ISC Practice Test 9 — 10 Questions

Question 1

An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

sourceIPAddress. The 'sourceIPAddress' field in the CloudTrail log entry directly identifies the client IP that made the API request.

Answer

recipientAccountId

Answer

requestParameters

Answer

userIdentity.arn

Question 2

Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?

Accepted Answer

Determine the effectiveness of controls. In NIST SP 800-37, 'Assess' involves evaluating the controls to determine if they are implemented correctly and effective.

Answer

Authorize the system

Answer

Define the boundary

Answer

Select controls

Question 3

Which TWO methods are commonly used to identify new risks in an enterprise environment?

Accepted Answer

Threat intelligence feeds. Risk identification is often driven by systematic reviews (audits/assessments) and data-driven analysis (threat intelligence).

Answer

The annual holiday party schedule

Answer

Automated server patching

Answer

Purchasing more hardware

Question 4

An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?

Accepted Answer

Implement a multi-cloud strategy. Multi-cloud or hybrid-cloud strategies are the primary methods to reduce concentration risk (dependence on a single provider).

Answer

Move all data to a private data center

Answer

Enable two-factor authentication

Answer

Increase the number of security analysts

Question 5

Which THREE types of data should be ingested by a SIEM to improve its threat detection capabilities?

Accepted Answer

Authentication/Identity logs. A robust SIEM needs endpoint logs, network logs, and identity/access logs to correlate threats.

Answer

Building HVAC monitoring logs

Answer

Office breakroom temperature logs

Question 6

Which THREE items are typically verified in a Security Gate check before a production deployment?

Accepted Answer

Formal change request approval is documented. Production gates check for vulnerability remediation, passing functional/security tests, and the presence of required documentation (like the change request).

Answer

The marketing campaign has been approved

Answer

The developer has finished their vacation

Question 7

An ISSMP is performing a security assessment on an application using containerized microservices. The team uses Kubernetes. What is the most effective way to ensure security configurations are consistently applied across all clusters?

Accepted Answer

Kubernetes Admission Controllers. Kubernetes Admission Controllers intercept requests to the API server before persistence, allowing enforcement of security policies such as pod security standards, resource limits, and image provenance. They ensure consistent application of configurations across all clusters by validating or mutating resources at creation time.

Answer

Regular penetration testing

Answer

Manual code review of Dockerfiles

Answer

Role-Based Access Control (RBAC) only

Question 8

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

Accepted Answer

Microsoft Purview DLP policies. Data Loss Prevention (DLP) policies in Microsoft 365 can be configured to detect PHI patterns and block or encrypt emails accordingly.

Answer

Exchange Online Protection (EOP) malware filtering

Answer

Microsoft Defender for Endpoint

Answer

Retention labels in the Compliance Center

Question 9

Which SOC metric is most appropriate to present to executive leadership to demonstrate the business value of security investments?

Accepted Answer

Reduction in Mean Time to Remediate (MTTR). MTTR reduction directly reflects how quickly the SOC detects, responds to, and resolves incidents — a business-relevant outcome that executives can tie to reduced breach impact and operational resilience. It translates technical security work into a measurable improvement in risk exposure over time.

Answer

Total number of firewall rules

Answer

Disk space usage of the SIEM

Answer

Number of dropped packets per day

Question 10

An organization is moving from a reactive security posture to a proactive threat-informed defense. As the ISSMP, you are implementing the MITRE ATT&CK framework. Which executive-level metric best demonstrates the maturity of the security program to the Board of Directors regarding this transition?

Accepted Answer

Percentage of MITRE ATT&CK techniques covered by existing controls. Mapping security coverage to MITRE ATT&CK techniques provides a quantifiable measure of defensive maturity that boards can understand, representing the shift from reactive compliance to proactive threat management.

Answer

Time to remediate critical security incidents

Answer

Number of phishing emails blocked by the email gateway

Answer

Total number of vulnerabilities patched per month