ISC Multiple Select — 10 Questions

Question 1

Which THREE of the following are considered 'Risk Assessment' methodologies?

Accepted Answer

NIST SP 800-30. Common risk assessment methodologies include NIST RMF, FAIR, and ISO 27005.

Answer

HTML 5.0

Answer

TCP/IP protocol

Question 2

Which TWO of the following are primary components of a formal Risk Management policy?

Accepted Answer

Clear identification of roles and responsibilities. A risk management policy must define roles/responsibilities and the risk appetite/tolerance.

Answer

Detailed technical firewall configuration steps

Answer

The specific hardware vendors approved for purchase

Answer

The yearly budget for the IT department

Question 3

Which TWO communication channels are typically used for emergency incident coordination within a SOC?

Accepted Answer

Dedicated bridge line (conference call). A dedicated bridge line (conference call) is correct because it provides a real-time, always-available voice channel that lets incident responders, management, and stakeholders coordinate synchronously during an active emergency without depending on compromised systems. Encrypted out-of-band messaging such as Signal is correct because it uses a separate, end-to-end encrypted channel outside the potentially breached corporate network, preserving confidentiality and availability if primary infrastructure is down or untrusted. Public social media feeds do not belong because they are unauthenticated, unencrypted, and publicly visible, making them unsuitable for sensitive incident coordination. Internal corporate email does not belong because it is often the compromised or monitored channel and is asynchronous, so it cannot be trusted or relied upon during an emergency. The company-wide intranet homepage does not belong because it is a one-way broadcast medium hosted on internal infrastructure that may itself be unavailable or compromised during an incident.

Answer

Public social media feeds

Answer

Internal corporate email

Answer

Company-wide intranet homepage

Question 4

A security operations manager is designing a threat intelligence program to improve detection of advanced persistent threats (APTs). The organization wants to prioritize intelligence that is actionable and relevant. Which TWO characteristics of threat intelligence are MOST important for driving effective detection engineering? (Choose two.)

Accepted Answer

Intelligence that is mapped to the MITRE ATT&CK framework and describes adversary tactics, techniques, and procedures (TTPs).. Effective detection engineering benefits most from intelligence that describes adversary TTPs mapped to MITRE ATT&CK, and from intelligence that is timely and machine-readable for automation. TTPs provide durable behavioral context, while timeliness and structured formats ensure the intelligence can be operationalized quickly. IOCs are perishable, free sources may lack relevance, and high volume can be counterproductive.

Answer

Intelligence that includes a high volume of indicators to maximize coverage.

Answer

Intelligence that is free and sourced from open-source communities.

Answer

Intelligence that includes specific indicators of compromise (IOCs) such as file hashes and domain names.

Question 5

A global manufacturing company is updating its crisis management plan. The plan must address the unique challenges of a cyber-related crisis, such as a ransomware attack that encrypts critical production systems. Which TWO of the following are the MOST important elements to include in the crisis management plan for this scenario? (Choose two.)

Accepted Answer

A communication strategy that includes pre-approved messages for internal staff, customers, and regulators.. For a ransomware crisis, the most important crisis management elements are a decision matrix for isolation and DR invocation, and a communication strategy with pre-approved messages. These address containment, recovery, and stakeholder communication. Asset inventory, vulnerability scanning, and access lists are important for prevention and recovery but are not core crisis management components.

Answer

A schedule for regular vulnerability scanning of the production network.

Answer

A list of all employees who have access to the production systems.

Answer

A detailed inventory of all hardware assets and their physical locations.

Question 6

When building an Enterprise Risk Management (ERM) program, which THREE factors must be considered to ensure integration with the organization?

Accepted Answer

Integration with existing business processes. ERM is successful when it aligns with the culture, business goals, and organizational structure.

Answer

Replacing all existing staff with security experts

Answer

Purchasing the most expensive security tool available

Question 7

Which TWO of the following are common challenges in quantitative risk analysis?

Accepted Answer

High complexity and resource intensity of modeling. Quantitative risk analysis suffers from lack of reliable data and the complexity of modeling.

Answer

It is not allowed by regulatory standards

Answer

The models are too simple to understand

Answer

Quantitative data is always free

Question 8

Which THREE of the following are key indicators of a mature security governance program?

Accepted Answer

The board receives regular, meaningful updates on security posture. Mature programs are characterized by metrics-driven processes, integration with enterprise functions, and active, informed oversight by the board.

Answer

The security team works in total isolation from the rest of the company

Answer

The CISO reports to the Help Desk manager

Question 9

Which TWO of the following are core components of a business-aligned security strategy?

Accepted Answer

Prioritization of security investments based on business impact. Alignment requires understanding the business's current state and risk profile, and ensuring that security projects are prioritized to support the most important business functions.

Answer

A requirement for all employees to have PhDs

Answer

A complete list of every software vulnerability in the firm

Answer

A mandate that all security tools must be from one vendor

Question 10

Which THREE factors must be considered during the 'Compliance Program Management' phase when evaluating whether to adopt a new cloud-based tool?

Accepted Answer

The availability of audit logs for compliance verification. Option B is correct because audit logs provide the evidentiary trail needed to verify that the cloud tool meets regulatory requirements and to support audits, so their availability is a core compliance consideration. Option C is correct because data residency determines where data is stored and processed, which directly affects adherence to laws such as GDPR or other jurisdictional privacy mandates. Option D is correct because the tool must align with the organization's existing security and privacy policies to avoid introducing control gaps or policy violations. Option A is not relevant because marketing budget does not affect regulatory compliance or control effectiveness. Option E is not relevant because a vendor's social media following has no bearing on compliance, security, or privacy obligations.

Answer

The tool's marketing budget

Answer

The number of social media followers of the vendor