ISC Practice Test 3 — 10 Questions

Question 1

Which TWO factors must a security officer consider when performing a 'Privacy Impact Assessment' (PIA) for a new cloud application?

Accepted Answer

The potential impact on data subjects if a breach occurs. PIAs must account for the nature of the data and the risks to the data subjects.

Answer

The cost of the cloud storage subscription

Answer

The number of CPU cores required

Answer

The uptime SLA of the provider

Question 2

A CISO is presenting a security program roadmap. Which approach is best for managing expectations regarding security maturity?

Accepted Answer

Defining security maturity as a set of phased milestones. Providing a phased implementation plan with measurable milestones allows the CISO to demonstrate progress while acknowledging that maturity is a journey.

Answer

Linking maturity to the total security budget

Answer

Promising 100% security coverage by the end of the year

Answer

Focusing only on the latest security technologies

Question 3

What is the primary objective of a 'lessons learned' meeting conducted after a disaster recovery exercise?

Accepted Answer

Identify gaps in the plan and define remediation actions.. The objective is to identify gaps in the plan based on the exercise results and assign ownership for remediation.

Answer

Update the organizational chart.

Answer

Verify the status of the offsite backup tapes.

Answer

Evaluate the performance of the IT staff for disciplinary purposes.

Question 4

Which THREE of the following strategies should be included in a 'Disaster Recovery Program Oversight' function to ensure long-term viability?

Accepted Answer

Annual validation of the BIA to ensure it reflects current business priorities.. Oversight involves continuous validation through testing, alignment with changing business goals, and periodic audits of the documentation.

Answer

Mandating the use of specific hardware vendors for all offices.

Answer

Standardization of server naming conventions across all data centers.

Question 5

Your organization uses a 'Hot Site' with hardware-level replication. During a disaster, the primary site becomes unavailable, but the failover fails due to a 'Split-Brain' scenario. What is the fundamental cause of this?

Accepted Answer

Loss of the heartbeat connection/quorum service.. Split-brain happens when both sites think they are the primary due to loss of the quorum or heartbeat mechanism.

Answer

Mismatched firmware versions between servers.

Answer

Inadequate storage capacity for incoming logs.

Answer

Insufficient cooling at the hot site.

Question 6

Which TWO of the following are primary risks associated with an 'asynchronous' data replication strategy?

Accepted Answer

The RPO will always be greater than zero.. Asynchronous replication introduces a lag, meaning if the primary fails, the latest data might not have reached the secondary, risking data loss.

Answer

Excessive consumption of bandwidth during peak hours.

Answer

Total system failure due to incompatible storage protocols.

Answer

Increased network latency on the primary application.

Question 7

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

Accepted Answer

A formal documented non-retaliation policy. Whistleblower protection requires anonymity and a non-retaliation policy.

Answer

Automatic termination for all suspected security policy violations

Answer

Mandatory disclosure of employee salaries

Answer

Public posting of all employee disciplinary files

Question 8

To ensure security requirements are integrated into the System Development Life Cycle (SDLC), what is the most effective approach for the security team?

Accepted Answer

Embedding security champions within development teams. Embed security champions within development teams to act as liaisons, ensuring security is considered throughout the development process rather than treated as a final check.

Answer

Requiring developers to attend annual security seminars

Answer

Automating the code deployment process

Answer

Mandating a security review before production release

Question 9

When managing a global security team, what is the primary challenge in maintaining a uniform security posture?

Accepted Answer

Cultural differences and local regulations. Cultural differences and local regulatory requirements make it difficult to enforce a single, global standard, requiring a balance between global directives and local adaptation.

Answer

Lack of global email systems

Answer

Time zone differences

Answer

Language barriers

Question 10

A security manager is conducting a third-party risk assessment using the NIST Cybersecurity Framework. Which tool in the AWS Artifact portal is most appropriate for obtaining the necessary SOC 2 Type II reports to fulfill compliance auditing requirements?

Accepted Answer

AWS Artifact Reports. AWS Artifact provides on-demand access to AWS compliance reports, including SOC 2 Type II, for auditing purposes.

Answer

AWS Trusted Advisor

Answer

AWS Config rules

Answer

AWS Security Hub