ISC Practice Test 5 — 10 Questions

Question 1

You are performing a qualitative risk assessment. Which factor must be prioritized to ensure the assessment is aligned with the organizational risk appetite?

Accepted Answer

The business impact of asset unavailability. The risk appetite, defined by leadership, dictates the tolerance for deviations from security standards.

Answer

The vendor's recommended patch cycle

Answer

The threat actor's motivation

Answer

The technical complexity of the vulnerability

Question 2

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?

Accepted Answer

Revoke sessions. The 'Revoke sessions' action in the Entra ID user blade forces the user to re-authenticate and clears all current refresh tokens.

Answer

Disable the user account

Answer

Remove assigned licenses

Answer

Reset the password

Question 3

When managing a security incident, what is the primary role of the CISO in a large enterprise?

Accepted Answer

Ensuring communication and strategic coordination. The CISO should focus on strategic decision-making, stakeholder communication, and resource management, leaving the tactical investigation to the incident response team.

Answer

Updating firewall rules manually

Answer

Performing forensic analysis on the compromised server

Answer

Drafting the initial incident response report

Question 4

Which THREE of the following are common indicators that a security program is failing to align with business objectives?

Accepted Answer

Increase in unauthorized technology use (Shadow IT). Lack of executive support, high levels of friction, and shadow IT are all strong indicators of a disconnect between security strategy and business goals.

Answer

Security budget is lower than the IT budget

Answer

The security team is located in the basement

Question 5

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

Accepted Answer

Defining the compliance scope and regulatory requirements. Identification of regulatory requirements (scope) is the foundation of any compliance program.

Answer

Performing a penetration test

Answer

Auditing existing logs

Answer

Deploying security controls

Question 6

In an environment governed by SOX (Sarbanes-Oxley), which feature of AWS IAM must be utilized to maintain strict 'Segregation of Duties' for account administrative tasks?

Accepted Answer

AWS IAM Roles with Service Control Policies (SCPs). IAM Policies with explicit denies or restricted permission sets (like Service Control Policies) enforce segregation of duties in AWS.

Answer

AWS CloudTrail insights

Answer

IAM User Access Keys

Answer

AWS Directory Service

Question 7

Which organizational structure is most effective for a CISO to influence security behavior across geographically dispersed and independent business units?

Accepted Answer

Matrix Management. A matrix management structure allows the CISO to exert influence through both functional and operational lines, ensuring security standards are consistent while respecting business unit autonomy.

Answer

Centralized Command and Control

Answer

Outsourced Security Operations

Answer

Decentralized/Siloed Management

Question 8

Which feature in Okta is essential for meeting compliance requirements regarding 'Identity Assurance' and 'Strong Authentication' mandated by financial regulations?

Accepted Answer

Okta Adaptive MFA. Okta's Adaptive Multi-Factor Authentication (MFA) uses risk-based policies to ensure identity assurance.

Answer

Okta Lifecycle Management

Answer

Okta Single Sign-On (SSO)

Answer

Okta Directory Integration

Question 9

When evaluating a third-party SaaS provider, which activity is most critical for assessing the vendor's security commitment?

Accepted Answer

Reviewing independent audit reports like SOC 2 Type II. Reviewing independent audit reports (such as SOC 2 Type II) provides verified evidence of the vendor's controls, which is more reliable than self-assessments.

Answer

Checking the vendor's marketing materials

Answer

Asking for the vendor's internal password policy

Answer

Verifying the vendor's office location

Question 10

What is the primary purpose of an Incident Response (IR) plan?

Accepted Answer

To provide a structured approach to incident handling. An IR plan provides a structured, predefined approach to handling security incidents to minimize impact and ensure business continuity.

Answer

To identify all vulnerabilities in the network

Answer

To punish employees who cause incidents

Answer

To replace the need for security policies