ISC Hard Questions — 25 Difficult Questions

Question 1

Which THREE of the following are important considerations for an ISSMP when outsourcing security functions?

Accepted Answer

Retaining the ultimate accountability for security. Outsourcing requires careful legal review, performance monitoring (SLAs), and ensuring that the provider is properly integrated into the organization's overall risk management.

Answer

Requiring the vendor to use only your internal tools

Answer

Choosing the vendor with the lowest price

Question 2

When designing a Disaster Recovery Program, which THREE of the following represent common 'single points of failure' that must be addressed?

Accepted Answer

Key-person dependency for initiating the disaster declaration.. Resilience requires removing dependencies on single, irreplaceable entities (people, physical locations, or specific gateway devices).

Answer

Use of standardized enterprise resource planning software.

Answer

The use of automated server patching tools.

Question 3

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

Accepted Answer

Microsoft Purview DLP policies. Data Loss Prevention (DLP) policies in Microsoft 365 can be configured to detect PHI patterns and block or encrypt emails accordingly.

Answer

Exchange Online Protection (EOP) malware filtering

Answer

Microsoft Defender for Endpoint

Answer

Retention labels in the Compliance Center

Question 4

Which THREE of the following strategies should be included in a 'Disaster Recovery Program Oversight' function to ensure long-term viability?

Accepted Answer

Annual validation of the BIA to ensure it reflects current business priorities.. Oversight involves continuous validation through testing, alignment with changing business goals, and periodic audits of the documentation.

Answer

Mandating the use of specific hardware vendors for all offices.

Answer

Standardization of server naming conventions across all data centers.

Question 5

Your organization uses a 'Hot Site' with hardware-level replication. During a disaster, the primary site becomes unavailable, but the failover fails due to a 'Split-Brain' scenario. What is the fundamental cause of this?

Accepted Answer

Loss of the heartbeat connection/quorum service.. Split-brain happens when both sites think they are the primary due to loss of the quorum or heartbeat mechanism.

Answer

Mismatched firmware versions between servers.

Answer

Inadequate storage capacity for incoming logs.

Answer

Insufficient cooling at the hot site.

Question 6

To ensure security requirements are integrated into the System Development Life Cycle (SDLC), what is the most effective approach for the security team?

Accepted Answer

Embedding security champions within development teams. Embed security champions within development teams to act as liaisons, ensuring security is considered throughout the development process rather than treated as a final check.

Answer

Requiring developers to attend annual security seminars

Answer

Automating the code deployment process

Answer

Mandating a security review before production release

Question 7

When managing a global security team, what is the primary challenge in maintaining a uniform security posture?

Accepted Answer

Cultural differences and local regulations. Cultural differences and local regulatory requirements make it difficult to enforce a single, global standard, requiring a balance between global directives and local adaptation.

Answer

Lack of global email systems

Answer

Time zone differences

Answer

Language barriers

Question 8

When establishing a security governance framework, what is the most critical element for ensuring long-term program success?

Accepted Answer

Securing ongoing executive sponsorship and clear accountability.. Executive sponsorship and clear accountability are the pillars of effective governance; without them, policies and frameworks lack the authority and resources needed for implementation.

Answer

Ensuring the framework is fully automated.

Answer

Outsourcing security oversight to a third-party audit firm.

Answer

Selecting the most robust technical security tools available.

Question 9

An ISSMP is evaluating a Cloud Access Security Broker (CASB) implementation. Which management goal is most effectively addressed by this tool?

Accepted Answer

Enforcing security policies for cloud application usage. A CASB provides visibility and control over cloud usage, enabling the enforcement of corporate security policies on data stored or accessed in cloud applications.

Answer

Automating the patching of local workstations

Answer

Managing user access to local databases

Answer

Securing the physical data center

Question 10

A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?

Accepted Answer

Require Multi-Factor Authentication. Requiring MFA and device compliance is the core component of explicit verification in Zero Trust.

Answer

Require Password Change

Answer

Enable Identity Protection alerts

Answer

Disable legacy authentication

Question 11

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?

Accepted Answer

Revoke sessions. The 'Revoke sessions' action in the Entra ID user blade forces the user to re-authenticate and clears all current refresh tokens.

Answer

Disable the user account

Answer

Remove assigned licenses

Answer

Reset the password

Question 12

Which THREE of the following are common indicators that a security program is failing to align with business objectives?

Accepted Answer

Increase in unauthorized technology use (Shadow IT). Lack of executive support, high levels of friction, and shadow IT are all strong indicators of a disconnect between security strategy and business goals.

Answer

Security budget is lower than the IT budget

Answer

The security team is located in the basement

Question 13

In an environment governed by SOX (Sarbanes-Oxley), which feature of AWS IAM must be utilized to maintain strict 'Segregation of Duties' for account administrative tasks?

Accepted Answer

AWS IAM Roles with Service Control Policies (SCPs). IAM Policies with explicit denies or restricted permission sets (like Service Control Policies) enforce segregation of duties in AWS.

Answer

AWS CloudTrail insights

Answer

IAM User Access Keys

Answer

AWS Directory Service

Question 14

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

Accepted Answer

Pod Security Admission policies. Pod Security Admissions (formerly Pod Security Policies) can explicitly forbid privileged containers to maintain security benchmarks.

Answer

Cluster Autoscaler settings

Answer

Namespace resource quotas

Answer

Kube-proxy configuration

Question 15

A CISO is managing a security budget with high pressure for cost optimization. Which strategy provides the best balance between security and cost efficiency?

Accepted Answer

Implementing risk-based resource allocation. Risk-based resource allocation allows the security team to prioritize investments on the highest-impact threats, ensuring maximum ROI on security spending.

Answer

Delaying all security projects by 12 months

Answer

Reducing headcount in security operations

Answer

Switching to only open-source security tools

Question 16

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

Accepted Answer

User-accessible consent management portals. Privacy by design requires technical controls, governance, and user rights management.

Answer

Public internet routing policies

Answer

Hardware security module (HSM) deployment

Question 17

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

Accepted Answer

Govern. The 'Govern' function was elevated in CSF 2.0 to encompass enterprise risk management, strategy, and policy.

Answer

Protect

Answer

Respond

Answer

Recover

Answer

Identify

Question 18

An organization wants to improve its security posture against supply chain attacks. Which action is most effective for an ISSMP?

Accepted Answer

Implementing a third-party risk management program. Implementing a third-party risk management (TPRM) program that assesses vendors' security practices is the best way to address risks introduced by the supply chain.

Answer

Outsourcing all IT functions to a single large provider

Answer

Replacing all proprietary software with open-source

Answer

Increasing internal network segmentation

Question 19

Which THREE configurations are necessary to satisfy the 'Technical Safeguards' requirement under HIPAA for data at rest?

Accepted Answer

Encryption of all storage volumes containing ePHI. HIPAA requires encryption and access control to protect ePHI at rest.

Answer

Physical fencing around the data center

Answer

Annual financial budget reporting

Question 20

An ISSMP needs to ensure compliance with global data privacy regulations in a multinational environment. Which governance strategy provides the most consistent approach?

Accepted Answer

Adopting the strictest regulatory standard as the global baseline. Implementing a global privacy framework that defaults to the strictest common denominator ensures compliance across all jurisdictions, simplifying operational management.

Answer

Excluding high-risk regions from business operations

Answer

Maintaining separate policies for every country

Answer

Relying on legal counsel to interpret local laws for every access request