ISC Practice Test 5 — 10 Questions

Question 1

Which document is the primary source for defining the 'Risk Appetite' of an enterprise?

Accepted Answer

Risk Appetite Statement. The Risk Appetite Statement is the foundational document authorized by the board/senior management.

Answer

Security Policy

Answer

Business Impact Analysis

Answer

Incident Response Plan

Question 2

Your organization has decided to use a 'Cloud Disaster Recovery' service. The vendor provides a 'Pilot Light' strategy. What does this mean for your organization's recovery capability?

Accepted Answer

Core services are running, and the remaining infrastructure can be scaled up on demand.. A pilot light maintains critical core components (e.g., database) in a running state, while application tiers are spun up on-demand during a disaster.

Answer

A complete replica of the production environment is running 24/7.

Answer

The environment only exists as data snapshots in cold storage.

Answer

The environment is hosted on-premises and fails over to a secondary data center.

Question 3

A project manager wants to bypass a security vulnerability finding because 'the patch will break the application'. What is the correct ISSMP response?

Accepted Answer

Document a formal Risk Acceptance with the business owner.. The ISSMP must initiate a formal Risk Acceptance process, requiring the business owner to acknowledge the residual risk and documenting it in the risk register.

Answer

Rewrite the application code personally.

Answer

Ignore the finding as it is non-critical.

Answer

Force the patch regardless of impact.

Question 4

When presenting a security budget request to the Board of Directors, which THREE of the following elements should be included to ensure the request is compelling and understood?

Accepted Answer

A comprehensive analysis of the return on investment (ROI) or risk-reduction value.. Board members prioritize risk-based arguments over technical jargon. They need to understand the impact on business outcomes, the current risk level, and the return on investment (or cost of inaction).

Answer

A summary of the latest cybersecurity job market trends.

Answer

Detailed list of every firewall rule and server configuration.

Question 5

An ISSMP is reviewing the 'Change Control' process for a critical system. Which of the following is an essential element for every change request?

Accepted Answer

A detailed backout/rollback plan.. A detailed backout/rollback plan is essential for every change request because it defines how to revert the change if it causes an outage, degradation, or unexpected side effects. Change control boards require it to assess risk and ensure the organization can restore service within acceptable recovery objectives.

Answer

The marketing department's approval.

Answer

A list of all software installed on the server.

Answer

A complete list of developer names.

Question 6

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

Accepted Answer

The vendor's secure software development lifecycle (SSDLC) practices. Vendor financial stability and their own security development lifecycle (SDL) are paramount for long-term supply chain risk.

Answer

The physical location of their headquarters

Answer

The number of employees at the vendor

Answer

The vendor's marketing budget

Question 7

When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?

Accepted Answer

Threat Modeling. Threat modeling during the design phase identifies architectural risks before code is written.

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Penetration Testing

Question 8

Which THREE of the following should be included in an annual strategic security plan?

Accepted Answer

Current state assessment of security maturity. A strategic plan must look at current maturity, future initiatives (projects), and the resources required to achieve those goals.

Answer

A detailed list of every firewall rule

Answer

A list of all employee salaries

Question 9

An ISSMP is leading a strategic security planning initiative using the balanced scorecard approach. Which perspective should be used to track metrics related to the workforce's proficiency and security awareness training success?

Accepted Answer

Learning and Growth. In the balanced scorecard framework, the 'Learning and Growth' perspective focuses on the human capital, infrastructure, and culture necessary to achieve the organization's security goals.

Answer

Financial

Answer

Customer

Answer

Internal Business Processes

Question 10

An ISSMP is evaluating a Cloud Access Security Broker (CASB) implementation. Which management goal is most effectively addressed by this tool?

Accepted Answer

Enforcing security policies for cloud application usage. A CASB provides visibility and control over cloud usage, enabling the enforcement of corporate security policies on data stored or accessed in cloud applications.

Answer

Automating the patching of local workstations

Answer

Managing user access to local databases

Answer

Securing the physical data center