ISC Practice Test 2 — 30 Questions

Question 1

Which organizational structure is most effective for a CISO to influence security behavior across geographically dispersed and independent business units?

Accepted Answer

Matrix Management. A matrix management structure allows the CISO to exert influence through both functional and operational lines, ensuring security standards are consistent while respecting business unit autonomy.

Answer

Centralized Command and Control

Answer

Outsourced Security Operations

Answer

Decentralized/Siloed Management

Question 2

During the maintenance phase, a production database needs a schema change. The ISSMP requires that this change be tested in a staging environment that mirrors production. Which process best demonstrates compliance with the 'Separation of Duties' principle?

Accepted Answer

Requiring a separate release team to deploy changes approved by a Change Advisory Board (CAB).. Separation of Duties (SoD) requires that no single individual controls all phases of a critical transaction — the person who writes or approves a change should not be the same person who deploys it. Option D satisfies this by splitting responsibilities: the CAB approves the change, and a separate release team executes the deployment, ensuring independent verification and accountability. This creates a documented, auditable chain of custody that demonstrates compliance with ISSMP governance expectations.

Answer

The ISSMP personally reviewing every SQL script.

Answer

Allowing the automated CI/CD tool to deploy without human review.

Answer

Having the DBA perform the deployment in staging and production.

Question 3

Which THREE factors must be considered during the 'Compliance Program Management' phase when evaluating whether to adopt a new cloud-based tool?

Accepted Answer

The availability of audit logs for compliance verification. Option B is correct because audit logs provide the evidentiary trail needed to verify that the cloud tool meets regulatory requirements and to support audits, so their availability is a core compliance consideration. Option C is correct because data residency determines where data is stored and processed, which directly affects adherence to laws such as GDPR or other jurisdictional privacy mandates. Option D is correct because the tool must align with the organization's existing security and privacy policies to avoid introducing control gaps or policy violations. Option A is not relevant because marketing budget does not affect regulatory compliance or control effectiveness. Option E is not relevant because a vendor's social media following has no bearing on compliance, security, or privacy obligations.

Answer

The tool's marketing budget

Answer

The number of social media followers of the vendor

Question 4

Your organization uses a 'Hot Site' with hardware-level replication. During a disaster, the primary site becomes unavailable, but the failover fails due to a 'Split-Brain' scenario. What is the fundamental cause of this?

Accepted Answer

Loss of the heartbeat connection/quorum service.. Split-brain happens when both sites think they are the primary due to loss of the quorum or heartbeat mechanism.

Answer

Mismatched firmware versions between servers.

Answer

Inadequate storage capacity for incoming logs.

Answer

Insufficient cooling at the hot site.

Question 5

Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?

Accepted Answer

Containment, Eradication, and Recovery. Recovery includes restoring systems to normal operation and confirming they are secure.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Preparation

Question 6

Which THREE factors are required to calculate the 'Risk' of a vulnerability for reporting purposes?

Accepted Answer

Asset Criticality. Risk is typically calculated as Likelihood x Impact, where Likelihood is influenced by Threat and Vulnerability, and Impact is determined by Asset Criticality.

Answer

Number of employees in the SOC

Answer

The cost of the security appliance

Question 7

Which phase of the SDLC is most appropriate for conducting a formal Threat Modeling exercise?

Accepted Answer

Design phase. Threat modeling is most effective during the design phase because it allows security architects to identify potential threats and design mitigations before code is written or systems are deployed. Conducting it early avoids costly rework and ensures security controls are built into the architecture. The design phase is where data flows, trust boundaries, and components are defined, which are the inputs threat modeling requires.

Answer

Release phase

Answer

Operations and Maintenance

Answer

Initiation phase

Question 8

Which document is primarily responsible for documenting the security controls applicable to a system during the SDLC's requirements phase?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the formal document that describes the system boundary, the security controls implemented or planned, and how those controls meet the applicable security requirements. It is developed during the requirements phase of the SDLC and evolves through the lifecycle, making it the primary artifact for documenting applicable security controls.

Answer

Acceptable Use Policy (AUP)

Answer

Service Level Agreement (SLA)

Answer

Business Impact Analysis (BIA)

Question 9

When drafting an organizational 'Acceptable Use Policy' (AUP), which element is most critical to ensure legal enforceability in a professional environment?

Accepted Answer

Mandatory user acknowledgment signature. A mandatory user acknowledgment signature is critical for legal enforceability because it provides documented proof that the user has read, understood, and agreed to the AUP. Without such evidence, enforcing the policy in disciplinary or legal actions becomes difficult.

Answer

Inclusion of the entire ISO 27001 standard

Answer

A list of blocked websites

Answer

Detailed technical specifications of the firewall

Question 10

An organization is migrating to a hybrid cloud environment and is updating its security architecture. Which of the following is the MOST effective way to ensure consistent security policy enforcement across both on-premises and cloud environments?

Accepted Answer

Implementing a unified security policy framework across all environments.. Implementing a unified security policy framework ensures that security requirements are standardized and consistently applied regardless of the underlying infrastructure. This approach reduces complexity and human error in policy management.

Answer

Managing separate security policies for on-premises and cloud environments.

Answer

Prioritizing the security of on-premises assets over cloud assets.

Answer

Allowing individual departments to define their own security policies.

Question 11

Which document is the primary source for defining the 'Risk Appetite' of an enterprise?

Accepted Answer

Risk Appetite Statement. The Risk Appetite Statement is the foundational document authorized by the board/senior management.

Answer

Security Policy

Answer

Business Impact Analysis

Answer

Incident Response Plan

Question 12

Your organization has decided to use a 'Cloud Disaster Recovery' service. The vendor provides a 'Pilot Light' strategy. What does this mean for your organization's recovery capability?

Accepted Answer

Core services are running, and the remaining infrastructure can be scaled up on demand.. A pilot light maintains critical core components (e.g., database) in a running state, while application tiers are spun up on-demand during a disaster.

Answer

A complete replica of the production environment is running 24/7.

Answer

The environment only exists as data snapshots in cold storage.

Answer

The environment is hosted on-premises and fails over to a secondary data center.

Question 13

A project manager wants to bypass a security vulnerability finding because 'the patch will break the application'. What is the correct ISSMP response?

Accepted Answer

Document a formal Risk Acceptance with the business owner.. The ISSMP must initiate a formal Risk Acceptance process, requiring the business owner to acknowledge the residual risk and documenting it in the risk register.

Answer

Rewrite the application code personally.

Answer

Ignore the finding as it is non-critical.

Answer

Force the patch regardless of impact.

Question 14

When presenting a security budget request to the Board of Directors, which THREE of the following elements should be included to ensure the request is compelling and understood?

Accepted Answer

A comprehensive analysis of the return on investment (ROI) or risk-reduction value.. Board members prioritize risk-based arguments over technical jargon. They need to understand the impact on business outcomes, the current risk level, and the return on investment (or cost of inaction).

Answer

A summary of the latest cybersecurity job market trends.

Answer

Detailed list of every firewall rule and server configuration.

Question 15

An ISSMP is reviewing the 'Change Control' process for a critical system. Which of the following is an essential element for every change request?

Accepted Answer

A detailed backout/rollback plan.. A detailed backout/rollback plan is essential for every change request because it defines how to revert the change if it causes an outage, degradation, or unexpected side effects. Change control boards require it to assess risk and ensure the organization can restore service within acceptable recovery objectives.

Answer

The marketing department's approval.

Answer

A list of all software installed on the server.

Answer

A complete list of developer names.

Question 16

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

Accepted Answer

The vendor's secure software development lifecycle (SSDLC) practices. Vendor financial stability and their own security development lifecycle (SDL) are paramount for long-term supply chain risk.

Answer

The physical location of their headquarters

Answer

The number of employees at the vendor

Answer

The vendor's marketing budget

Question 17

When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?

Accepted Answer

Threat Modeling. Threat modeling during the design phase identifies architectural risks before code is written.

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Penetration Testing

Question 18

Which THREE of the following should be included in an annual strategic security plan?

Accepted Answer

Current state assessment of security maturity. A strategic plan must look at current maturity, future initiatives (projects), and the resources required to achieve those goals.

Answer

A detailed list of every firewall rule

Answer

A list of all employee salaries

Question 19

An ISSMP is leading a strategic security planning initiative using the balanced scorecard approach. Which perspective should be used to track metrics related to the workforce's proficiency and security awareness training success?

Accepted Answer

Learning and Growth. In the balanced scorecard framework, the 'Learning and Growth' perspective focuses on the human capital, infrastructure, and culture necessary to achieve the organization's security goals.

Answer

Financial

Answer

Customer

Answer

Internal Business Processes

Question 20

An ISSMP is evaluating a Cloud Access Security Broker (CASB) implementation. Which management goal is most effectively addressed by this tool?

Accepted Answer

Enforcing security policies for cloud application usage. A CASB provides visibility and control over cloud usage, enabling the enforcement of corporate security policies on data stored or accessed in cloud applications.

Answer

Automating the patching of local workstations

Answer

Managing user access to local databases

Answer

Securing the physical data center