ISC Practice Test 7 — 10 Questions

Question 1

Your organization is evaluating the procurement of a new SaaS platform. As the ISSMP, you are responsible for integrating security into the vendor risk management process. Which action is most critical during the 'Due Diligence' phase?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reviewing the vendor's SOC 2 Type II report for documented control effectiveness. During due diligence, the most critical action is to assess the vendor's security posture through independent audits. A SOC 2 Type II report provides detailed evidence of the effectiveness of controls over a period, making it a key artifact for evaluating vendor risk. It covers security, availability, processing integrity, confidentiality, and privacy, aligning with the need to integrate security into vendor management.

Answer

Requesting the vendor's penetration test results from five years ago

Answer

Verifying the vendor's office location and physical building security

Answer

Ensuring the vendor signs a standard non-disclosure agreement

Question 2

A CISO needs to justify an increase in the security budget. Which argument is most persuasive to the Chief Financial Officer (CFO)?

Accepted Answer

Quantifying financial exposure from potential security events. Quantifying the cost of potential data breaches in terms of lost revenue and regulatory fines demonstrates the financial risk the CFO is helping to manage.

Answer

Comparing the budget to industry peers

Answer

Focusing on the technical features of a new tool

Answer

Listing the latest security threats in the industry

Question 3

Which of the following is a key component of a successful security awareness training program?

Accepted Answer

Regular, engaging, and relevant content. Regular, relevant, and engaging content is necessary to keep security top-of-mind for employees and to ensure long-term retention of good security practices.

Answer

Focusing only on threats to external users

Answer

Using outdated training videos to save costs

Answer

Mandating attendance once every five years

Question 4

During a BCP planning session, the executive team is debating the 'Maximum Tolerable Downtime' (MTD) for a legacy internal application. What is the correct way to define this metric?

Accepted Answer

The total duration of time that an organization can tolerate a business process being unavailable.. MTD is the total time a process can be down before the organization suffers catastrophic/irreversible harm.

Answer

The maximum acceptable age of data in the event of a system crash.

Answer

The time taken to fail over to the secondary site during a disaster.

Answer

The time required to restore the application from the latest tape backup.

Question 5

Which TWO of the following are effective ways to improve 'Crisis Management Leadership' effectiveness during an incident?

Accepted Answer

Ensuring a dedicated communications officer manages stakeholder messaging.. Leadership requires clear delegation and effective, structured communication to prevent panic and ensure well-informed decisions.

Answer

Removing all documentation to force teams to think creatively.

Answer

Ignoring external media requests to focus only on technical repair.

Answer

Requiring all employees to attend weekly disaster drills.

Question 6

What is the primary objective of a Business Impact Analysis (BIA)?

Accepted Answer

To determine the impact of disruptions on business operations. The BIA identifies critical business processes and the impact of their disruption, which informs the BCP/DR plan.

Answer

To calculate the cost of a data breach

Answer

To identify all system vulnerabilities

Answer

To configure firewalls for recovery

Question 7

Which THREE of the following are important considerations for an ISSMP when outsourcing security functions?

Accepted Answer

Retaining the ultimate accountability for security. Outsourcing requires careful legal review, performance monitoring (SLAs), and ensuring that the provider is properly integrated into the organization's overall risk management.

Answer

Requiring the vendor to use only your internal tools

Answer

Choosing the vendor with the lowest price

Question 8

A CISO is presenting a security program roadmap. Which approach is best for managing expectations regarding security maturity?

Accepted Answer

Defining security maturity as a set of phased milestones. Providing a phased implementation plan with measurable milestones allows the CISO to demonstrate progress while acknowledging that maturity is a journey.

Answer

Linking maturity to the total security budget

Answer

Promising 100% security coverage by the end of the year

Answer

Focusing only on the latest security technologies

Question 9

What is the primary objective of a 'lessons learned' meeting conducted after a disaster recovery exercise?

Accepted Answer

Identify gaps in the plan and define remediation actions.. The objective is to identify gaps in the plan based on the exercise results and assign ownership for remediation.

Answer

Update the organizational chart.

Answer

Verify the status of the offsite backup tapes.

Answer

Evaluate the performance of the IT staff for disciplinary purposes.

Question 10

During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?

Accepted Answer

Interviews with business process owners.. The BIA requires both understanding of the process importance and the technical dependencies (what systems are actually used).

Answer

Current data center power consumption logs.

Answer

The organization's current IT procurement strategy.

Answer

Employee performance review records.