ISC Practice Test 8 — 10 Questions

Question 1

When managing a security incident, what is the primary role of the CISO in a large enterprise?

Accepted Answer

Ensuring communication and strategic coordination. The CISO should focus on strategic decision-making, stakeholder communication, and resource management, leaving the tactical investigation to the incident response team.

Answer

Updating firewall rules manually

Answer

Performing forensic analysis on the compromised server

Answer

Drafting the initial incident response report

Question 2

An organization wants to improve its security posture against supply chain attacks. Which action is most effective for an ISSMP?

Accepted Answer

Implementing a third-party risk management program. Implementing a third-party risk management (TPRM) program that assesses vendors' security practices is the best way to address risks introduced by the supply chain.

Answer

Outsourcing all IT functions to a single large provider

Answer

Replacing all proprietary software with open-source

Answer

Increasing internal network segmentation

Question 3

Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?

Accepted Answer

Technique. The 'Technique' ID is the core component that describes the 'how' of an adversary's action.

Answer

Tactic

Answer

Platform

Answer

Group

Question 4

An organization is adopting a Zero Trust Architecture (ZTA). Which management principle is critical for the long-term success of this transition?

Accepted Answer

Continuous monitoring and verification. Continuous monitoring and verification are the fundamental principles of ZTA; without them, the architecture cannot adapt to changing threat landscapes.

Answer

Centralized static access lists

Answer

Automated patch management only

Answer

Strict perimeter-based defense

Question 5

Which of the following is the most important factor in the success of a security governance program?

Accepted Answer

Executive leadership support and commitment. Executive leadership support is the foundation upon which the security program is built; without it, policies lack authority and resources remain scarce.

Answer

The complexity of the security technology

Answer

The number of security staff members

Answer

The frequency of internal audits

Question 6

In an incident response plan, which metric is most useful for measuring the 'dwell time' of a threat actor?

Accepted Answer

Mean Time to Detect (MTTD). Dwell time is the period between the initial compromise and the time the organization detects the breach.

Answer

Mean Time to Acknowledge (MTTA)

Answer

Mean Time to Recovery (MTTR)

Answer

Mean Time to Contain (MTTC)

Question 7

When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?

Accepted Answer

Device patch management capabilities. IoT devices often have poor security (patching challenges), high network exposure, and physical access vulnerabilities.

Answer

The manufacturer's stock price history

Answer

The aesthetic design of the device

Question 8

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

Accepted Answer

Percentage of assets with missing security patches. A leading indicator predicts future risk, whereas a lagging indicator reports past occurrences.

Answer

Total cost of a data breach

Answer

Number of systems compromised

Answer

Number of security incidents in the last month

Question 9

An ISSMP is developing a cross-functional incident response team. Which THREE roles or functions are absolutely critical to include to ensure comprehensive handling of a major security breach?

Accepted Answer

Legal Counsel (General Counsel or Privacy Officer).. A major incident requires more than just technical response; it requires legal oversight, communication strategies, and executive decision-making capabilities.

Answer

External janitorial staff for physical security.

Answer

Internal cafeteria staff for onsite catering.

Question 10

An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?

Accepted Answer

It requires assessing risk at the resource and identity level. Zero Trust shifts the focus from network perimeters to identity and device health, requiring a more granular, asset-centric risk assessment.

Answer

It makes the risk assessment easier

Answer

It eliminates the need for risk assessment

Answer

It only impacts physical security