ISC Practice Test 4 — 10 Questions

Question 1

Which of the following is a key component of a successful security awareness training program?

Accepted Answer

Regular, engaging, and relevant content. Regular, relevant, and engaging content is necessary to keep security top-of-mind for employees and to ensure long-term retention of good security practices.

Answer

Focusing only on threats to external users

Answer

Using outdated training videos to save costs

Answer

Mandating attendance once every five years

Question 2

Which TWO of the following are metrics that provide insight into the effectiveness of security leadership?

Accepted Answer

Trend in risk reduction over time. Leadership effectiveness is best measured by the organization's ability to minimize risk over time and the efficiency with which resources are converted into security posture improvements.

Answer

Number of firewall blocks per second

Answer

The color of the security team's uniforms

Answer

The number of security certifications held by the CISO

Question 3

As an ISSMP, you are defining the organizational security culture. Which activity is the most effective way to demonstrate executive commitment to security?

Accepted Answer

Actively chairing the cross-functional Security Steering Committee. The tone at the top is the most significant factor in shaping security culture. Direct executive participation in security steering committees signals that security is a business priority.

Answer

Sending an automated email newsletter regarding password policies

Answer

Appointing a dedicated Security Awareness Officer

Answer

Increasing the budget for the security operations center

Question 4

When establishing a security governance framework, what is the most critical element for ensuring long-term program success?

Accepted Answer

Securing ongoing executive sponsorship and clear accountability.. Executive sponsorship and clear accountability are the pillars of effective governance; without them, policies and frameworks lack the authority and resources needed for implementation.

Answer

Ensuring the framework is fully automated.

Answer

Outsourcing security oversight to a third-party audit firm.

Answer

Selecting the most robust technical security tools available.

Question 5

You are implementing a disaster recovery strategy for a database that uses synchronous replication. What is the most significant trade-off you must accept by enforcing this configuration?

Accepted Answer

Increased latency for write operations.. Synchronous replication guarantees zero data loss (RPO=0) but introduces latency overhead on write operations because the commit must wait for the acknowledgment from the secondary site.

Answer

Higher risk of data corruption.

Answer

Increased probability of backup failure.

Answer

Limited scalability of the database cluster.

Question 6

During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?

Accepted Answer

Interviews with business process owners.. The BIA requires both understanding of the process importance and the technical dependencies (what systems are actually used).

Answer

Current data center power consumption logs.

Answer

The organization's current IT procurement strategy.

Answer

Employee performance review records.

Question 7

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

Accepted Answer

Vertex AI Explainable AI (XAI). Vertex AI Explainable AI provides insights into how models make predictions, satisfying transparency requirements.

Answer

Vertex AI Model Monitoring

Answer

Vertex AI Feature Store

Answer

Vertex AI Pipelines

Question 8

An organization is expanding into a new region. What is the most important first step for the ISSMP?

Accepted Answer

Conducting a regulatory and legal gap analysis. Conducting a regulatory and legal gap analysis ensures that the organization understands the compliance requirements of the new jurisdiction before initiating operations.

Answer

Updating the corporate security policy

Answer

Deploying security monitoring tools

Answer

Hiring a local security manager

Question 9

An ISSMP is evaluating a Cloud Access Security Broker (CASB) implementation. Which management goal is most effectively addressed by this tool?

Accepted Answer

Enforcing security policies for cloud application usage. A CASB provides visibility and control over cloud usage, enabling the enforcement of corporate security policies on data stored or accessed in cloud applications.

Answer

Automating the patching of local workstations

Answer

Managing user access to local databases

Answer

Securing the physical data center

Question 10

A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?

Accepted Answer

Require Multi-Factor Authentication. Requiring MFA and device compliance is the core component of explicit verification in Zero Trust.

Answer

Require Password Change

Answer

Enable Identity Protection alerts

Answer

Disable legacy authentication