ISC Timed Practice Test 2 — 10 Questions

Question 1

When reporting to the board of directors, which presentation method is most effective for communicating security performance?

Accepted Answer

Dashboards correlating security metrics to business objectives. Using dashboards with KPIs that correlate security activity to business objectives (e.g., risk reduction, compliance status) provides the context necessary for informed board decision-making.

Answer

A list of all blocked malicious IP addresses

Answer

Detailed technical logs and packet captures

Answer

A full copy of the latest penetration test report

Question 2

In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?

Accepted Answer

Vulnerability Priority Rating (VPR). The Vulnerability Priority Rating (VPR) incorporates threat intelligence and exploit code availability, making it more accurate for risk-based prioritization than CVSS alone.

Answer

Plugin Family

Answer

Asset Criticality Rating

Answer

CVSS Base Score

Question 3

When managing cross-functional security projects, which stakeholder communication strategy is most effective for securing project resources?

Accepted Answer

Aligning security project outcomes with business goals. Linking security initiatives to business outcomes, such as reduced downtime or faster time-to-market, ensures that non-technical stakeholders understand the necessity of resource allocation.

Answer

Focusing strictly on threat lists and vulnerability counts

Answer

Escalating all requests to the CEO

Answer

Using technical jargon to emphasize the severity of risks

Question 4

Which THREE of the following are important considerations for an ISSMP when outsourcing security functions?

Accepted Answer

Retaining the ultimate accountability for security. Outsourcing requires careful legal review, performance monitoring (SLAs), and ensuring that the provider is properly integrated into the organization's overall risk management.

Answer

Requiring the vendor to use only your internal tools

Answer

Choosing the vendor with the lowest price

Question 5

A CISO is aligning the organizational information security strategy with the NIST Cybersecurity Framework (CSF) 2.0. Which specific function should the CISO prioritize to ensure that the organizational security culture promotes the identification of risks before they impact business operations?

Accepted Answer

Govern. The 'Govern' function in NIST CSF 2.0 is specifically designed to establish the organizational context, risk management strategy, and cybersecurity supply chain risk management, which are foundational for aligning security culture with business objectives.

Answer

Identify

Answer

Protect

Answer

Recover

Question 6

An organization is conducting a risk assessment and identifies a critical vulnerability in a legacy system that cannot be patched. Which of the following is the most appropriate risk management strategy to address this vulnerability?

Accepted Answer

Implement compensatory controls to reduce the risk.. When patching is not possible, implementing compensatory controls (such as network segmentation or enhanced monitoring) is the standard approach to reduce the residual risk to an acceptable level.

Answer

Transfer the risk to a third-party vendor without further assessment.

Answer

Decommission the system immediately regardless of business impact.

Answer

Accept the risk without implementing any additional controls.

Question 7

When designing the Crisis Communication Plan, why is it essential to establish pre-approved communication templates?

Accepted Answer

To ensure consistent and rapid messaging during high-stress situations.. During a crisis, speed and accuracy are critical. Templates reduce cognitive load and prevent errors in messaging.

Answer

To allow marketing teams to create brand-focused content.

Answer

To bypass legal review during the crisis.

Answer

To fulfill regulatory requirements for daily status reports.

Question 8

When designing a Disaster Recovery Program, which THREE of the following represent common 'single points of failure' that must be addressed?

Accepted Answer

Key-person dependency for initiating the disaster declaration.. Resilience requires removing dependencies on single, irreplaceable entities (people, physical locations, or specific gateway devices).

Answer

Use of standardized enterprise resource planning software.

Answer

The use of automated server patching tools.

Question 9

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

Accepted Answer

Microsoft Purview DLP policies. Data Loss Prevention (DLP) policies in Microsoft 365 can be configured to detect PHI patterns and block or encrypt emails accordingly.

Answer

Exchange Online Protection (EOP) malware filtering

Answer

Microsoft Defender for Endpoint

Answer

Retention labels in the Compliance Center

Question 10

Which principle of 'Ethics in Security Leadership' dictates that a manager should prioritize the safety and privacy of the user over organizational convenience?

Accepted Answer

Duty of care / Stewardship. The principle of stewardship and duty of care requires leaders to act in the best interest of the data subject.

Answer

Transparency

Answer

Principle of least privilege

Answer

Separation of duties