ISC Exam Simulation — 125 Questions

Question 1

Which THREE of the following are considered 'Risk Assessment' methodologies?

Accepted Answer

NIST SP 800-30. Common risk assessment methodologies include NIST RMF, FAIR, and ISO 27005.

Answer

HTML 5.0

Answer

TCP/IP protocol

Question 2

What is the primary function of an 'Exception Process' in a risk management program?

Accepted Answer

To manage temporary deviations from security standards. An exception process allows for documented, time-bound deviations from security standards when compliance cannot be met immediately.

Answer

To bypass the change management process

Answer

To punish non-compliant employees

Answer

To permanently ignore security policies

Question 3

In the context of risk reporting, what does a 'Risk Heat Map' effectively communicate to the board?

Accepted Answer

The relative prioritization of risks across the enterprise. A Risk Heat Map plots risks on a grid of likelihood versus impact (or similar axes) with color coding, giving the board a visual, prioritized view of which risks matter most across the enterprise. It communicates relative prioritization, not raw technical detail or financial precision. This makes it an executive-level communication tool rather than an operational one.

Answer

The history of past audit findings

Answer

The exact cost of every security control

Answer

Technical vulnerability lists

Question 4

As an ISSMP, you are defining the organizational security culture. Which activity is the most effective way to demonstrate executive commitment to security?

Accepted Answer

Actively chairing the cross-functional Security Steering Committee. The tone at the top is the most significant factor in shaping security culture. Direct executive participation in security steering committees signals that security is a business priority.

Answer

Sending an automated email newsletter regarding password policies

Answer

Appointing a dedicated Security Awareness Officer

Answer

Increasing the budget for the security operations center

Question 5

When configuring a Qualys scanner to perform authenticated scans on Windows, what is the 'Windows Authentication Record' primarily used for?

Accepted Answer

To perform deep local configuration checks. A Windows Authentication Record in Qualys stores credentials (domain, username, password, or hash) that the scanner uses to log into the target host. Once authenticated, the scanner can read the registry, installed software, file permissions, and other local configuration details that are invisible to an unauthenticated scan — enabling deep local configuration checks.

Answer

To perform a packet capture

Answer

To deploy patches to the host

Answer

To bypass the local firewall

Question 6

Which TWO of the following are primary components of a formal Risk Management policy?

Accepted Answer

Clear identification of roles and responsibilities. A risk management policy must define roles/responsibilities and the risk appetite/tolerance.

Answer

Detailed technical firewall configuration steps

Answer

The specific hardware vendors approved for purchase

Answer

The yearly budget for the IT department

Question 7

Which TWO communication channels are typically used for emergency incident coordination within a SOC?

Accepted Answer

Dedicated bridge line (conference call). A dedicated bridge line (conference call) is correct because it provides a real-time, always-available voice channel that lets incident responders, management, and stakeholders coordinate synchronously during an active emergency without depending on compromised systems. Encrypted out-of-band messaging such as Signal is correct because it uses a separate, end-to-end encrypted channel outside the potentially breached corporate network, preserving confidentiality and availability if primary infrastructure is down or untrusted. Public social media feeds do not belong because they are unauthenticated, unencrypted, and publicly visible, making them unsuitable for sensitive incident coordination. Internal corporate email does not belong because it is often the compromised or monitored channel and is asynchronous, so it cannot be trusted or relied upon during an emergency. The company-wide intranet homepage does not belong because it is a one-way broadcast medium hosted on internal infrastructure that may itself be unavailable or compromised during an incident.

Answer

Public social media feeds

Answer

Internal corporate email

Answer

Company-wide intranet homepage

Question 8

When establishing a security governance framework, what is the most critical element for ensuring long-term program success?

Accepted Answer

Securing ongoing executive sponsorship and clear accountability.. Executive sponsorship and clear accountability are the pillars of effective governance; without them, policies and frameworks lack the authority and resources needed for implementation.

Answer

Ensuring the framework is fully automated.

Answer

Outsourcing security oversight to a third-party audit firm.

Answer

Selecting the most robust technical security tools available.

Question 9

When managing a global security team, what is the primary challenge in maintaining a uniform security posture?

Accepted Answer

Cultural differences and local regulations. Cultural differences and local regulatory requirements make it difficult to enforce a single, global standard, requiring a balance between global directives and local adaptation.

Answer

Lack of global email systems

Answer

Time zone differences

Answer

Language barriers

Question 10

What is the primary purpose of an Incident Response (IR) plan?

Accepted Answer

To provide a structured approach to incident handling. An IR plan provides a structured, predefined approach to handling security incidents to minimize impact and ensure business continuity.

Answer

To identify all vulnerabilities in the network

Answer

To punish employees who cause incidents

Answer

To replace the need for security policies

Question 11

During an incident, which document is used by the SOC to record evidence, timestamps, and actions taken to ensure admissibility in a legal proceeding?

Accepted Answer

Chain of Custody. The Chain of Custody document tracks the handling of evidence from discovery through to investigation.

Answer

Runbook

Answer

Lessons Learned Report

Answer

Risk Register

Question 12

A security manager at a U.S. publicly traded healthcare technology company is notified by a forensic firm that an attacker exfiltrated 40,000 patient records and also altered financial reporting data used for quarterly earnings. The security manager must decide how to sequence regulatory notifications under the HIPAA Breach Notification Rule and the SEC's material cybersecurity incident disclosure rules. Which action BEST aligns with the organization's legal and regulatory obligations?

Accepted Answer

Notify the SEC on Form 8-K within four business days of determining the incident is material, and notify affected individuals and HHS within 60 days of discovering the PHI breach.. When an incident implicates both protected health information and material financial data, HIPAA and SEC obligations run concurrently and independently. The HIPAA Breach Notification Rule requires notice to individuals without unreasonable delay and no later than 60 days after discovery, with HHS notification depending on breach size. The SEC requires Form 8-K disclosure within four business days of determining a cybersecurity incident is material. Coordinating legal, privacy, and disclosure counsel ensures neither timeline is missed.

Answer

Notify the SEC within 60 days to align with the HIPAA Breach Notification Rule timeline, consolidating both notifications into a single regulatory filing.

Answer

Notify HHS within 24 hours of discovery and delay all SEC reporting until the forensic investigation is fully complete to avoid inaccurate disclosures.

Answer

Notify affected patients first, then notify the SEC only if the Department of Health and Human Services (HHS) determines the breach is reportable under HIPAA.

Question 13

An organization wants to improve its security posture by adopting a continuous monitoring approach. Which approach is most effective for an ISSMP to champion?

Accepted Answer

Implementing integrated security telemetry and automated analysis.. Continuous monitoring requires integrated data collection, automated analysis, and real-time reporting to provide actionable insights, which is the definition of a robust monitoring strategy.

Answer

Relying on manual logs review on a monthly basis.

Answer

Implementing a firewall with default deny rules.

Answer

Conducting annual penetration tests.

Question 14

A security operations manager is designing a threat intelligence program to improve detection of advanced persistent threats (APTs). The organization wants to prioritize intelligence that is actionable and relevant. Which TWO characteristics of threat intelligence are MOST important for driving effective detection engineering? (Choose two.)

Accepted Answer

Intelligence that is mapped to the MITRE ATT&CK framework and describes adversary tactics, techniques, and procedures (TTPs).. Effective detection engineering benefits most from intelligence that describes adversary TTPs mapped to MITRE ATT&CK, and from intelligence that is timely and machine-readable for automation. TTPs provide durable behavioral context, while timeliness and structured formats ensure the intelligence can be operationalized quickly. IOCs are perishable, free sources may lack relevance, and high volume can be counterproductive.

Answer

Intelligence that includes a high volume of indicators to maximize coverage.

Answer

Intelligence that is free and sourced from open-source communities.

Answer

Intelligence that includes specific indicators of compromise (IOCs) such as file hashes and domain names.

Question 15

A security manager is drafting the organization's acceptable use policy and wants to address the ethical expectation that employees report observed security violations. Which statement best reflects a professionally recognized ethical obligation for information security practitioners?

Accepted Answer

Employees should report suspected violations through designated channels promptly and cooperate with authorized investigations. Recognized professional codes require practitioners to act honorably, protect the organization and public, and report concerns through proper channels. An acceptable use policy should therefore direct employees to report suspected violations promptly and cooperate with authorized investigations. Conditioning reports on personal risk, requiring self-verification, or encouraging direct confrontation all conflict with these ethical expectations and with sound investigative practice.

Answer

Employees should report violations only when doing so cannot harm their own performance ratings or team relationships

Answer

Employees should report violations only after independently confirming that a policy breach actually occurred

Answer

Employees should confront the suspected violator directly and attempt to resolve the matter informally before escalating

Question 16

A global manufacturing company is updating its crisis management plan. The plan must address the unique challenges of a cyber-related crisis, such as a ransomware attack that encrypts critical production systems. Which TWO of the following are the MOST important elements to include in the crisis management plan for this scenario? (Choose two.)

Accepted Answer

A communication strategy that includes pre-approved messages for internal staff, customers, and regulators.. For a ransomware crisis, the most important crisis management elements are a decision matrix for isolation and DR invocation, and a communication strategy with pre-approved messages. These address containment, recovery, and stakeholder communication. Asset inventory, vulnerability scanning, and access lists are important for prevention and recovery but are not core crisis management components.

Answer

A schedule for regular vulnerability scanning of the production network.

Answer

A list of all employees who have access to the production systems.

Answer

A detailed inventory of all hardware assets and their physical locations.

Question 17

When building an Enterprise Risk Management (ERM) program, which THREE factors must be considered to ensure integration with the organization?

Accepted Answer

Integration with existing business processes. ERM is successful when it aligns with the culture, business goals, and organizational structure.

Answer

Replacing all existing staff with security experts

Answer

Purchasing the most expensive security tool available

Question 18

During a system's operations and maintenance phase, the ISSMP learns that a critical vulnerability has been disclosed in a widely used library embedded in the application. The vendor confirms a patch is available. Which action should the ISSMP take FIRST?

Accepted Answer

Open a change request, assess the risk and patch impact, and route the change through the organization's change management process for approval and scheduling.. A vendor-supplied patch for a critical vulnerability is a change to the production environment and must be processed through change management, where impact analysis, testing, approval, and rollback planning are performed. Initiating the change request first preserves both security and availability, and the process can be expedited through an emergency change path if the risk warrants faster action. Applying the patch blindly, relying only on a compensating control, or merely logging the finding all fail to remediate the flaw properly.

Answer

Document the vulnerability in the risk register, assign it a residual risk rating, and defer remediation to the next scheduled release cycle.

Answer

Immediately apply the vendor patch directly to the production servers to eliminate the exposure as quickly as possible.

Answer

Add a compensating network control such as a virtual patching rule at the web application firewall and close the finding without patching the library.

Question 19

An organization is replacing its aging identity management system. The ISSMP must ensure that sensitive identity data from the legacy platform is handled securely during migration and that the old platform is properly retired. Which action BEST addresses the data lifecycle risk during this transition?

Accepted Answer

Define and execute a data migration and sanitization plan that classifies legacy identity data, migrates only what is required, and cryptographically erases or destroys the remainder before decommissioning the legacy platform.. Managing identity data across a platform replacement means applying the full data lifecycle: classify and minimize what is migrated, protect it in transit and at rest, and ensure the source data is irrecoverably removed before the legacy system is retired. Cryptographic erasure or physical destruction provides evidence that sensitive identity data cannot be recovered, satisfying privacy and retention requirements. Indefinite backups, ordinary file deletion, and leaving the old platform running all fail to close the lifecycle risk.

Answer

Migrate all legacy identity records to the new platform and delete the legacy database files using the operating system's standard file deletion command.

Answer

Keep the legacy identity platform running in read-only mode indefinitely so that users retain access to historical records while the new system is validated.

Answer

Perform a full backup of the legacy identity database and retain it indefinitely in the new platform's backup infrastructure in case historical records are needed.

Question 20

During a crisis simulation, the incident commander discovers that the crisis management team has no pre-agreed criteria for escalating from the operational incident response team to the executive crisis team. Decisions are being made ad hoc and communication is inconsistent. Which action best addresses this governance gap?

Accepted Answer

Define and document activation thresholds and escalation criteria in the crisis management plan, then validate them through exercises.. The simulation exposed the absence of pre-agreed escalation criteria, which caused ad hoc decisions and inconsistent communication. Documenting activation thresholds tied to impact severity, regulatory exposure, and duration, then rehearsing them, gives the organization a consistent and auditable basis for moving from operational response to executive crisis management. The other choices either remove escalation, over-activate it, or concentrate authority without addressing the missing criteria.

Answer

Assign the legal department sole authority to declare a crisis and convene the executive team.

Answer

Empower the operational incident response team to handle all incidents without executive involvement.

Answer

Require the executive crisis team to be activated for every incident regardless of severity.