ISC Practice Test 4 — 25 Questions

Question 1

In an incident response plan, which metric is most useful for measuring the 'dwell time' of a threat actor?

Accepted Answer

Mean Time to Detect (MTTD). Dwell time is the period between the initial compromise and the time the organization detects the breach.

Answer

Mean Time to Acknowledge (MTTA)

Answer

Mean Time to Recovery (MTTR)

Answer

Mean Time to Contain (MTTC)

Question 2

When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?

Accepted Answer

Device patch management capabilities. IoT devices often have poor security (patching challenges), high network exposure, and physical access vulnerabilities.

Answer

The manufacturer's stock price history

Answer

The aesthetic design of the device

Question 3

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

Accepted Answer

Percentage of assets with missing security patches. A leading indicator predicts future risk, whereas a lagging indicator reports past occurrences.

Answer

Total cost of a data breach

Answer

Number of systems compromised

Answer

Number of security incidents in the last month

Question 4

An ISSMP is developing a cross-functional incident response team. Which THREE roles or functions are absolutely critical to include to ensure comprehensive handling of a major security breach?

Accepted Answer

Legal Counsel (General Counsel or Privacy Officer).. A major incident requires more than just technical response; it requires legal oversight, communication strategies, and executive decision-making capabilities.

Answer

External janitorial staff for physical security.

Answer

Internal cafeteria staff for onsite catering.

Question 5

An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?

Accepted Answer

It requires assessing risk at the resource and identity level. Zero Trust shifts the focus from network perimeters to identity and device health, requiring a more granular, asset-centric risk assessment.

Answer

It makes the risk assessment easier

Answer

It eliminates the need for risk assessment

Answer

It only impacts physical security

Question 6

An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?

Accepted Answer

sourceIPAddress. The 'sourceIPAddress' field in the CloudTrail log entry directly identifies the client IP that made the API request.

Answer

recipientAccountId

Answer

requestParameters

Answer

userIdentity.arn

Question 7

Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?

Accepted Answer

Determine the effectiveness of controls. In NIST SP 800-37, 'Assess' involves evaluating the controls to determine if they are implemented correctly and effective.

Answer

Authorize the system

Answer

Define the boundary

Answer

Select controls

Question 8

Which TWO methods are commonly used to identify new risks in an enterprise environment?

Accepted Answer

Threat intelligence feeds. Risk identification is often driven by systematic reviews (audits/assessments) and data-driven analysis (threat intelligence).

Answer

The annual holiday party schedule

Answer

Automated server patching

Answer

Purchasing more hardware

Question 9

An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?

Accepted Answer

Implement a multi-cloud strategy. Multi-cloud or hybrid-cloud strategies are the primary methods to reduce concentration risk (dependence on a single provider).

Answer

Move all data to a private data center

Answer

Enable two-factor authentication

Answer

Increase the number of security analysts

Question 10

Which THREE types of data should be ingested by a SIEM to improve its threat detection capabilities?

Accepted Answer

Authentication/Identity logs. A robust SIEM needs endpoint logs, network logs, and identity/access logs to correlate threats.

Answer

Building HVAC monitoring logs

Answer

Office breakroom temperature logs

Question 11

Which THREE items are typically verified in a Security Gate check before a production deployment?

Accepted Answer

Formal change request approval is documented. Production gates check for vulnerability remediation, passing functional/security tests, and the presence of required documentation (like the change request).

Answer

The marketing campaign has been approved

Answer

The developer has finished their vacation

Question 12

An ISSMP is performing a security assessment on an application using containerized microservices. The team uses Kubernetes. What is the most effective way to ensure security configurations are consistently applied across all clusters?

Accepted Answer

Kubernetes Admission Controllers. Kubernetes Admission Controllers intercept requests to the API server before persistence, allowing enforcement of security policies such as pod security standards, resource limits, and image provenance. They ensure consistent application of configurations across all clusters by validating or mutating resources at creation time.

Answer

Regular penetration testing

Answer

Manual code review of Dockerfiles

Answer

Role-Based Access Control (RBAC) only

Question 13

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

Accepted Answer

Microsoft Purview DLP policies. Data Loss Prevention (DLP) policies in Microsoft 365 can be configured to detect PHI patterns and block or encrypt emails accordingly.

Answer

Exchange Online Protection (EOP) malware filtering

Answer

Microsoft Defender for Endpoint

Answer

Retention labels in the Compliance Center

Question 14

Which SOC metric is most appropriate to present to executive leadership to demonstrate the business value of security investments?

Accepted Answer

Reduction in Mean Time to Remediate (MTTR). MTTR reduction directly reflects how quickly the SOC detects, responds to, and resolves incidents — a business-relevant outcome that executives can tie to reduced breach impact and operational resilience. It translates technical security work into a measurable improvement in risk exposure over time.

Answer

Total number of firewall rules

Answer

Disk space usage of the SIEM

Answer

Number of dropped packets per day

Question 15

An organization is moving from a reactive security posture to a proactive threat-informed defense. As the ISSMP, you are implementing the MITRE ATT&CK framework. Which executive-level metric best demonstrates the maturity of the security program to the Board of Directors regarding this transition?

Accepted Answer

Percentage of MITRE ATT&CK techniques covered by existing controls. Mapping security coverage to MITRE ATT&CK techniques provides a quantifiable measure of defensive maturity that boards can understand, representing the shift from reactive compliance to proactive threat management.

Answer

Time to remediate critical security incidents

Answer

Number of phishing emails blocked by the email gateway

Answer

Total number of vulnerabilities patched per month

Question 16

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?

Accepted Answer

Revoke sessions. The 'Revoke sessions' action in the Entra ID user blade forces the user to re-authenticate and clears all current refresh tokens.

Answer

Disable the user account

Answer

Remove assigned licenses

Answer

Reset the password

Question 17

As an ISSMP developing a security governance program, which THREE of the following activities are essential to ensure the program remains effective and compliant?

Accepted Answer

Establishing a formal security steering committee. Option B is correct because a formal security steering committee provides executive-level oversight, strategic direction, and cross-functional decision-making that keeps the governance program aligned with business objectives and regulatory requirements. Option C is correct because assigning clear roles and responsibilities (e.g., via a RACI matrix) ensures accountability for security tasks, prevents gaps or overlaps in ownership, and is a foundational governance control. Option D is correct because regular audits of security policy compliance verify that controls are operating effectively, identify deviations, and drive corrective actions needed for continuous compliance. Option A is not essential to governance—manual firewall configuration is an operational task that should be automated and delegated, not performed by the ISSMP. Option E is irrelevant to security governance, as help desk ticket volume measures operational workload, not the effectiveness or compliance of the governance program.

Answer

Directly managing all firewall configurations manually

Answer

Increasing the number of help desk tickets handled daily

Question 18

Which TWO mechanisms are effective for preventing 'insecure direct object references' (IDOR) in a web application during the development phase?

Accepted Answer

Using non-enumerable, cryptographically strong identifiers (e.g., UUIDs). Preventing IDOR requires both server-side authorization checks and the use of indirect/randomized identifiers rather than sequential, predictable keys.

Answer

Client-side input validation

Answer

Disabling logging of access attempts

Answer

Using sequential database IDs in URLs

Question 19

Which document is considered the primary 'source of truth' for defining the SOC's roles, responsibilities, and communication paths during a major security incident?

Accepted Answer

Incident Response Plan (IRP). The Incident Response Plan (IRP) is the primary document that defines the SOC's roles, responsibilities, and communication paths during a major security incident. It provides a structured approach to incident handling, including escalation procedures, contact information, and step-by-step actions. The IRP is specifically designed to be the authoritative source during incident response.

Answer

Vulnerability Assessment Report

Answer

Standard Operating Procedure (SOP)

Answer

Asset Inventory

Question 20

During a cross-functional security planning session, the IT operations team argues that security controls are negatively impacting system performance. As an ISSMP, what is the most appropriate management approach to resolve this conflict?

Accepted Answer

Perform a joint business impact analysis to determine the optimal balance of security and performance. Effective security management involves balancing security needs with business operational requirements through a collaborative risk-based approach, ensuring security is integrated rather than imposed.

Answer

Enforce the security controls regardless of performance impacts

Answer

Escalate the issue to the CIO for a final decision without further analysis

Answer

Reduce security controls until performance targets are met