ISC Practice Test 3 — 25 Questions

Question 1

When aligning security with organizational goals, how should an ISSMP address a conflict between security controls and user productivity?

Accepted Answer

Conduct a risk-benefit analysis for alternative controls. Conduct a risk-benefit analysis to determine if the security control is truly necessary and if alternative, less intrusive controls exist that provide the same level of protection.

Answer

Remove the security control to favor productivity

Answer

Delegate the decision to the IT support manager

Answer

Enforce the security control regardless of impact

Question 2

Which TWO of the following are critical components of a secure SDLC (Software Development Life Cycle) implementation?

Accepted Answer

Continuous Threat Modeling. Option D (Continuous Threat Modeling) is correct because a secure SDLC requires threat modeling to be an ongoing activity integrated throughout the lifecycle, not a one-time event, so that new attack surfaces and design changes are identified and mitigated as the software evolves. Option E (Automated security testing in the pipeline) is correct because embedding SAST, DAST, SCA, and similar automated checks into CI/CD pipelines enforces security gates on every build, catching vulnerabilities early and consistently rather than relying on sporadic manual review. The unmarked options do not belong: A (Manual annual security reviews) is too infrequent and reactive to be a critical component, B (Standardized desktop operating systems) is an endpoint-hardening control unrelated to the software development process, and C (Outsourcing all security to a vendor) is not a secure SDLC practice since accountability for security cannot be fully delegated and must remain with the developing organization.

Answer

Manual annual security reviews

Answer

Standardized desktop operating systems

Answer

Outsourcing all security to a vendor

Question 3

In a decentralized organization, which approach to BCP management ensures both local agility and global alignment?

Accepted Answer

A federated model with a centralized governance framework.. A federated model allows individual business units to customize plans to their specific needs while adhering to a common global framework/policy.

Answer

Leaving BCP entirely to the discretion of local department managers.

Answer

A strictly centralized command-and-control model.

Answer

Outsourcing the entire BCP function to a single managed service provider.

Question 4

Which of the following is the most important factor to consider when evaluating the effectiveness of a security training and awareness program?

Accepted Answer

Measurable improvements in employee behavior and incident reporting.. Behavioral changes, such as reduced click rates on phishing simulations and increased reporting of suspicious activities, are the best indicators of a successful security awareness program.

Answer

The total budget allocated to security awareness programs.

Answer

The frequency and quality of security awareness training sessions.

Answer

The number of employees who completed the training modules.

Question 5

When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?

Accepted Answer

Playbook. The XSOAR 'Playbook' engine manages the logic flow and script execution across various integrated products.

Answer

Classifier

Answer

Integration Instance

Answer

Indicator Field

Question 6

When managing a FortiGate firewall, which feature allows the SOC to dynamically update network objects based on external threat feeds?

Accepted Answer

External Connectors. External Connectors on a FortiGate firewall enable the SOC to dynamically update network objects (such as IP addresses, FQDNs, or MAC addresses) by pulling threat intelligence from external sources like STIX/TAXII feeds, malware databases, or cloud services. These connectors automatically synchronize with the external feed, ensuring that firewall policies and security profiles always use the latest threat data without manual intervention. This is a core feature of FortiGate's Security Fabric, allowing automated response to emerging threats.

Answer

DHCP Server

Answer

Traffic Shaper

Answer

Virtual Domains (VDOMs)

Question 7

When implementing FIM (File Integrity Monitoring) in Tripwire Enterprise, what is the specific purpose of a 'Promotion' action?

Accepted Answer

To update the baseline with the current file state. In Tripwire Enterprise, a Promotion action takes the current state of a monitored file and updates the baseline (the known-good reference) to match it. This is used after a legitimate change — such as a patch or approved configuration update — so that future changes are detected relative to the new, approved state.

Answer

To revert a file to its previous version

Answer

To deploy the file to all servers

Answer

To archive the file for legal hold

Question 8

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

Accepted Answer

Defining the compliance scope and regulatory requirements. Identification of regulatory requirements (scope) is the foundation of any compliance program.

Answer

Performing a penetration test

Answer

Auditing existing logs

Answer

Deploying security controls

Question 9

An ISSMP is managing a merger where two organizations use different identity providers. Which strategy best mitigates identity-related risk during the integration phase?

Accepted Answer

Implementing a federated identity solution. Establishing a federated identity model allows for centralized management and consistent access control policies across both entities without forcing an immediate migration.

Answer

Granting domain administrative rights to both IT teams

Answer

Migrating all users to a new identity provider immediately

Answer

Creating duplicate user accounts for all employees

Question 10

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

Accepted Answer

Vertex AI Explainable AI (XAI). Vertex AI Explainable AI provides insights into how models make predictions, satisfying transparency requirements.

Answer

Vertex AI Model Monitoring

Answer

Vertex AI Feature Store

Answer

Vertex AI Pipelines

Question 11

Your organization is evaluating the procurement of a new SaaS platform. As the ISSMP, you are responsible for integrating security into the vendor risk management process. Which action is most critical during the 'Due Diligence' phase?

Accepted Answer

Reviewing the vendor's SOC 2 Type II report for documented control effectiveness. During due diligence, the most critical action is to assess the vendor's security posture through independent audits. A SOC 2 Type II report provides detailed evidence of the effectiveness of controls over a period, making it a key artifact for evaluating vendor risk. It covers security, availability, processing integrity, confidentiality, and privacy, aligning with the need to integrate security into vendor management.

Answer

Requesting the vendor's penetration test results from five years ago

Answer

Verifying the vendor's office location and physical building security

Answer

Ensuring the vendor signs a standard non-disclosure agreement

Question 12

A CISO needs to justify an increase in the security budget. Which argument is most persuasive to the Chief Financial Officer (CFO)?

Accepted Answer

Quantifying financial exposure from potential security events. Quantifying the cost of potential data breaches in terms of lost revenue and regulatory fines demonstrates the financial risk the CFO is helping to manage.

Answer

Comparing the budget to industry peers

Answer

Focusing on the technical features of a new tool

Answer

Listing the latest security threats in the industry

Question 13

Which of the following is a key component of a successful security awareness training program?

Accepted Answer

Regular, engaging, and relevant content. Regular, relevant, and engaging content is necessary to keep security top-of-mind for employees and to ensure long-term retention of good security practices.

Answer

Focusing only on threats to external users

Answer

Using outdated training videos to save costs

Answer

Mandating attendance once every five years

Question 14

During a BCP planning session, the executive team is debating the 'Maximum Tolerable Downtime' (MTD) for a legacy internal application. What is the correct way to define this metric?

Accepted Answer

The total duration of time that an organization can tolerate a business process being unavailable.. MTD is the total time a process can be down before the organization suffers catastrophic/irreversible harm.

Answer

The maximum acceptable age of data in the event of a system crash.

Answer

The time taken to fail over to the secondary site during a disaster.

Answer

The time required to restore the application from the latest tape backup.

Question 15

Which TWO of the following are effective ways to improve 'Crisis Management Leadership' effectiveness during an incident?

Accepted Answer

Ensuring a dedicated communications officer manages stakeholder messaging.. Leadership requires clear delegation and effective, structured communication to prevent panic and ensure well-informed decisions.

Answer

Removing all documentation to force teams to think creatively.

Answer

Ignoring external media requests to focus only on technical repair.

Answer

Requiring all employees to attend weekly disaster drills.

Question 16

What is the primary objective of a Business Impact Analysis (BIA)?

Accepted Answer

To determine the impact of disruptions on business operations. The BIA identifies critical business processes and the impact of their disruption, which informs the BCP/DR plan.

Answer

To calculate the cost of a data breach

Answer

To identify all system vulnerabilities

Answer

To configure firewalls for recovery

Question 17

Which THREE of the following are important considerations for an ISSMP when outsourcing security functions?

Accepted Answer

Retaining the ultimate accountability for security. Outsourcing requires careful legal review, performance monitoring (SLAs), and ensuring that the provider is properly integrated into the organization's overall risk management.

Answer

Requiring the vendor to use only your internal tools

Answer

Choosing the vendor with the lowest price

Question 18

A CISO is presenting a security program roadmap. Which approach is best for managing expectations regarding security maturity?

Accepted Answer

Defining security maturity as a set of phased milestones. Providing a phased implementation plan with measurable milestones allows the CISO to demonstrate progress while acknowledging that maturity is a journey.

Answer

Linking maturity to the total security budget

Answer

Promising 100% security coverage by the end of the year

Answer

Focusing only on the latest security technologies

Question 19

What is the primary objective of a 'lessons learned' meeting conducted after a disaster recovery exercise?

Accepted Answer

Identify gaps in the plan and define remediation actions.. The objective is to identify gaps in the plan based on the exercise results and assign ownership for remediation.

Answer

Update the organizational chart.

Answer

Verify the status of the offsite backup tapes.

Answer

Evaluate the performance of the IT staff for disciplinary purposes.

Question 20

During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?

Accepted Answer

Interviews with business process owners.. The BIA requires both understanding of the process importance and the technical dependencies (what systems are actually used).

Answer

Current data center power consumption logs.

Answer

The organization's current IT procurement strategy.

Answer

Employee performance review records.