ISC Practice Test 3 — 30 Questions

Question 1

An organization wants to improve its security posture against supply chain attacks. Which action is most effective for an ISSMP?

Accepted Answer

Implementing a third-party risk management program. Implementing a third-party risk management (TPRM) program that assesses vendors' security practices is the best way to address risks introduced by the supply chain.

Answer

Outsourcing all IT functions to a single large provider

Answer

Replacing all proprietary software with open-source

Answer

Increasing internal network segmentation

Question 2

Which THREE configurations are necessary to satisfy the 'Technical Safeguards' requirement under HIPAA for data at rest?

Accepted Answer

Encryption of all storage volumes containing ePHI. HIPAA requires encryption and access control to protect ePHI at rest.

Answer

Physical fencing around the data center

Answer

Annual financial budget reporting

Question 3

An ISSMP needs to ensure compliance with global data privacy regulations in a multinational environment. Which governance strategy provides the most consistent approach?

Accepted Answer

Adopting the strictest regulatory standard as the global baseline. Implementing a global privacy framework that defaults to the strictest common denominator ensures compliance across all jurisdictions, simplifying operational management.

Answer

Excluding high-risk regions from business operations

Answer

Maintaining separate policies for every country

Answer

Relying on legal counsel to interpret local laws for every access request

Question 4

The board of directors requests a quantitative risk assessment for a new cloud-based initiative. Which metric provides the best representation of potential financial exposure to the organization for a single, significant security event?

Accepted Answer

Single Loss Expectancy (SLE). Single Loss Expectancy (SLE) is the monetary loss expected from a single security incident, making it the most direct metric for board-level financial exposure discussions.

Answer

Residual Risk

Answer

Annualized Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)

Question 5

When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?

Accepted Answer

Threat Modeling. Threat modeling during the design phase identifies architectural risks before code is written.

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Penetration Testing

Question 6

An organization is adopting a Zero Trust Architecture (ZTA). Which management principle is critical for the long-term success of this transition?

Accepted Answer

Continuous monitoring and verification. Continuous monitoring and verification are the fundamental principles of ZTA; without them, the architecture cannot adapt to changing threat landscapes.

Answer

Centralized static access lists

Answer

Automated patch management only

Answer

Strict perimeter-based defense

Question 7

Which of the following is the most important factor in the success of a security governance program?

Accepted Answer

Executive leadership support and commitment. Executive leadership support is the foundation upon which the security program is built; without it, policies lack authority and resources remain scarce.

Answer

The complexity of the security technology

Answer

The number of security staff members

Answer

The frequency of internal audits

Question 8

An organization wants to improve its security posture by adopting a continuous monitoring approach. Which approach is most effective for an ISSMP to champion?

Accepted Answer

Implementing integrated security telemetry and automated analysis.. Continuous monitoring requires integrated data collection, automated analysis, and real-time reporting to provide actionable insights, which is the definition of a robust monitoring strategy.

Answer

Relying on manual logs review on a monthly basis.

Answer

Implementing a firewall with default deny rules.

Answer

Conducting annual penetration tests.

Question 9

Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?

Accepted Answer

Commitment that the processor only processes data on documented instructions. GDPR Article 28 lists mandatory items for DPAs, including security obligations and rights of the data subject.

Answer

Marketing agreements for joint promotions

Answer

The price list for cloud services

Question 10

An ISSMP is implementing a Disaster Recovery (DR) plan. Which objective is most important to define with business leaders?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business service, which drives the design of the recovery infrastructure.

Answer

The total cost of the recovery site

Answer

The physical address of the secondary site

Answer

The names of the IT staff members

Question 11

Which TWO of the following are core components of a business-aligned security strategy?

Accepted Answer

Prioritization of security investments based on business impact. Alignment requires understanding the business's current state and risk profile, and ensuring that security projects are prioritized to support the most important business functions.

Answer

A requirement for all employees to have PhDs

Answer

A complete list of every software vulnerability in the firm

Answer

A mandate that all security tools must be from one vendor

Question 12

Which document is the primary source for defining the 'Risk Appetite' of an enterprise?

Accepted Answer

Risk Appetite Statement. The Risk Appetite Statement is the foundational document authorized by the board/senior management.

Answer

Security Policy

Answer

Business Impact Analysis

Answer

Incident Response Plan

Question 13

Which TWO of the following are primary components of a formal Risk Management policy?

Accepted Answer

Clear identification of roles and responsibilities. A risk management policy must define roles/responsibilities and the risk appetite/tolerance.

Answer

Detailed technical firewall configuration steps

Answer

The specific hardware vendors approved for purchase

Answer

The yearly budget for the IT department

Question 14

When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?

Accepted Answer

Device patch management capabilities. IoT devices often have poor security (patching challenges), high network exposure, and physical access vulnerabilities.

Answer

The manufacturer's stock price history

Answer

The aesthetic design of the device

Question 15

In an incident response plan, which metric is most useful for measuring the 'dwell time' of a threat actor?

Accepted Answer

Mean Time to Detect (MTTD). Dwell time is the period between the initial compromise and the time the organization detects the breach.

Answer

Mean Time to Acknowledge (MTTA)

Answer

Mean Time to Recovery (MTTR)

Answer

Mean Time to Contain (MTTC)

Question 16

In VMware Carbon Black Cloud, which feature should be enabled to block unauthorized scripts while allowing signed binaries from trusted software vendors?

Accepted Answer

Advanced Threat Prevention (ATP). The 'Advanced Threat Prevention' policies allow for specific exclusion and blocking rules based on file reputation and signing certificates.

Answer

Watchlists

Answer

Policy Bypass

Answer

Live Query

Question 17

Which TWO of the following are essential components of an effective security governance framework?

Accepted Answer

Clearly defined roles, responsibilities, and accountability. A comprehensive framework needs defined policies (what) and a structure of accountability (who) to ensure execution.

Answer

The latest artificial intelligence tools

Answer

A dedicated office space for the security team

Answer

A large annual security budget

Question 18

Which TWO of the following are effective communication strategies for a CISO interacting with senior executives?

Accepted Answer

Focusing on the business impact of security risks. Executives need concise, business-focused information that allows them to make informed decisions about risk and resource allocation.

Answer

Providing hour-long technical deep dives on every vulnerability

Answer

Using complex, obscure security acronyms

Answer

Writing 50-page reports for every meeting

Question 19

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

Accepted Answer

Percentage of assets with missing security patches. A leading indicator predicts future risk, whereas a lagging indicator reports past occurrences.

Answer

Total cost of a data breach

Answer

Number of systems compromised

Answer

Number of security incidents in the last month

Question 20

An organization is moving from a reactive security posture to a proactive threat-informed defense. As the ISSMP, you are implementing the MITRE ATT&CK framework. Which executive-level metric best demonstrates the maturity of the security program to the Board of Directors regarding this transition?

Accepted Answer

Percentage of MITRE ATT&CK techniques covered by existing controls. Mapping security coverage to MITRE ATT&CK techniques provides a quantifiable measure of defensive maturity that boards can understand, representing the shift from reactive compliance to proactive threat management.

Answer

Time to remediate critical security incidents

Answer

Number of phishing emails blocked by the email gateway

Answer

Total number of vulnerabilities patched per month