ISC Practice Test 5 — 25 Questions

Question 1

A security manager is evaluating organizational security culture. Which indicator provides the most reliable evidence of a 'security-first' culture?

Accepted Answer

Volume of self-reported security near-misses. The reporting of near-misses by employees shows that staff are actively engaged in security awareness and feel safe identifying potential threats, which is a key trait of a mature security culture.

Answer

Budget allocated to security

Answer

Percentage of employees who completed training

Answer

Number of security policies written

Question 2

A Chief Risk Officer is utilizing the FAIR framework to quantify cyber risk. Which input is required to calculate the Loss Event Frequency?

Accepted Answer

Threat Event Frequency and Vulnerability. In the FAIR framework, Loss Event Frequency (LEF) is calculated from Threat Event Frequency (TEF) and Vulnerability (the probability that a threat event becomes a loss event). The formula is LEF = TEF × Vulnerability. Therefore, the required inputs are Threat Event Frequency and Vulnerability.

Answer

Primary Loss Magnitude and Secondary Loss Magnitude

Answer

Inherent Risk and Residual Risk

Answer

Control Strength and Asset Valuation

Question 3

For an organization to maintain compliance with the GLBA (Gramm-Leach-Bliley Act), which mechanism within Azure Key Vault is required to demonstrate evidence of 'Key Rotation' and 'Access History'?

Accepted Answer

Azure Monitor Diagnostic Settings. Azure Key Vault logs accessed via Azure Monitor and Log Analytics provide the necessary evidence for key management compliance.

Answer

Key Vault Backup

Answer

Key Vault Access Policies

Answer

Azure Active Directory B2C

Question 4

In Rapid7 InsightVM, what is the best way to categorize assets into groups based on their business function for targeted vulnerability reporting?

Accepted Answer

Dynamic Asset Groups. Dynamic Asset Groups in Rapid7 InsightVM automatically include assets based on filter criteria such as tags, operating system, or vulnerability attributes, so assets can be grouped by business function (e.g., 'PCI servers', 'HR workstations') and kept current as the environment changes. This enables targeted vulnerability reporting and remediation workflows without manual list maintenance. It is the intended mechanism for business-function-based categorization.

Answer

User role

Answer

Scan template

Answer

Site configuration

Question 5

Which THREE activities are included in the 'Preparation' phase of the IR life cycle?

Accepted Answer

Conducting incident drills and exercises. Preparation involves setting up tools, training the team, and defining the procedures necessary for effective response.

Answer

Eradicating an ongoing malware infection

Answer

Writing the post-incident summary report

Question 6

An ISSMP is overseeing the integration of security into a new DevOps pipeline using Jenkins. Which stage of the SDLC should the ISSMP enforce the execution of SAST tools to ensure security requirements are met early?

Accepted Answer

Development/Build phase. SAST (Static Application Security Testing) tools analyze source code or binaries for security vulnerabilities without executing the program. They are most effective when integrated into the Development/Build phase of the SDLC, where code is written and compiled. Enforcing SAST at this stage allows developers to identify and remediate security flaws early, reducing cost and effort compared to fixing issues later in production. This aligns with the shift-left security principle in DevOps, ensuring security requirements are met from the start.

Answer

Decommissioning phase

Answer

Post-deployment monitoring

Answer

Requirements gathering phase

Question 7

Which THREE of the following are challenges in transitioning to a secure DevSecOps model?

Accepted Answer

Lack of security training for developers. Transitioning requires overcoming cultural resistance, automating complex security gates, and ensuring developers have the right training to take ownership of security.

Answer

Using only manual security review processes

Answer

Replacing all developers with security professionals

Question 8

Following a ransomware attack, the organization must decide whether to invoke the DRP or remain in a degraded state while security teams perform forensics. What is the ISSMP's primary responsibility in this decision-making process?

Accepted Answer

Ensuring the decision is documented to align with the organization's risk appetite.. The ISSMP operates at the management and governance layer, not the hands-on technical layer. When deciding between invoking the DRP and staying degraded for forensics, the ISSMP's primary duty is to ensure the decision is made deliberately, documented, and aligned with the organization's stated risk appetite and business priorities. This preserves accountability and provides an auditable rationale for regulators, auditors, and executives.

Answer

Choosing the restore point from the offsite immutable backup.

Answer

Performing the initial forensic image of the infected servers.

Answer

Directing the IT team to disconnect the network immediately.

Question 9

Which TWO factors should be used to weigh the 'Impact' in a risk assessment?

Accepted Answer

The replacement cost of the asset. Impact is generally measured by the potential loss to the business, focusing on availability, confidentiality, and integrity.

Answer

The number of hours the system has been running

Answer

The font size used in internal memos

Answer

The age of the server hardware

Question 10

Which leadership style is most effective for building a strong security team during a period of rapid organizational growth?

Accepted Answer

Transformational leadership. Transformational leadership inspires and motivates team members to exceed expectations by fostering a shared vision, encouraging innovation, and providing individualized consideration. During rapid growth, this style is most effective for building a strong security team because it aligns diverse talents toward common goals and adapts to change.

Answer

Transaction-based leadership

Answer

Laissez-faire leadership

Answer

Autocratic leadership

Question 11

Your organization has adopted a cloud-native microservices architecture. Which strategy is most appropriate for maintaining business continuity in the event of a regional cloud provider outage?

Accepted Answer

Multi-region active-active deployment with global load balancing.. Multi-region deployment with active-active traffic distribution provides the highest level of resilience for cloud-native apps.

Answer

Cross-region cold standby snapshots.

Answer

On-premises hot-site failover.

Answer

Single-region immutable backups.

Question 12

An ISSMP is leading the secure acquisition of a commercial off-the-shelf (COTS) payroll system that will process employee PII. The vendor will not permit source code review but does provide a completed consensus assessment questionnaire. Which action BEST allows the ISSMP to establish assurance that the product meets the organization's security requirements before signing the contract?

Accepted Answer

Require the vendor to undergo a SOC 2 Type II examination and review the report's trust services criteria and complementary user entity controls.. When source code review and on-site assessment are not feasible, the strongest pre-contract assurance comes from an independent examination of the vendor's controls over a period of time. A SOC 2 Type II report, read together with its trust services criteria and complementary user entity controls, tells the ISSMP both what was tested and what the organization must do to rely on those controls. Self-attestations, point-in-time tests, and deferred audits do not close the assurance gap before PII is entrusted to the vendor.

Answer

Request the vendor's most recent penetration test executive summary and treat a passing result as evidence that the product satisfies the security requirements.

Answer

Accept the vendor's completed consensus assessment questionnaire as sufficient evidence because it is signed by the vendor's Chief Information Security Officer.

Answer

Insert a contractual right to audit into the master services agreement and defer all assurance activities until the first annual audit after go-live.

Question 13

A multinational manufacturer is updating its contingency management framework after a prolonged supplier outage disrupted production. Executive leadership wants assurance that future disruptions are detected early and that recovery priorities remain aligned with business objectives. (Choose two.)

Accepted Answer

Establishing early warning indicators and monitoring for critical suppliers and internal dependencies.. Early warning indicators address the detection requirement by surfacing supplier and dependency deterioration before failure, while a change-driven BIA refresh keeps recovery priorities matched to current business objectives. Together they close the two gaps leadership identified. Delegation, exercise frequency, and insurance each address different concerns and none directly provides early detection or sustained alignment of recovery priorities.

Answer

Delegating all contingency planning decisions to the supplier management team.

Answer

Purchasing additional cyber insurance to transfer the financial impact of supplier outages.

Answer

Increasing the frequency of full-scale disaster recovery exercises to monthly.

Question 14

You are the ISSMP for a multinational retailer that operates in the European Union and the United States. The Chief Human Resources Officer asks you to approve a new employee monitoring tool that captures screenshots, keystrokes, and application usage on all corporate endpoints. Legal counsel in the EU has not yet been consulted. As the ISSMP, which action best demonstrates alignment of security leadership with legal and privacy obligations before the tool is deployed?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) with legal counsel and the works council before approving the monitoring tool.. Employee monitoring is high-risk processing under GDPR, so a DPIA must be completed before deployment. Involving legal counsel and the works council ensures the security program respects privacy, employment law, and consultation requirements. The ISSMP's role is to integrate legal and privacy governance into security decisions rather than treat monitoring as a purely technical control.

Answer

Require the vendor to sign a data processing agreement and then proceed with full deployment.

Answer

Deploy the tool only on endpoints used by US-based employees to avoid EU regulatory exposure.

Answer

Approve the tool because endpoint monitoring is a standard security control covered by the acceptable use policy.

Question 15

A retail company is conducting a business impact analysis (BIA) for its point-of-sale (POS) system. The BIA team has identified that a 4-hour outage would result in $500,000 in lost sales and reputational damage. The company's risk appetite allows for a maximum of 2 hours of downtime for critical systems. Which of the following should be the PRIMARY output of this BIA for the POS system?

Accepted Answer

A recovery time objective (RTO) of 2 hours or less for the POS system.. The BIA determines the maximum tolerable downtime based on business impact and risk appetite. For the POS system, the risk appetite limits downtime to 2 hours, so the RTO must be 2 hours or less. This RTO drives the selection of recovery strategies. Cost-benefit analysis, backup schedules, and supplier lists are downstream activities, not the primary BIA output.

Answer

A detailed cost-benefit analysis for upgrading the POS hardware.

Answer

A schedule for daily backups of POS transaction data.

Answer

A list of alternate suppliers for POS terminals.

Question 16

During a declared major incident, the incident commander needs to preserve volatile evidence on a compromised Linux server before the platform team rebuilds it. The server hosts a critical billing application and cannot be taken offline for more than 30 minutes. Which action BEST satisfies both the evidentiary requirement and the availability constraint?

Accepted Answer

Capture a full physical memory image using LiME, record running processes with ps aux, and save network connection state from /proc/net, then proceed with the rebuild.. Volatile evidence such as RAM contents, running processes, and network connections is lost the instant a system is powered off or rebuilt. Capturing these artifacts first with a tool like LiME preserves the most perishable and often most probative evidence. Because the acquisition can be performed quickly, the 30-minute rebuild window remains achievable, balancing forensic obligations with the availability requirement of the billing application.

Answer

Power off the server immediately and remove the disk drives for forensic imaging at the lab, accepting the extended downtime as necessary for evidence integrity.

Answer

Run a full antivirus scan and collect the resulting quarantine log, then rebuild the server once the scan confirms the malware has been removed.

Answer

Take a forensic snapshot of the virtual machine through the hypervisor management console and continue running the production workload on the original VM.

Question 17

You are the ISSMP leading development of a security strategy that must support a three-year business transformation involving cloud migration and new digital products. Executive leadership expects the strategy to be both risk-based and measurable. Which two actions are most appropriate to include in the strategy? (Choose two.)

Accepted Answer

Establish a governance and reporting cadence that ties security performance metrics to the same executive dashboard used for transformation delivery.. A risk-based, measurable strategy aligns security objectives and indicators with business transformation milestones and executive risk appetite, and reports them through the same governance cadence as delivery. This keeps security integrated, visible, and adjustable as threats and business priorities evolve, rather than treating it as a separate or deferred workstream.

Answer

Adopt a fixed three-year security budget and roadmap that cannot be adjusted regardless of changes in the threat landscape or business priorities.

Answer

Defer all security architecture changes until the cloud migration and digital product launches are complete, to avoid slowing delivery.

Answer

Measure strategy success primarily by the number of security tools deployed and the volume of policies published during the transformation.

Question 18

An ISSMP is leading the security integration for a new software development project that will use agile methodologies. The project team is distributed across multiple time zones. Which TWO practices are MOST effective for ensuring security requirements are not overlooked in this environment? (Choose two.)

Accepted Answer

Embedding a security champion within each development team to advocate for and review security practices.. The most effective practices are embedding security champions in each team and defining security requirements as user stories with acceptance criteria. Champions provide local advocacy and expertise, while user stories make security visible and trackable in the agile backlog. Together, they ensure continuous security integration in a distributed environment, unlike late reviews, centralized decision-making, or passive documentation.

Answer

Using a shared document repository for security policies that developers can consult as needed.

Answer

Conducting a comprehensive security review only at the end of the project before release.

Answer

Requiring all security decisions to be made by the central security team to ensure consistency.

Question 19

A financial services firm has a primary data center and a cold DR site 120 miles away. A risk assessment reveals that the maximum tolerable downtime (MTD) for the core banking application is 8 hours, but the DR plan requires 24 hours to restore from tape backups at the cold site. The business continuity manager must close this gap. Which action is the MOST effective immediate step?

Accepted Answer

Upgrade the cold site to a warm site with pre-staged hardware and replicated data.. The core banking application's MTD is 8 hours, but the cold site requires 24 hours to restore. A warm site with pre-staged hardware and replicated data can be activated within the MTD, directly closing the gap. Increasing backup frequency addresses RPO, not RTO. Reciprocal agreements are unreliable. Altering the MTD to fit current capabilities undermines the BIA's purpose and leaves the business exposed.

Answer

Update the BIA to reflect a more realistic MTD of 24 hours for the core banking application.

Answer

Increase the backup frequency from daily to hourly and store tapes offsite.

Answer

Negotiate a reciprocal agreement with a nearby business partner to use their data center.

Question 20

A security manager is leading the response to a confirmed ransomware outbreak on a file server. The malware is still actively encrypting files and spreading laterally via SMB. Executive leadership asks the manager to authorize immediate containment. Which action BEST satisfies the containment objective while preserving forensic evidence?

Accepted Answer

Disconnect the file server's network cable and leave the system powered on to preserve volatile memory and active encryption state.. Containment must stop the spread immediately without destroying evidence. Physically disconnecting the network cable isolates the host while keeping memory and running processes available for forensic analysis. Powering off destroys volatile evidence, scanning in place allows continued encryption, and network-layer tricks are too slow. The manager should authorize the physical disconnection as the fastest, evidence-preserving containment step.

Answer

Immediately power off the file server to halt encryption and prevent further data loss.

Answer

Revoke the file server's DNS registration and wait for DHCP lease expiration to remove it from the network.

Answer

Run a full antivirus scan on the file server and quarantine any detected malware while keeping it on the network.