting the most robust technical security tools available.

Question 10

You are implementing a disaster recovery strategy for a database that uses synchronous replication. What is the most significant trade-off you must accept by enforcing this configuration?

Accepted Answer

Increased latency for write operations.. Synchronous replication guarantees zero data loss (RPO=0) but introduces latency overhead on write operations because the commit must wait for the acknowledgment from the secondary site.

Answer

Higher risk of data corruption.

Answer

Increased probability of backup failure.

Answer

Limited scalability of the database cluster.

Question 11

During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?

Accepted Answer

Interviews with business process owners.. The BIA requires both understanding of the process importance and the technical dependencies (what systems are actually used).

Answer

Current data center power consumption logs.

Answer

The organization's current IT procurement strategy.

Answer

Employee performance review records.

Question 12

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

Accepted Answer

Vertex AI Explainable AI (XAI). Vertex AI Explainable AI provides insights into how models make predictions, satisfying transparency requirements.

Answer

Vertex AI Model Monitoring

Answer

Vertex AI Feature Store

Answer

Vertex AI Pipelines

Question 13

An organization is expanding into a new region. What is the most important first step for the ISSMP?

Accepted Answer

Conducting a regulatory and legal gap analysis. Conducting a regulatory and legal gap analysis ensures that the organization understands the compliance requirements of the new jurisdiction before initiating operations.

Answer

Updating the corporate security policy

Answer

Deploying security monitoring tools

Answer

Hiring a local security manager

Question 14

An ISSMP is evaluating a Cloud Access Security Broker (CASB) implementation. Which management goal is most effectively addressed by this tool?

Accepted Answer

Enforcing security policies for cloud application usage. A CASB provides visibility and control over cloud usage, enabling the enforcement of corporate security policies on data stored or accessed in cloud applications.

Answer

Automating the patching of local workstations

Answer

Managing user access to local databases

Answer

Securing the physical data center

Question 15

A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?

Accepted Answer

Require Multi-Factor Authentication. Requiring MFA and device compliance is the core component of explicit verification in Zero Trust.

Answer

Require Password Change

Answer

Enable Identity Protection alerts

Answer

Disable legacy authentication

Question 16

You are performing a qualitative risk assessment. Which factor must be prioritized to ensure the assessment is aligned with the organizational risk appetite?

Accepted Answer

The business impact of asset unavailability. The risk appetite, defined by leadership, dictates the tolerance for deviations from security standards.

Answer

The vendor's recommended patch cycle

Answer

The threat actor's motivation

Answer

The technical complexity of the vulnerability

Question 17

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?

Accepted Answer

Revoke sessions. The 'Revoke sessions' action in the Entra ID user blade forces the user to re-authenticate and clears all current refresh tokens.

Answer

Disable the user account

Answer

Remove assigned licenses

Answer

Reset the password

Question 18

When managing a security incident, what is the primary role of the CISO in a large enterprise?

Accepted Answer

Ensuring communication and strategic coordination. The CISO should focus on strategic decision-making, stakeholder communication, and resource management, leaving the tactical investigation to the incident response team.

Answer

Updating firewall rules manually

Answer

Performing forensic analysis on the compromised server

Answer

Drafting the initial incident response report

Question 19

Which THREE of the following are common indicators that a security program is failing to align with business objectives?

Accepted Answer

Increase in unauthorized technology use (Shadow IT). Lack of executive support, high levels of friction, and shadow IT are all strong indicators of a disconnect between security strategy and business goals.

Answer

Security budget is lower than the IT budget

Answer

The security team is located in the basement

Question 20

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

Accepted Answer

Defining the compliance scope and regulatory requirements. Identification of regulatory requirements (scope) is the foundation of any compliance program.

Answer

Performing a penetration test

Answer

Auditing existing logs

Answer

Deploying security controls