ISC Practice Questions 2 — 50 Questions

Question 1

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

Accepted Answer

Pod Security Admission policies. Pod Security Admissions (formerly Pod Security Policies) can explicitly forbid privileged containers to maintain security benchmarks.

Answer

Cluster Autoscaler settings

Answer

Namespace resource quotas

Answer

Kube-proxy configuration

Question 2

When transitioning to an Agile development methodology, which security management approach best supports the 'Shift Left' security strategy?

Accepted Answer

Integrating automated security testing in the CI/CD pipeline. Integrating security activities (like threat modeling) into the design and development phases ensures vulnerabilities are identified and mitigated earlier in the lifecycle.

Answer

Performing security audits only after deployment

Answer

Requiring manual sign-off for every code commit

Answer

Limiting access to the development environment

Question 3

A CISO is managing a security budget with high pressure for cost optimization. Which strategy provides the best balance between security and cost efficiency?

Accepted Answer

Implementing risk-based resource allocation. Risk-based resource allocation allows the security team to prioritize investments on the highest-impact threats, ensuring maximum ROI on security spending.

Answer

Delaying all security projects by 12 months

Answer

Reducing headcount in security operations

Answer

Switching to only open-source security tools

Question 4

When presenting a security budget request to the Board of Directors, which THREE of the following elements should be included to ensure the request is compelling and understood?

Accepted Answer

A comprehensive analysis of the return on investment (ROI) or risk-reduction value.. Board members prioritize risk-based arguments over technical jargon. They need to understand the impact on business outcomes, the current risk level, and the return on investment (or cost of inaction).

Answer

A summary of the latest cybersecurity job market trends.

Answer

Detailed list of every firewall rule and server configuration.

Question 5

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

Accepted Answer

User-accessible consent management portals. Privacy by design requires technical controls, governance, and user rights management.

Answer

Public internet routing policies

Answer

Hardware security module (HSM) deployment

Question 6

Which of the following is a 'Key Risk Indicator' (KRI) for an organization's email security program?

Accepted Answer

Phishing simulation failure rate. A KRI provides an early signal of increasing risk exposure. Phishing click-through rates measure effectiveness and exposure.

Answer

Total number of employees

Answer

Cost of the email license

Answer

Number of emails received

Question 7

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

Accepted Answer

Govern. The 'Govern' function was elevated in CSF 2.0 to encompass enterprise risk management, strategy, and policy.

Answer

Protect

Answer

Respond

Answer

Recover

Answer

Identify

Question 8

When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?

Accepted Answer

Playbook. The XSOAR 'Playbook' engine manages the logic flow and script execution across various integrated products.

Answer

Classifier

Answer

Integration Instance

Answer

Indicator Field

Question 9

Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?

Accepted Answer

Technique. The 'Technique' ID is the core component that describes the 'how' of an adversary's action.

Answer

Tactic

Answer

Platform

Answer

Group

Question 10

Which document establishes the high-level security objectives and the roles/responsibilities of senior management within an organization?

Accepted Answer

Security Charter. The Security Charter or Security Governance Framework outlines the scope, mandate, and leadership roles required to oversee the security program.

Answer

Standard Operating Procedure (SOP)

Answer

Acceptable Use Policy (AUP)

Answer

Incident Response Plan

Question 11

An organization wants to improve its security posture against supply chain attacks. Which action is most effective for an ISSMP?

Accepted Answer

Implementing a third-party risk management program. Implementing a third-party risk management (TPRM) program that assesses vendors' security practices is the best way to address risks introduced by the supply chain.

Answer

Outsourcing all IT functions to a single large provider

Answer

Replacing all proprietary software with open-source

Answer

Increasing internal network segmentation

Question 12

Which THREE configurations are necessary to satisfy the 'Technical Safeguards' requirement under HIPAA for data at rest?

Accepted Answer

Encryption of all storage volumes containing ePHI. HIPAA requires encryption and access control to protect ePHI at rest.

Answer

Physical fencing around the data center

Answer

Annual financial budget reporting

Question 13

An ISSMP needs to ensure compliance with global data privacy regulations in a multinational environment. Which governance strategy provides the most consistent approach?

Accepted Answer

Adopting the strictest regulatory standard as the global baseline. Implementing a global privacy framework that defaults to the strictest common denominator ensures compliance across all jurisdictions, simplifying operational management.

Answer

Excluding high-risk regions from business operations

Answer

Maintaining separate policies for every country

Answer

Relying on legal counsel to interpret local laws for every access request

Question 14

The board of directors requests a quantitative risk assessment for a new cloud-based initiative. Which metric provides the best representation of potential financial exposure to the organization for a single, significant security event?

Accepted Answer

Single Loss Expectancy (SLE). Single Loss Expectancy (SLE) is the monetary loss expected from a single security incident, making it the most direct metric for board-level financial exposure discussions.

Answer

Residual Risk

Answer

Annualized Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)

Question 15

When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?

Accepted Answer

Threat Modeling. Threat modeling during the design phase identifies architectural risks before code is written.

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Penetration Testing

Question 16

An organization is adopting a Zero Trust Architecture (ZTA). Which management principle is critical for the long-term success of this transition?

Accepted Answer

Continuous monitoring and verification. Continuous monitoring and verification are the fundamental principles of ZTA; without them, the architecture cannot adapt to changing threat landscapes.

Answer

Centralized static access lists

Answer

Automated patch management only

Answer

Strict perimeter-based defense

Question 17

Which of the following is the most important factor in the success of a security governance program?

Accepted Answer

Executive leadership support and commitment. Executive leadership support is the foundation upon which the security program is built; without it, policies lack authority and resources remain scarce.

Answer

The complexity of the security technology

Answer

The number of security staff members

Answer

The frequency of internal audits

Question 18

An organization wants to improve its security posture by adopting a continuous monitoring approach. Which approach is most effective for an ISSMP to champion?

Accepted Answer

Implementing integrated security telemetry and automated analysis.. Continuous monitoring requires integrated data collection, automated analysis, and real-time reporting to provide actionable insights, which is the definition of a robust monitoring strategy.

Answer

Relying on manual logs review on a monthly basis.

Answer

Implementing a firewall with default deny rules.

Answer

Conducting annual penetration tests.

Question 19

Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?

Accepted Answer

Commitment that the processor only processes data on documented instructions. GDPR Article 28 lists mandatory items for DPAs, including security obligations and rights of the data subject.

Answer

Marketing agreements for joint promotions

Answer

The price list for cloud services

Question 20

An ISSMP is implementing a Disaster Recovery (DR) plan. Which objective is most important to define with business leaders?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business service, which drives the design of the recovery infrastructure.

Answer

The total cost of the recovery site

Answer

The physical address of the secondary site

Answer

The names of the IT staff members