ISC Timed Practice Test 3 — 10 Questions

Question 1

An ISSMP is establishing the security requirements baseline for a system that must comply with a regulatory framework. The framework is updated annually and the system will operate for at least five years. Which approach BEST ensures the system remains compliant across its full lifecycle?

10 minute time limit — choose an answer to begin.

Accepted Answer

Establish a process to monitor regulatory changes, perform periodic control assessments against the current framework version, and feed identified gaps into the change management process.. A system that must remain compliant for years needs a continuous compliance capability: watch for regulatory changes, reassess controls against the current framework, and remediate gaps through change management. This ensures the security baseline tracks both the evolving framework and the system's changing risk profile. One-time certification, over-engineering, and delegating the watch function to an external auditor all leave the organization unable to demonstrate ongoing compliance.

Answer

Delegate ongoing compliance responsibility to the external auditor who performs the annual assessment, relying on the auditor to notify the organization of any new requirements.

Answer

Certify the system against the framework version in effect at go-live and document that certification as the basis for compliance for the system's lifetime.

Answer

Build the system to the strictest interpretation of every control in the framework so that future updates cannot introduce a compliance gap.

Question 2

You are the ISSMP at a global logistics company. The board has adopted a risk appetite statement that tolerates moderate operational risk but demands very low tolerance for safety and regulatory compliance failures. A business unit proposes bypassing a mandatory security control to accelerate a new routing platform launch. Which action best reflects the ISSMP's responsibility in enforcing the board's risk appetite?

Accepted Answer

Evaluate the control's purpose against the risk appetite, document residual risk, and require a time-bound remediation plan with executive acceptance if the bypass proceeds.. The ISSMP enforces risk appetite by evaluating whether a proposed exception breaches the board's tolerances, documenting the residual risk, and requiring accountable executive acceptance with a remediation timeline. This balances business speed with governance. Outright approval or denial, or deferring to audit, fails to apply the board's stated risk criteria to the decision.

Answer

Approve the bypass because the risk appetite allows moderate operational risk and the launch is time-sensitive.

Answer

Deny the bypass outright and instruct the business unit to delay the launch until full compliance is achieved.

Answer

Refer the decision to the internal audit function and take no further action until audit issues a finding.

Question 3

A healthcare insurer is preparing for a regulatory examination and must demonstrate to examiners that its security program is driven by documented leadership commitment rather than by the security team alone. The CISO reports to the CIO, and security topics rarely reach the board. Which action should the ISSMP recommend to best satisfy the examiners' expectation of visible executive ownership?

Accepted Answer

Establish a board-level risk committee that receives security risk reporting, approves risk appetite, and documents its oversight decisions in formal minutes.. Regulators and examiners distinguish between a well-run security function and a governed one. The decisive evidence is leadership setting risk appetite, receiving risk information, and being accountable for decisions, all documented. A board-level risk committee with formal reporting, risk-appetite approval, and minuted decisions provides that evidence directly. Operational improvements, awareness training, and framework mappings are useful, but each remains an artifact of the security team and does not show that executives own and direct the program.

Answer

Increase the frequency of vulnerability scans and include the results in the monthly security operations report sent to the CIO.

Answer

Require all executives to complete the same annual security awareness training that is assigned to general staff.

Answer

Adopt an industry-recognized security framework and map existing controls to it so the program can be presented as mature and comprehensive.

Question 4

Which TWO of the following are common challenges in quantitative risk analysis?

Accepted Answer

High complexity and resource intensity of modeling. Quantitative risk analysis suffers from lack of reliable data and the complexity of modeling.

Answer

It is not allowed by regulatory standards

Answer

The models are too simple to understand

Answer

Quantitative data is always free

Question 5

Which THREE of the following are key indicators of a mature security governance program?

Accepted Answer

The board receives regular, meaningful updates on security posture. Mature programs are characterized by metrics-driven processes, integration with enterprise functions, and active, informed oversight by the board.

Answer

The security team works in total isolation from the rest of the company

Answer

The CISO reports to the Help Desk manager

Question 6

You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?

Accepted Answer

Single Loss Expectancy. The Single Loss Expectancy (SLE) is the monetary value of a single loss event.

Answer

Security Loss Estimate

Answer

System Level Exposure

Answer

Serious Loss Evaluation

Question 7

An organization must comply with CCPA/CPRA requirements regarding 'Right to Delete'. In a hybrid environment utilizing Google Cloud Platform, which mechanism is best suited for implementing automated lifecycle policies to satisfy deletion requests across Cloud Storage buckets?

Accepted Answer

Cloud Storage Lifecycle Management rules. Cloud Storage Lifecycle Management rules are the native GCP mechanism for automating object deletion based on conditions such as age, creation date, or storage class. They operate at the bucket level and can be configured to automatically delete objects after a defined retention period, directly satisfying CCPA/CPRA 'Right to Delete' obligations without manual intervention. This makes them the correct fit for automated lifecycle-based deletion across Cloud Storage buckets.

Answer

Cloud IAM condition policies

Answer

VPC Service Controls

Answer

Data Loss Prevention (DLP) API scan-only mode

Question 8

Which TWO of the following are core components of a business-aligned security strategy?

Accepted Answer

Prioritization of security investments based on business impact. Alignment requires understanding the business's current state and risk profile, and ensuring that security projects are prioritized to support the most important business functions.

Answer

A requirement for all employees to have PhDs

Answer

A complete list of every software vulnerability in the firm

Answer

A mandate that all security tools must be from one vendor

Question 9

A CISO is managing a security budget with high pressure for cost optimization. Which strategy provides the best balance between security and cost efficiency?

Accepted Answer

Implementing risk-based resource allocation. Risk-based resource allocation allows the security team to prioritize investments on the highest-impact threats, ensuring maximum ROI on security spending.

Answer

Delaying all security projects by 12 months

Answer

Reducing headcount in security operations

Answer

Switching to only open-source security tools

Question 10

To ensure security requirements are integrated into the System Development Life Cycle (SDLC), what is the most effective approach for the security team?

Accepted Answer

Embedding security champions within development teams. Embed security champions within development teams to act as liaisons, ensuring security is considered throughout the development process rather than treated as a final check.

Answer

Requiring developers to attend annual security seminars

Answer

Automating the code deployment process

Answer

Mandating a security review before production release