ISC Practice Test 6 — 10 Questions

Question 1

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

Accepted Answer

Pod Security Admission policies. Pod Security Admissions (formerly Pod Security Policies) can explicitly forbid privileged containers to maintain security benchmarks.

Answer

Cluster Autoscaler settings

Answer

Namespace resource quotas

Answer

Kube-proxy configuration

Question 2

When transitioning to an Agile development methodology, which security management approach best supports the 'Shift Left' security strategy?

Accepted Answer

Integrating automated security testing in the CI/CD pipeline. Integrating security activities (like threat modeling) into the design and development phases ensures vulnerabilities are identified and mitigated earlier in the lifecycle.

Answer

Performing security audits only after deployment

Answer

Requiring manual sign-off for every code commit

Answer

Limiting access to the development environment

Question 3

A CISO is managing a security budget with high pressure for cost optimization. Which strategy provides the best balance between security and cost efficiency?

Accepted Answer

Implementing risk-based resource allocation. Risk-based resource allocation allows the security team to prioritize investments on the highest-impact threats, ensuring maximum ROI on security spending.

Answer

Delaying all security projects by 12 months

Answer

Reducing headcount in security operations

Answer

Switching to only open-source security tools

Question 4

When presenting a security budget request to the Board of Directors, which THREE of the following elements should be included to ensure the request is compelling and understood?

Accepted Answer

A comprehensive analysis of the return on investment (ROI) or risk-reduction value.. Board members prioritize risk-based arguments over technical jargon. They need to understand the impact on business outcomes, the current risk level, and the return on investment (or cost of inaction).

Answer

A summary of the latest cybersecurity job market trends.

Answer

Detailed list of every firewall rule and server configuration.

Question 5

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

Accepted Answer

User-accessible consent management portals. Privacy by design requires technical controls, governance, and user rights management.

Answer

Public internet routing policies

Answer

Hardware security module (HSM) deployment

Question 6

Which of the following is a 'Key Risk Indicator' (KRI) for an organization's email security program?

Accepted Answer

Phishing simulation failure rate. A KRI provides an early signal of increasing risk exposure. Phishing click-through rates measure effectiveness and exposure.

Answer

Total number of employees

Answer

Cost of the email license

Answer

Number of emails received

Question 7

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

Accepted Answer

Govern. The 'Govern' function was elevated in CSF 2.0 to encompass enterprise risk management, strategy, and policy.

Answer

Protect

Answer

Respond

Answer

Recover

Answer

Identify

Question 8

When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?

Accepted Answer

Playbook. The XSOAR 'Playbook' engine manages the logic flow and script execution across various integrated products.

Answer

Classifier

Answer

Integration Instance

Answer

Indicator Field

Question 9

Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?

Accepted Answer

Technique. The 'Technique' ID is the core component that describes the 'how' of an adversary's action.

Answer

Tactic

Answer

Platform

Answer

Group

Question 10

Which document establishes the high-level security objectives and the roles/responsibilities of senior management within an organization?

Accepted Answer

Security Charter. The Security Charter or Security Governance Framework outlines the scope, mandate, and leadership roles required to oversee the security program.

Answer

Standard Operating Procedure (SOP)

Answer

Acceptable Use Policy (AUP)

Answer

Incident Response Plan