ISC Practice Test 5 — 25 Questions

Question 1

Which THREE of the following are challenges in transitioning to a secure DevSecOps model?

Accepted Answer

Lack of security training for developers. Transitioning requires overcoming cultural resistance, automating complex security gates, and ensuring developers have the right training to take ownership of security.

Answer

Using only manual security review processes

Answer

Replacing all developers with security professionals

Question 2

During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?

Accepted Answer

Develop a unified risk assessment framework for the combined entity. Harmonizing methodologies allows for a unified risk view across the enterprise, which is essential for consistent governance.

Answer

Ignore the methodologies and rely on external audits

Answer

Force the smaller entity to adopt the larger one's tool

Answer

Keep both and report separately

Question 3

An organization is migrating to a hybrid cloud environment and is updating its security architecture. Which of the following is the MOST effective way to ensure consistent security policy enforcement across both on-premises and cloud environments?

Accepted Answer

Implementing a unified security policy framework across all environments.. Implementing a unified security policy framework ensures that security requirements are standardized and consistently applied regardless of the underlying infrastructure. This approach reduces complexity and human error in policy management.

Answer

Managing separate security policies for on-premises and cloud environments.

Answer

Prioritizing the security of on-premises assets over cloud assets.

Answer

Allowing individual departments to define their own security policies.

Question 4

Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?

Accepted Answer

Determine the effectiveness of controls. In NIST SP 800-37, 'Assess' involves evaluating the controls to determine if they are implemented correctly and effective.

Answer

Authorize the system

Answer

Define the boundary

Answer

Select controls

Question 5

When performing a risk assessment on a new SaaS implementation, which document is most useful for understanding the vendor's risk profile?

Accepted Answer

A SOC 2 Type II report. A SOC 2 Type II report provides an independent auditor's assessment of the vendor's security controls over time.

Answer

The vendor's sales brochure

Answer

The vendor's stock ticker symbol

Answer

The vendor's customer list

Question 6

Which THREE of the following are considered 'Risk Assessment' methodologies?

Accepted Answer

NIST SP 800-30. Common risk assessment methodologies include NIST RMF, FAIR, and ISO 27005.

Answer

HTML 5.0

Answer

TCP/IP protocol

Question 7

An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?

Accepted Answer

sourceIPAddress. The 'sourceIPAddress' field in the CloudTrail log entry directly identifies the client IP that made the API request.

Answer

recipientAccountId

Answer

requestParameters

Answer

userIdentity.arn

Question 8

Which THREE actions should be taken when performing an incident post-mortem according to industry best practices?

Accepted Answer

Review the effectiveness of the response timeline. Post-mortems focus on identifying root causes, improving processes, and ensuring documentation is captured.

Answer

Discipline the analyst who missed the alert

Answer

Delete all evidence to save storage space

Question 9

When executive leadership discusses 'Acceptable Risk', they are referring to:

Accepted Answer

Residual risk within the risk appetite. Acceptable risk is the remaining risk after controls are applied that remains within the organizational risk tolerance.

Answer

Inherent risk before controls

Answer

Zero risk tolerance

Answer

The total budget for security

Question 10

You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?

Accepted Answer

Single Loss Expectancy. The Single Loss Expectancy (SLE) is the monetary value of a single loss event.

Answer

Security Loss Estimate

Answer

System Level Exposure

Answer

Serious Loss Evaluation

Question 11

Which TWO methods are commonly used to identify new risks in an enterprise environment?

Accepted Answer

Threat intelligence feeds. Risk identification is often driven by systematic reviews (audits/assessments) and data-driven analysis (threat intelligence).

Answer

The annual holiday party schedule

Answer

Automated server patching

Answer

Purchasing more hardware

Question 12

Which of the following is an example of a detective control in a risk management program?

Accepted Answer

Security Information and Event Management (SIEM) alerts. Detective controls, like logs or monitoring, identify that a risk event has occurred.

Answer

Encryption

Answer

Firewall rules

Answer

Disaster recovery plan

Question 13

What is the primary difference between a 'Risk Assessment' and a 'Vulnerability Assessment'?

Accepted Answer

Risk assessment considers business context and impact. A vulnerability assessment finds technical flaws; a risk assessment determines the business impact and likelihood of those flaws being exploited.

Answer

There is no difference

Answer

Risk assessment is only for physical assets

Answer

Vulnerability assessment is only for executive level

Question 14

Which THREE criteria are essential for establishing a successful 'Risk Committee'?

Accepted Answer

Representation from multiple business units. A successful committee needs diverse perspectives, executive support, and a defined mandate.

Answer

Limiting membership to only IT security staff

Answer

Conducting meetings at midnight for secrecy

Question 15

An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?

Accepted Answer

Implement a multi-cloud strategy. Multi-cloud or hybrid-cloud strategies are the primary methods to reduce concentration risk (dependence on a single provider).

Answer

Move all data to a private data center

Answer

Enable two-factor authentication

Answer

Increase the number of security analysts

Question 16

When assessing the risk of a third-party service provider, which THREE areas should be evaluated?

Accepted Answer

Legal and contractual liability clauses. Supply chain risk management requires a holistic review of security, legal, and operational/financial health.

Answer

The vendor's office coffee selection

Answer

The color of the vendor's logo

Question 17

Which TWO items must be documented in a Change Control Log after a successful production change?

Accepted Answer

The timestamp of the change. A change log must include the final outcome (status) and the timestamp to ensure traceability and audit accuracy.

Answer

The developer's personal home address

Answer

The names of all employees who saw the change code

Answer

The total budget of the organization

Question 18

In Splunk Enterprise Security, which dashboard should the SOC manager review to evaluate the effectiveness of the current correlation searches and the volume of notable events?

Accepted Answer

Content Management Dashboard. The Content Management dashboard provides insights into the performance, trigger volume, and status of correlation searches.

Answer

Threat Intelligence Dashboard

Answer

Asset Center

Answer

Incident Review Dashboard

Question 19

An organization is adopting Infrastructure-as-Code (IaC) using Terraform. The ISSMP wants to ensure no insecure configurations (e.g., S3 buckets with public read) are deployed. What should be integrated into the CI/CD pipeline?

Accepted Answer

Static Analysis for IaC (e.g., tfsec/Checkov).. Integrating static analysis tools for IaC (like 'tfsec' or 'Checkov') into the pipeline identifies insecure configurations before the 'terraform apply' command is executed.

Answer

Manual Terraform code review logs.

Answer

Using AWS IAM policies only.

Answer

Disabling the Terraform 'plan' command.

Question 20

Which metric provides the best insight into the effectiveness of the security program within the SDLC?

Accepted Answer

Mean Time to Remediation (MTTR).. The 'Vulnerability Density' (vulnerabilities per KLOC) or 'Mean Time to Remediation' (MTTR) are the most effective metrics for demonstrating SDLC security health.

Answer

Number of servers decommissioned.

Answer

Number of lines of code written.

Answer

Number of developers hired.