ISC Practice Test 4 — 25 Questions

Question 1

In VMware Carbon Black Cloud, which feature should be enabled to block unauthorized scripts while allowing signed binaries from trusted software vendors?

Accepted Answer

Advanced Threat Prevention (ATP). The 'Advanced Threat Prevention' policies allow for specific exclusion and blocking rules based on file reputation and signing certificates.

Answer

Watchlists

Answer

Policy Bypass

Answer

Live Query

Question 2

Which TWO of the following are essential components of an effective security governance framework?

Accepted Answer

Clearly defined roles, responsibilities, and accountability. A comprehensive framework needs defined policies (what) and a structure of accountability (who) to ensure execution.

Answer

The latest artificial intelligence tools

Answer

A dedicated office space for the security team

Answer

A large annual security budget

Question 3

Which TWO of the following are effective communication strategies for a CISO interacting with senior executives?

Accepted Answer

Focusing on the business impact of security risks. Executives need concise, business-focused information that allows them to make informed decisions about risk and resource allocation.

Answer

Providing hour-long technical deep dives on every vulnerability

Answer

Using complex, obscure security acronyms

Answer

Writing 50-page reports for every meeting

Question 4

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

Accepted Answer

Percentage of assets with missing security patches. A leading indicator predicts future risk, whereas a lagging indicator reports past occurrences.

Answer

Total cost of a data breach

Answer

Number of systems compromised

Answer

Number of security incidents in the last month

Question 5

An organization is moving from a reactive security posture to a proactive threat-informed defense. As the ISSMP, you are implementing the MITRE ATT&CK framework. Which executive-level metric best demonstrates the maturity of the security program to the Board of Directors regarding this transition?

Accepted Answer

Percentage of MITRE ATT&CK techniques covered by existing controls. Mapping security coverage to MITRE ATT&CK techniques provides a quantifiable measure of defensive maturity that boards can understand, representing the shift from reactive compliance to proactive threat management.

Answer

Time to remediate critical security incidents

Answer

Number of phishing emails blocked by the email gateway

Answer

Total number of vulnerabilities patched per month

Question 6

Which THREE of the following represent the primary responsibilities of executive leadership in fostering a strong organizational security culture?

Accepted Answer

Holding business units accountable for security outcomes. Executive leadership is responsible for setting the tone, providing resources, and ensuring accountability, which directly shapes the security culture of the organization.

Answer

Writing technical documentation for network architecture

Answer

Installing software patches on all end-user workstations

Question 7

Which THREE of the following should be included in an annual strategic security plan?

Accepted Answer

Current state assessment of security maturity. A strategic plan must look at current maturity, future initiatives (projects), and the resources required to achieve those goals.

Answer

A detailed list of every firewall rule

Answer

A list of all employee salaries

Question 8

During a cross-functional security planning session, the IT operations team argues that security controls are negatively impacting system performance. As an ISSMP, what is the most appropriate management approach to resolve this conflict?

Accepted Answer

Perform a joint business impact analysis to determine the optimal balance of security and performance. Effective security management involves balancing security needs with business operational requirements through a collaborative risk-based approach, ensuring security is integrated rather than imposed.

Answer

Enforce the security controls regardless of performance impacts

Answer

Escalate the issue to the CIO for a final decision without further analysis

Answer

Reduce security controls until performance targets are met

Question 9

Which TWO of the following are primary components of an effective strategic security planning process as defined by (ISC)2 best practices for an ISSMP?

Accepted Answer

Alignment of security objectives with organizational business goals. Strategic planning requires aligning security goals with business objectives and conducting a formal gap analysis to determine the current state versus the future state.

Answer

Creating a daily incident report for the Board

Answer

Manual review of every individual firewall rule change

Answer

Purchasing the most expensive security software available

Question 10

An ISSMP is developing a cross-functional incident response team. Which THREE roles or functions are absolutely critical to include to ensure comprehensive handling of a major security breach?

Accepted Answer

Legal Counsel (General Counsel or Privacy Officer).. A major incident requires more than just technical response; it requires legal oversight, communication strategies, and executive decision-making capabilities.

Answer

External janitorial staff for physical security.

Answer

Internal cafeteria staff for onsite catering.

Question 11

In the context of ISO 31000, what is the primary purpose of 'Risk Communication and Consultation'?

Accepted Answer

To inform decision-making by engaging stakeholders. ISO 31000 emphasizes stakeholder engagement throughout the entire risk management process to ensure transparency and accountability.

Answer

To notify the public of breaches

Answer

To assign blame for security failures

Answer

To archive risk records for auditing

Question 12

An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?

Accepted Answer

It requires assessing risk at the resource and identity level. Zero Trust shifts the focus from network perimeters to identity and device health, requiring a more granular, asset-centric risk assessment.

Answer

It makes the risk assessment easier

Answer

It eliminates the need for risk assessment

Answer

It only impacts physical security

Question 13

When presenting a risk treatment plan to the Board of Directors, which THREE elements should be included to ensure executive buy-in?

Accepted Answer

Cost-benefit analysis of the proposed treatment. Executives need to understand the cost, the risk reduction, and the business impact to approve funding.

Answer

A list of all software versions running in the data center

Answer

Technical logs of the last 100 failed login attempts

Question 14

A CISO needs to justify an increase in the security budget. Which argument is most persuasive to the Chief Financial Officer (CFO)?

Accepted Answer

Quantifying financial exposure from potential security events. Quantifying the cost of potential data breaches in terms of lost revenue and regulatory fines demonstrates the financial risk the CFO is helping to manage.

Answer

Comparing the budget to industry peers

Answer

Focusing on the technical features of a new tool

Answer

Listing the latest security threats in the industry

Question 15

Which TWO of the following are key responsibilities of the CISO regarding corporate risk management?

Accepted Answer

Aligning security controls with the enterprise risk appetite. The CISO is responsible for translating technical risks into business impact and for ensuring that the organization's risk appetite is reflected in security controls.

Answer

Determining the organization's risk appetite

Answer

Hiring external penetration testers

Answer

Personally fixing every firewall misconfiguration

Question 16

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

Accepted Answer

The vendor's secure software development lifecycle (SSDLC) practices. Vendor financial stability and their own security development lifecycle (SDL) are paramount for long-term supply chain risk.

Answer

The physical location of their headquarters

Answer

The number of employees at the vendor

Answer

The vendor's marketing budget

Question 17

Which TWO factors should be used to weigh the 'Impact' in a risk assessment?

Accepted Answer

The replacement cost of the asset. Impact is generally measured by the potential loss to the business, focusing on availability, confidentiality, and integrity.

Answer

The number of hours the system has been running

Answer

The font size used in internal memos

Answer

The age of the server hardware

Question 18

Which THREE actions are necessary when preparing to decommission a cloud-based Virtual Machine (VM)?

Accepted Answer

Deleting associated snapshots and backups. Decommissioning in the cloud involves ensuring data is wiped, access rights are removed, and the resources are actually terminated to prevent billing and security exposure.

Answer

Taking a final full-disk backup to a public S3 bucket

Answer

Updating the local hardware inventory

Question 19

When aligning security with organizational goals, how should an ISSMP address a conflict between security controls and user productivity?

Accepted Answer

Conduct a risk-benefit analysis for alternative controls. Conduct a risk-benefit analysis to determine if the security control is truly necessary and if alternative, less intrusive controls exist that provide the same level of protection.

Answer

Remove the security control to favor productivity

Answer

Delegate the decision to the IT support manager

Answer

Enforce the security control regardless of impact

Question 20

Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?

Accepted Answer

Containment, Eradication, and Recovery. Recovery includes restoring systems to normal operation and confirming they are secure.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Preparation