ISC Practice Test 6 — 10 Questions

Question 1

When aligning security with organizational goals, how should an ISSMP address a conflict between security controls and user productivity?

Accepted Answer

Conduct a risk-benefit analysis for alternative controls. Conduct a risk-benefit analysis to determine if the security control is truly necessary and if alternative, less intrusive controls exist that provide the same level of protection.

Answer

Remove the security control to favor productivity

Answer

Delegate the decision to the IT support manager

Answer

Enforce the security control regardless of impact

Question 2

Which TWO of the following are critical components of a secure SDLC (Software Development Life Cycle) implementation?

Accepted Answer

Continuous Threat Modeling. Option D (Continuous Threat Modeling) is correct because a secure SDLC requires threat modeling to be an ongoing activity integrated throughout the lifecycle, not a one-time event, so that new attack surfaces and design changes are identified and mitigated as the software evolves. Option E (Automated security testing in the pipeline) is correct because embedding SAST, DAST, SCA, and similar automated checks into CI/CD pipelines enforces security gates on every build, catching vulnerabilities early and consistently rather than relying on sporadic manual review. The unmarked options do not belong: A (Manual annual security reviews) is too infrequent and reactive to be a critical component, B (Standardized desktop operating systems) is an endpoint-hardening control unrelated to the software development process, and C (Outsourcing all security to a vendor) is not a secure SDLC practice since accountability for security cannot be fully delegated and must remain with the developing organization.

Answer

Manual annual security reviews

Answer

Standardized desktop operating systems

Answer

Outsourcing all security to a vendor

Question 3

In a decentralized organization, which approach to BCP management ensures both local agility and global alignment?

Accepted Answer

A federated model with a centralized governance framework.. A federated model allows individual business units to customize plans to their specific needs while adhering to a common global framework/policy.

Answer

Leaving BCP entirely to the discretion of local department managers.

Answer

A strictly centralized command-and-control model.

Answer

Outsourcing the entire BCP function to a single managed service provider.

Question 4

Which of the following is the most important factor to consider when evaluating the effectiveness of a security training and awareness program?

Accepted Answer

Measurable improvements in employee behavior and incident reporting.. Behavioral changes, such as reduced click rates on phishing simulations and increased reporting of suspicious activities, are the best indicators of a successful security awareness program.

Answer

The total budget allocated to security awareness programs.

Answer

The frequency and quality of security awareness training sessions.

Answer

The number of employees who completed the training modules.

Question 5

When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?

Accepted Answer

Playbook. The XSOAR 'Playbook' engine manages the logic flow and script execution across various integrated products.

Answer

Classifier

Answer

Integration Instance

Answer

Indicator Field

Question 6

When managing a FortiGate firewall, which feature allows the SOC to dynamically update network objects based on external threat feeds?

Accepted Answer

External Connectors. External Connectors on a FortiGate firewall enable the SOC to dynamically update network objects (such as IP addresses, FQDNs, or MAC addresses) by pulling threat intelligence from external sources like STIX/TAXII feeds, malware databases, or cloud services. These connectors automatically synchronize with the external feed, ensuring that firewall policies and security profiles always use the latest threat data without manual intervention. This is a core feature of FortiGate's Security Fabric, allowing automated response to emerging threats.

Answer

DHCP Server

Answer

Traffic Shaper

Answer

Virtual Domains (VDOMs)

Question 7

When implementing FIM (File Integrity Monitoring) in Tripwire Enterprise, what is the specific purpose of a 'Promotion' action?

Accepted Answer

To update the baseline with the current file state. In Tripwire Enterprise, a Promotion action takes the current state of a monitored file and updates the baseline (the known-good reference) to match it. This is used after a legitimate change — such as a patch or approved configuration update — so that future changes are detected relative to the new, approved state.

Answer

To revert a file to its previous version

Answer

To deploy the file to all servers

Answer

To archive the file for legal hold

Question 8

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

Accepted Answer

Defining the compliance scope and regulatory requirements. Identification of regulatory requirements (scope) is the foundation of any compliance program.

Answer

Performing a penetration test

Answer

Auditing existing logs

Answer

Deploying security controls

Question 9

An ISSMP is managing a merger where two organizations use different identity providers. Which strategy best mitigates identity-related risk during the integration phase?

Accepted Answer

Implementing a federated identity solution. Establishing a federated identity model allows for centralized management and consistent access control policies across both entities without forcing an immediate migration.

Answer

Granting domain administrative rights to both IT teams

Answer

Migrating all users to a new identity provider immediately

Answer

Creating duplicate user accounts for all employees

Question 10

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

Accepted Answer

Vertex AI Explainable AI (XAI). Vertex AI Explainable AI provides insights into how models make predictions, satisfying transparency requirements.

Answer

Vertex AI Model Monitoring

Answer

Vertex AI Feature Store

Answer

Vertex AI Pipelines