scenario questions

Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?

You are the ISSMP for a multinational retailer that operates in the European Union and the United States. The Chief Human Resources Officer asks you to approve a new employee monitoring tool that captures screenshots, keystrokes, and application usage on all corporate endpoints. Legal counsel in the EU has not yet been consulted. As the ISSMP, which action best demonstrates alignment of security leadership with legal and privacy obligations before the tool is deployed?

Which of the following is the most important factor in the success of a security governance program?

A financial services firm has a primary data center and a cold DR site 120 miles away. A risk assessment reveals that the maximum tolerable downtime (MTD) for the core banking application is 8 hours, but the DR plan requires 24 hours to restore from tape backups at the cold site. The business continuity manager must close this gap. Which action is the MOST effective immediate step?

Your organization uses a 'Warm Site' for its disaster recovery strategy. During a recent audit, you find that the site lacks the necessary bandwidth to support peak production traffic. What is the most appropriate management response?

A security manager is evaluating organizational security culture. Which indicator provides the most reliable evidence of a 'security-first' culture?

You are auditing a third-party disaster recovery service provider. Which metric provides the most accurate evidence that the provider can meet your organization's required recovery point for a database cluster?

An ISSMP needs to ensure compliance with global data privacy regulations in a multinational environment. Which governance strategy provides the most consistent approach?

In Splunk Enterprise Security, which dashboard should the SOC manager review to evaluate the effectiveness of the current correlation searches and the volume of notable events?

During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?

An ISSMP is leading the secure acquisition of a commercial off-the-shelf (COTS) payroll system that will process employee PII. The vendor will not permit source code review but does provide a completed consensus assessment questionnaire. Which action BEST allows the ISSMP to establish assurance that the product meets the organization's security requirements before signing the contract?

During a declared major incident, the incident commander needs to preserve volatile evidence on a compromised Linux server before the platform team rebuilds it. The server hosts a critical billing application and cannot be taken offline for more than 30 minutes. Which action BEST satisfies both the evidentiary requirement and the availability constraint?

Which THREE factors should an ISSMP consider when selecting security controls for a new system?

In the context of the SDLC, what is the primary purpose of a 'Software Bill of Materials' (SBOM)?

Which TWO of the following are essential components of an effective security governance framework?

An ISSMP is leading a strategic security planning initiative using the balanced scorecard approach. Which perspective should be used to track metrics related to the workforce's proficiency and security awareness training success?

Which TWO of the following are primary components of an effective strategic security planning process as defined by (ISC)2 best practices for an ISSMP?

An ISSMP is developing a contingency plan for a critical e-commerce platform. The organization wants to ensure that the plan addresses both business process recovery and technology recovery. Which TWO of the following components are essential to include in the contingency plan? (Choose two.)

Which THREE pieces of information should be included in an 'Incident Notification' for executive stakeholders?

You are the ISSMP leading development of a security strategy that must support a three-year business transformation involving cloud migration and new digital products. Executive leadership expects the strategy to be both risk-based and measurable. Which two actions are most appropriate to include in the strategy? (Choose two.)

An ISSMP is leading the security integration for a new software development project that will use agile methodologies. The project team is distributed across multiple time zones. Which TWO practices are MOST effective for ensuring security requirements are not overlooked in this environment? (Choose two.)

Which principle of 'Ethics in Security Leadership' dictates that a manager should prioritize the safety and privacy of the user over organizational convenience?

A global manufacturing company is updating its crisis management plan. The plan must address the unique challenges of a cyber-related crisis, such as a ransomware attack that encrypts critical production systems. Which TWO of the following are the MOST important elements to include in the crisis management plan for this scenario? (Choose two.)

A multinational corporation is integrating its risk management program with its enterprise risk management (ERM) framework. The ISSMP is tasked with ensuring that risk appetite and tolerance are effectively communicated and applied across all business units. Which TWO actions are most critical to achieve this integration? (Choose two.)

Which THREE of the following strategies should be included in a 'Disaster Recovery Program Oversight' function to ensure long-term viability?

A financial services firm is expanding its risk management program to include cyber risk quantification. The CISO wants to express cyber risk in monetary terms to compare it with other business risks. Which approach best aligns with this objective?

When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?

Which THREE types of data should be ingested by a SIEM to improve its threat detection capabilities?

Your organization has decided to use a 'Cloud Disaster Recovery' service. The vendor provides a 'Pilot Light' strategy. What does this mean for your organization's recovery capability?

An ISSMP is conducting a security awareness program. What is the primary metric for measuring the success of this program?

When executive leadership discusses 'Acceptable Risk', they are referring to:

When designing the Crisis Communication Plan, why is it essential to establish pre-approved communication templates?

Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?

A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The risk team has identified that the platform's encryption at rest uses a deprecated algorithm. The vendor cannot upgrade the algorithm for another six months due to contractual constraints. Which of the following is the BEST risk response?

Which THREE of the following should be included in an annual strategic security plan?

A security manager is leading the response to a confirmed ransomware outbreak on a file server. The malware is still actively encrypting files and spreading laterally via SMB. Executive leadership asks the manager to authorize immediate containment. Which action BEST satisfies the containment objective while preserving forensic evidence?

Your organization is restructuring its security team after a merger. Two legacy security operations centers use different escalation paths, and executives complain that incident decisions are inconsistent. As the ISSMP, you must design a governance structure that clarifies authority, accountability, and decision rights across the combined security function. Which action best accomplishes this?

During a system's operations and maintenance phase, the ISSMP learns that a critical vulnerability has been disclosed in a widely used library embedded in the application. The vendor confirms a patch is available. Which action should the ISSMP take FIRST?

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

An organization uses a microservices architecture. How can the ISSMP ensure that inter-service communication is encrypted and that services are authenticated to one another?

A Chief Risk Officer is utilizing the FAIR framework to quantify cyber risk. Which input is required to calculate the Loss Event Frequency?

Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?

When performing a risk assessment on a new SaaS implementation, which document is most useful for understanding the vendor's risk profile?

An organization wants to monitor its compliance with CIS Benchmarks automatically. Which tool is best suited to provide an automated 'Compliance Score' against these benchmarks in a multi-cloud environment?

A security operations manager is reviewing the SOC's use of threat intelligence and wants to ensure that indicators are automatically ingested and matched against event data with minimal latency. Which capability should be prioritized to meet this objective?

A healthcare organization is building a Security Operations Center and must define how it will measure and govern detection and response performance. The CISO asks the security manager to select metrics that directly reflect the SOC's ability to detect and respond to threats. Which TWO metrics best meet this requirement? (Choose two.)

An ISSMP is reviewing an organizational risk register. Which field is essential for effective risk prioritization?

You are the ISSMP at a financial services firm that has just acquired a smaller competitor. The acquisition brings 400 new employees, a different identity provider, and an unintegrated security operations center. Executive leadership wants a single security governance model within twelve months. Which action should you prioritize first to establish effective governance across the combined organization?

A healthcare insurer is preparing for a regulatory examination and must demonstrate to examiners that its security program is driven by documented leadership commitment rather than by the security team alone. The CISO reports to the CIO, and security topics rarely reach the board. Which action should the ISSMP recommend to best satisfy the examiners' expectation of visible executive ownership?

A security manager discovers that a business unit has been storing customer payment card data in a legacy on-premises application that was never brought into the PCI DSS assessment scope. The business unit argues the data is 'just for reporting.' Which action should the security manager take FIRST?

You are implementing a disaster recovery strategy for a database that uses synchronous replication. What is the most significant trade-off you must accept by enforcing this configuration?

When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?

When evaluating the effectiveness of a risk mitigation strategy, which stakeholder is most critical to involve in the sign-off process?

Which TWO of the following are primary risks associated with an 'asynchronous' data replication strategy?

A healthcare organization is developing its crisis management plan. The plan must address how the organization will coordinate with external entities during a public health emergency. Which of the following is the PRIMARY purpose of including a call tree and contact list in the crisis management plan?

An ISSMP is defining the disposal requirements for a new system that will process regulated financial data. The system uses a combination of on-premises servers with self-encrypting drives, cloud object storage, and encrypted backup tapes. Which action best ensures that data remanence is addressed across ALL media during the disposal phase?

What is the primary objective of a 'Security Gate' in an SDLC?

A company is integrating a Third-Party API into their application. What must the ISSMP ensure is included in the risk assessment process?

Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?

Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?

A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?

The board of directors requests a quantitative risk assessment for a new cloud-based initiative. Which metric provides the best representation of potential financial exposure to the organization for a single, significant security event?

Which THREE of the following are important considerations for an ISSMP when outsourcing security functions?

An organization is conducting a risk assessment and identifies a critical vulnerability in a legacy system that cannot be patched. Which of the following is the most appropriate risk management strategy to address this vulnerability?

When designing a security program, which TWO of the following factors should be considered to ensure the program can successfully scale with organizational growth?

Which TWO aspects of the NIST Cybersecurity Framework (CSF) are most relevant when establishing a 'Compliance Program Management' function?

Which THREE of the following represent the primary responsibilities of executive leadership in fostering a strong organizational security culture?

Which document serves as the primary governing authority to define the triggers, escalation paths, and communication roles during a declared crisis event?

A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The ISSMP must ensure that the assessment adequately addresses regulatory requirements. Which of the following should be the PRIMARY focus of the risk assessment?

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

When managing a FortiGate firewall, which feature allows the SOC to dynamically update network objects based on external threat feeds?

Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?

A multinational corporation is reviewing its business continuity plan (BCP). The BCP includes a recovery strategy for its primary ERP system that relies on a hot site with synchronous replication. During a tabletop exercise, participants discover that the hot site is in the same seismic zone as the primary data center. Which of the following is the MOST critical risk to address?

Which TWO factors should be used to weigh the 'Impact' in a risk assessment?

Which THREE actions are necessary when preparing to decommission a cloud-based Virtual Machine (VM)?

An organization is retiring a customer relationship management system that stored personally identifiable information. The system is scheduled for shutdown in 30 days, and the ISSMP must ensure the decommissioning aligns with lifecycle management and data protection obligations. Which action should the ISSMP prioritize?

When managing cross-functional security projects, which stakeholder communication strategy is most effective for securing project resources?

What is the primary role of a Change Advisory Board (CAB)?

A security manager is drafting the organization's acceptable use policy and wants to address the ethical expectation that employees report observed security violations. Which statement best reflects a professionally recognized ethical obligation for information security practitioners?

Your organization has adopted a cloud-native microservices architecture. Which strategy is most appropriate for maintaining business continuity in the event of a regional cloud provider outage?

An ISSMP is implementing a Disaster Recovery (DR) plan. Which objective is most important to define with business leaders?

When decommissioning an application, which action should the ISSMP prioritize to ensure data privacy requirements (e.g., GDPR) are satisfied?

A multinational manufacturer is updating its contingency management framework after a prolonged supplier outage disrupted production. Executive leadership wants assurance that future disruptions are detected early and that recovery priorities remain aligned with business objectives. (Choose two.)

When transitioning to an Agile development methodology, which security management approach best supports the 'Shift Left' security strategy?

Which risk response strategy is being employed when a company purchases cyber insurance?

In the context of ISO 31000, what is the primary purpose of 'Risk Communication and Consultation'?

What is the primary difference between a 'Risk Assessment' and a 'Vulnerability Assessment'?

In the context of the Google Cloud Security Command Center (SCC), which feature provides a prioritized list of findings based on the criticality of the impacted asset?

An organization is replacing its aging identity management system. The ISSMP must ensure that sensitive identity data from the legacy platform is handled securely during migration and that the old platform is properly retired. Which action BEST addresses the data lifecycle risk during this transition?

Which SOC process ensures that all security tools are configured to log at the same time standard to prevent confusion during timeline analysis?

A multinational corporation is implementing an Enterprise Risk Management (ERM) program. The Chief Risk Officer wants to ensure that risk management is integrated into strategic planning. Which of the following activities best demonstrates this integration?

Which of the following is an example of a detective control in a risk management program?

An ISSMP is reviewing the Business Continuity Plan (BCP) for a critical application. Which TWO of the following factors should be considered when defining the 'Maximum Tolerable Downtime' (MTD)?

A healthcare organization is integrating risk management into its enterprise architecture practice. The Chief Risk Officer (CRO) wants to ensure that new technology initiatives are evaluated for risk before funding is approved. Which activity best demonstrates that risk management is embedded in the architecture governance process?

When establishing a security governance framework, what is the most critical element for ensuring long-term program success?

A security manager is developing a risk treatment plan for a critical vulnerability in a web application. The vulnerability allows remote code execution and has a high likelihood of exploitation. The organization has a low risk appetite. Which TWO of the following are the MOST appropriate risk treatment options to consider? (Choose two.)

A software development company is integrating risk management into its DevOps pipeline. The security team wants to implement a control that automatically scans code for vulnerabilities before deployment. Which of the following best describes this type of control in the context of risk management?

An ISSMP is reviewing the 'Change Control' process for a critical system. Which of the following is an essential element for every change request?

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

What is the primary objective of a 'lessons learned' meeting conducted after a disaster recovery exercise?

During a waterfall-to-Agile transition, the development team wants to bypass formal Security Requirements Traceability Matrix (SRTM) documentation in favor of user stories. How should the ISSMP reconcile this?

When reporting to the board of directors, which presentation method is most effective for communicating security performance?

When presenting a risk treatment plan to the Board of Directors, which THREE elements should be included to ensure executive buy-in?

A global financial services firm is expanding its enterprise risk management (ERM) program to include third-party risk. The CISO wants to ensure that the risk appetite for third-party relationships is consistently applied across all business units. Which of the following is the MOST effective way to achieve this?

Your organization uses a 'Hot Site' with hardware-level replication. During a disaster, the primary site becomes unavailable, but the failover fails due to a 'Split-Brain' scenario. What is the fundamental cause of this?

An organization is adopting a DevSecOps model and wants to ensure that security requirements are continuously validated throughout the CI/CD pipeline. The ISSMP is asked to define the security control gates. Which approach BEST integrates security into the pipeline while maintaining development velocity?

You are the ISSMP at a mid-sized manufacturing company. The CEO asks you to explain how the security program supports the organization's strategic goal of expanding into new international markets. Which response best demonstrates strategic alignment of the security program with business objectives?

When aligning security with organizational goals, how should an ISSMP address a conflict between security controls and user productivity?

Which feature in Okta is essential for meeting compliance requirements regarding 'Identity Assurance' and 'Strong Authentication' mandated by financial regulations?

When conducting a compliance audit, what is the purpose of a 'Gap Analysis'?

A financial services firm has a primary data center in a flood plain and a contractual obligation to resume trading operations within two hours of any disruption. The CIO proposes replacing the current cold site with a mirrored hot site in a different seismic zone, but the CFO objects to the recurring cost. Which action best supports a defensible decision while preserving the two-hour commitment?

Which THREE of the following are essential components of a robust Crisis Management Plan?

A security manager is evaluating the effectiveness of the SOC's detection capabilities. The SOC has a high volume of alerts, but many are false positives, and analysts are overwhelmed. Which metric BEST indicates that the SOC needs to tune its detection rules to reduce noise?

A US-based company is processing data of German citizens. To comply with the Schrems II ruling, which contractual mechanism must they document in their vendor risk management registry?

Which TWO factors must a security officer consider when performing a 'Privacy Impact Assessment' (PIA) for a new cloud application?

Which document is primarily responsible for documenting the security controls applicable to a system during the SDLC's requirements phase?

A security manager at a U.S. publicly traded healthcare technology company is notified by a forensic firm that an attacker exfiltrated 40,000 patient records and also altered financial reporting data used for quarterly earnings. The security manager must decide how to sequence regulatory notifications under the HIPAA Breach Notification Rule and the SEC's material cybersecurity incident disclosure rules. Which action BEST aligns with the organization's legal and regulatory obligations?

When configuring CrowdStrike Falcon to isolate a host during an active incident, what is the prerequisite requirement for the agent's communication state?

Which THREE actions should be taken when performing an incident post-mortem according to industry best practices?

A multinational organization needs to align its security policies with various regional privacy regulations (e.g., GDPR, CCPA). What is the best strategy to achieve this?

During an internal investigation, a security manager learns that an employee copied proprietary source code to personal cloud storage before resigning. Legal counsel requests that the security team preserve evidence without tipping off the former employee. Which action best supports potential civil litigation while maintaining investigative integrity?

Your organization is evaluating the procurement of a new SaaS platform. As the ISSMP, you are responsible for integrating security into the vendor risk management process. Which action is most critical during the 'Due Diligence' phase?

A security operations manager is designing a threat intelligence program to improve detection of advanced persistent threats (APTs). The organization wants to prioritize intelligence that is actionable and relevant. Which TWO characteristics of threat intelligence are MOST important for driving effective detection engineering? (Choose two.)

A multinational corporation is integrating its risk management program with its supply chain management. The CISO wants to ensure that risk assessments are performed consistently for all suppliers. Which of the following is the MOST important factor to consider when defining the risk assessment criteria?

When managing a global security team, what is the primary challenge in maintaining a uniform security posture?

Which TWO of the following are critical components of a secure SDLC (Software Development Life Cycle) implementation?

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

A CISO needs to justify an increase in the security budget. Which argument is most persuasive to the Chief Financial Officer (CFO)?

A global financial services firm has experienced three major security incidents in the past year, each traced to a different business unit ignoring security policies during rapid project delivery. The CISO wants to embed security accountability into the performance management system rather than relying on after-the-fact audits. Which approach is MOST effective for achieving this goal?

During a crisis simulation, the incident commander discovers that the crisis management team has no pre-agreed criteria for escalating from the operational incident response team to the executive crisis team. Decisions are being made ad hoc and communication is inconsistent. Which action best addresses this governance gap?

Which TWO mechanisms are effective for preventing 'insecure direct object references' (IDOR) in a web application during the development phase?

Which TWO of the following are primary components of an effective Incident Response (IR) program?

An ISSMP is performing a security assessment on an application using containerized microservices. The team uses Kubernetes. What is the most effective way to ensure security configurations are consistently applied across all clusters?

A global financial services firm has completed a quantitative risk analysis for its primary trading platform. The analysis shows an annualized loss expectancy (ALE) of $4.2 million. The platform owner proposes a $1.1 million annual security program that would reduce the ALE to $900,000. The Chief Information Security Officer (CISO) must decide whether to recommend funding. The organization's risk appetite statement permits a maximum residual ALE of $1.5 million for critical systems. Which decision is most appropriate?

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

An ISSMP is reviewing a project that will replace the organization's customer relationship management (CRM) system. The project manager proposes to reuse the existing security test plan from the legacy CRM to save time and cost. The new CRM is a cloud-based SaaS solution with different data flows and integrations. What should the ISSMP recommend?

An ISSMP is reviewing the organization's business continuity plan (BCP). The plan defines recovery time objectives (RTOs) and recovery point objectives (RPOs) for critical business processes. The internal audit team has asked for evidence that the BCP will actually work during a disruption. Which action provides the MOST reliable evidence that the BCP is effective?

A global manufacturing company has a federated governance model in which each regional business unit owns its own security budget and risk register. The corporate CISO is accountable to the board for enterprise-wide risk but has no direct authority over regional security spending. The board has asked the CISO to produce one consolidated risk view that can be audited. Which action should the ISSMP take FIRST to establish an effective enterprise-wide security governance structure?

An organization wants to improve its security posture against supply chain attacks. Which action is most effective for an ISSMP?

A security manager is presenting a risk register to the executive committee. One risk item shows a high likelihood and high impact, but the risk owner has proposed a treatment plan that requires significant funding. The executive committee asks for justification. Which of the following is the BEST approach to justify the investment?

A newly appointed CISO at a mid-sized healthcare organization discovers that security responsibilities are informally assigned across departments, with no clear ownership. The organization must comply with HIPAA and wants to establish clear accountability for security. Which action should the CISO take FIRST to establish a foundation for security governance?

As a Chief Information Security Officer (CISO), you need to ensure that the security program is aligned with organizational business objectives. Which activity best demonstrates this alignment?

When managing a security incident, what is the primary role of the CISO in a large enterprise?

A security manager is developing an incident response plan that must comply with legal and regulatory requirements for evidence handling. The organization operates in a jurisdiction that follows common law and may need to present digital evidence in court. Which two principles must the manager ensure are followed to maintain the admissibility of digital evidence? (Choose two.)

Which leadership style is most effective for building a strong security team during a period of rapid organizational growth?

In Okta, to restrict administrative access to a specific geographic region during an active session, which policy should be modified?

In Rapid7 InsightVM, what is the best way to categorize assets into groups based on their business function for targeted vulnerability reporting?

A security manager is reviewing the organization's incident response plan and wants to ensure that evidence collected during an incident is handled in a manner that preserves its integrity for potential legal proceedings. Which TWO practices should be included in the evidence handling procedures? (Choose two.)

An organization is adopting Infrastructure-as-Code (IaC) using Terraform. The ISSMP wants to ensure no insecure configurations (e.g., S3 buckets with public read) are deployed. What should be integrated into the CI/CD pipeline?

When assessing the risk of a third-party service provider, which THREE areas should be evaluated?

Which THREE technical controls are effective for limiting the impact of lateral movement?

A security manager is building a compliance monitoring program for a multinational insurer subject to state breach notification laws, the Gramm-Leach-Bliley Act, and internal audit requirements. Which TWO activities best establish continuous compliance visibility across these obligations? (Choose two.)

An ISSMP is reviewing the system development lifecycle (SDLC) for a new payroll application. The organization must comply with PCI DSS because the application will process employee salary payments. At which phase should the ISSMP ensure that PCI DSS requirements are identified and documented?

Which TWO of the following are metrics that provide insight into the effectiveness of security leadership?

A security manager is developing a business continuity plan (BCP) for the security operations center (SOC). The plan must ensure that critical monitoring and response capabilities continue during a disaster that disables the primary SOC. Which strategy BEST addresses this requirement?

An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Which of the following is the most effective method for testing the efficacy of a Business Continuity Plan without disrupting production operations?

An ISSMP is leading the development of a new security governance framework for a multinational manufacturing company. The framework must ensure that security decisions are made at the right level and that the program remains aligned with business strategy over time. Which TWO of the following are essential components of this governance framework? (Choose two.)

A security manager at a U.S. publicly traded company is preparing for the annual external financial audit. The IT team wants to grant the external auditor temporary access to the ERP system to verify access controls. Which action best satisfies both the audit requirement and security governance principles?

Which THREE of the following are challenges in transitioning to a secure DevSecOps model?

A retail company is conducting a business impact analysis (BIA) for its point-of-sale (POS) system. The BIA team has identified that a 4-hour outage would result in $500,000 in lost sales and reputational damage. The company's risk appetite allows for a maximum of 2 hours of downtime for critical systems. Which of the following should be the PRIMARY output of this BIA for the POS system?

A security manager is asked to approve a vendor contract for a cloud service that will process regulated data. The vendor refuses any changes to its standard terms and offers only a self-attestation of security. Which action is most appropriate?

An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?

For an organization to maintain compliance with the GLBA (Gramm-Leach-Bliley Act), which mechanism within Azure Key Vault is required to demonstrate evidence of 'Key Rotation' and 'Access History'?

A security manager is reviewing the organization's incident response plan. The plan requires that after a major incident, lessons learned are captured and used to improve future response. Which activity BEST ensures that lessons learned are effectively integrated into the security operations program?

A financial services firm is acquiring a SaaS-based fraud analytics platform. During the due diligence phase of the system lifecycle, the vendor provides a SOC 2 Type II report covering the last 12 months, a completed security questionnaire, and a penetration test summary dated 18 months ago. The ISSMP must decide whether to accept the vendor for integration into the production environment. Which action best satisfies the ISSMP's responsibility at this lifecycle stage?

Which THREE activities are included in the 'Preparation' phase of the IR life cycle?

An organization is deploying a globally distributed application. The ISSMP needs to ensure that code changes are signed to prevent tampering. Which process should be implemented in the build pipeline?

A security manager is drafting a security policy. Which element is essential for ensuring executive support and establishing the policy's organizational authority?

What is the primary function of an 'Exception Process' in a risk management program?

In the context of risk reporting, what does a 'Risk Heat Map' effectively communicate to the board?

As an ISSMP, you are defining the organizational security culture. Which activity is the most effective way to demonstrate executive commitment to security?

Your organization runs its order-management platform in an active-active configuration across two data centers, with a third site reserved for disaster recovery. During a quarterly BCP exercise, the CIO asks you to define the maximum acceptable time that transaction data may be irretrievably lost if the primary site fails before replication completes. Which contingency metric should you present?

When configuring a Qualys scanner to perform authenticated scans on Windows, what is the 'Windows Authentication Record' primarily used for?

Which TWO of the following are primary components of a formal Risk Management policy?

Which TWO communication channels are typically used for emergency incident coordination within a SOC?

Which TWO techniques are effective for securing the software supply chain?

A CISO is presenting a security program roadmap. Which approach is best for managing expectations regarding security maturity?

During an incident, which document is used by the SOC to record evidence, timestamps, and actions taken to ensure admissibility in a legal proceeding?

An organization wants to improve its security posture by adopting a continuous monitoring approach. Which approach is most effective for an ISSMP to champion?

A security manager is defining the scope of the organization's incident response program and needs to ensure that the program addresses all phases of the incident handling lifecycle. Which sequence of phases should the manager use as the framework for the program?

You are the ISSMP for a mid-sized financial services firm. The CIO asks you to build a repeatable process for evaluating and onboarding new vendors that handle regulated data. You must ensure the process produces defensible evidence of due diligence and aligns with the firm's risk appetite. Which approach best satisfies this requirement?

When building an Enterprise Risk Management (ERM) program, which THREE factors must be considered to ensure integration with the organization?

An ISSMP is overseeing the integration of security into a new DevOps pipeline using Jenkins. Which stage of the SDLC should the ISSMP enforce the execution of SAST tools to ensure security requirements are met early?

When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?

Which TWO methods are commonly used to identify new risks in an enterprise environment?

Which TWO of the following are common challenges in quantitative risk analysis?

Which THREE of the following are key indicators of a mature security governance program?

You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?

An organization must comply with CCPA/CPRA requirements regarding 'Right to Delete'. In a hybrid environment utilizing Google Cloud Platform, which mechanism is best suited for implementing automated lifecycle policies to satisfy deletion requests across Cloud Storage buckets?

Which TWO of the following are core components of a business-aligned security strategy?

A security manager is building the incident response program for a financial services firm and needs to define the criteria that determine when an event must be escalated to a formally declared incident. Which artifact should be created to document these criteria, the required responders, and the approval chain for escalation?

As the ISSMP, you are advising the executive team on how to embed security requirements into the organization's enterprise architecture practice. Business units frequently deploy new cloud services without security review, creating unmanaged risk. Which action best integrates security into enterprise architecture governance?

A CISO is managing a security budget with high pressure for cost optimization. Which strategy provides the best balance between security and cost efficiency?

During an internal investigation, a security manager learns that an employee may have exfiltrated proprietary source code to a personal cloud account. Legal counsel has issued a litigation hold. Which action should the security manager take to preserve evidence while respecting legal constraints?

A global retailer is expanding its risk management program to include third-party vendors. The Chief Information Security Officer (CISO) is concerned about supply chain risks. Which TWO of the following are the most effective controls to mitigate third-party risk? (Choose two.)

An ISSMP is developing a cross-functional incident response team. Which THREE roles or functions are absolutely critical to include to ensure comprehensive handling of a major security breach?

To ensure security requirements are integrated into the System Development Life Cycle (SDLC), what is the most effective approach for the security team?

Which organizational structure is most effective for a CISO to influence security behavior across geographically dispersed and independent business units?

Which TWO actions are part of the 'Risk Monitoring' process?

In an incident response plan, which metric is most useful for measuring the 'dwell time' of a threat actor?

A security manager discovers that a business unit deployed a customer analytics platform that transfers personal data from the EU to a US-based processor without a valid transfer mechanism. Executive leadership wants to continue the processing. Which action best aligns with GDPR Chapter V obligations?

During the maintenance phase, a production database needs a schema change. The ISSMP requires that this change be tested in a staging environment that mirrors production. Which process best demonstrates compliance with the 'Separation of Duties' principle?

A security manager at a publicly traded US retailer is preparing for the first year of SOX Section 404 IT general controls testing. The external auditor requests evidence that access to the financial reporting database is revoked within 24 hours of an employee's termination. Which control artifact best satisfies the auditor's request?

Which THREE factors must be considered during the 'Compliance Program Management' phase when evaluating whether to adopt a new cloud-based tool?

Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?

An information security manager discovers that a penetration tester, hired under a signed contract with a defined scope and rules of engagement, accessed a production database containing customer records that were explicitly excluded from the scope. The tester claims the access was accidental during a pivot. The organization is now deciding whether to pursue legal action. Which legal principle is most relevant in determining the tester's liability?

Which THREE criteria are essential for establishing a successful 'Risk Committee'?

You are the ISSMP for a regional hospital network. The CIO wants assurance that the emergency department's clinical information system can be recovered within its maximum tolerable downtime (MTD) of 30 minutes. The system runs on a three-tier architecture with a relational database. Which recovery strategy BEST satisfies the MTD requirement?

Which THREE components should be included in an application security requirements document?

Which THREE factors are required to calculate the 'Risk' of a vulnerability for reporting purposes?

A security manager is reviewing the organization's log management program. An auditor notes that several critical servers retain logs for only 7 days, while the incident response policy requires the ability to investigate incidents up to 90 days after detection. The servers generate approximately 50 GB of logs per day. Which action BEST addresses the audit finding while controlling storage cost?

Which phase of the SDLC is most appropriate for conducting a formal Threat Modeling exercise?

A regional utility has completed its business impact analysis and is now selecting recovery strategies for its supervisory control and data acquisition environment. The BIA shows that loss of grid monitoring beyond 30 minutes creates public safety risk. Which recovery strategy characteristic is most important when selecting the target environment for this system?

An organization is migrating to a hybrid cloud environment and is updating its security architecture. Which of the following is the MOST effective way to ensure consistent security policy enforcement across both on-premises and cloud environments?

What is the primary objective of a Business Impact Analysis (BIA)?

Which THREE items are typically verified in a Security Gate check before a production deployment?

Which document establishes the high-level security objectives and the roles/responsibilities of senior management within an organization?

During a cross-functional security planning session, the IT operations team argues that security controls are negatively impacting system performance. As an ISSMP, what is the most appropriate management approach to resolve this conflict?

You are the ISSMP at a global logistics company. The board has adopted a risk appetite statement that tolerates moderate operational risk but demands very low tolerance for safety and regulatory compliance failures. A business unit proposes bypassing a mandatory security control to accelerate a new routing platform launch. Which action best reflects the ISSMP's responsibility in enforcing the board's risk appetite?

A project manager wants to bypass a security vulnerability finding because 'the patch will break the application'. What is the correct ISSMP response?

An organization is adopting a Zero Trust Architecture (ZTA). Which management principle is critical for the long-term success of this transition?

When presenting a security budget request to the Board of Directors, which THREE of the following elements should be included to ensure the request is compelling and understood?

Which THREE of the following are critical for successfully managing cross-functional security initiatives?

Which TWO items must be documented in a Change Control Log after a successful production change?

Which THREE of the following are common indicators that a security program is failing to align with business objectives?

An ISSMP is evaluating a Cloud Access Security Broker (CASB) implementation. Which management goal is most effectively addressed by this tool?

An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?

In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?

When designing a Disaster Recovery Program, which THREE of the following represent common 'single points of failure' that must be addressed?

A financial services firm uses a risk matrix with likelihood and impact scales. During a risk assessment, the team identifies a new vulnerability in a core banking application. The likelihood is rated as 'Possible' (3 on a 1-5 scale) and the impact as 'Major' (4 on a 1-5 scale). The organization's risk appetite statement says that risks with a score of 12 or higher require immediate treatment. What is the risk score and what action should be taken?

When drafting an organizational 'Acceptable Use Policy' (AUP), which element is most critical to ensure legal enforceability in a professional environment?

In a decentralized organization, which approach to BCP management ensures both local agility and global alignment?

Which of the following is the most important factor to consider when evaluating the effectiveness of a security training and awareness program?

Which document describes the specific steps an analyst should take when a 'Phishing' alert is triggered in the SIEM?

A hospital's emergency department depends on a clinical documentation system. The BIA shows the department can function on paper forms for up to four hours, after which patient safety risk becomes unacceptable. The DR plan states the system will be restored within six hours. What should the contingency manager do FIRST?

You are the ISSMP at a healthcare provider preparing for a HIPAA security rule assessment. The CIO asks you to identify which activities are the responsibility of the security management process standard under administrative safeguards. (Choose two.)

During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?

When implementing FIM (File Integrity Monitoring) in Tripwire Enterprise, what is the specific purpose of a 'Promotion' action?

An ISSMP is establishing the security requirements baseline for a system that must comply with a regulatory framework. The framework is updated annually and the system will operate for at least five years. Which approach BEST ensures the system remains compliant across its full lifecycle?

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

Which TWO of the following are effective communication strategies for a CISO interacting with senior executives?

During a post-implementation review of a new enterprise resource planning (ERP) system, the ISSMP discovers that the project team did not perform a security risk assessment during the design phase. The system is now in production and handles sensitive financial data. What should the ISSMP do FIRST?

A security manager is drafting the business continuity plan for a payment processing platform. The CIO asks which element establishes the maximum tolerable time that the payment service can be unavailable before the organization suffers unacceptable financial and regulatory harm. Which concept should the manager document?

An ISSMP is managing a merger where two organizations use different identity providers. Which strategy best mitigates identity-related risk during the integration phase?

A security manager at a mid-sized financial firm discovers that a privileged database administrator account was used at 02:00 UTC to export 40 GB of customer records to an external IP address. The account was not locked out, no alert fired, and the export completed over 47 minutes. Which action should the manager take FIRST to align with the ISC2 ISSMP incident management lifecycle?

Which TWO of the following are effective ways to improve 'Crisis Management Leadership' effectiveness during an incident?

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

Which document is the primary source for defining the 'Risk Appetite' of an enterprise?

A security manager is establishing a formal incident response capability and wants to ensure that lessons learned from major incidents are captured and used to improve future response. Which activity should be conducted after a significant incident to meet this goal?

A security manager is building a compliance monitoring capability for a regulated environment. Which TWO activities are essential to demonstrate that controls remain effective between formal audits? (Choose two.)

Which THREE of the following are considered 'Risk Assessment' methodologies?

Which of the following is a key component of a successful security awareness training program?

During a BCP planning session, the executive team is debating the 'Maximum Tolerable Downtime' (MTD) for a legacy internal application. What is the correct way to define this metric?

Which SOC metric is most appropriate to present to executive leadership to demonstrate the business value of security investments?

Which TWO metrics are essential for evaluating the performance of a SOC team in identifying and containing threats?

As an ISSMP developing a security governance program, which THREE of the following activities are essential to ensure the program remains effective and compliant?

Which TWO of the following are valid responses to a high-risk finding?

Which document is considered the primary 'source of truth' for defining the SOC's roles, responsibilities, and communication paths during a major security incident?

What is the primary purpose of an Incident Response (IR) plan?

An organization is initiating a project to develop a new mobile banking application. The ISSMP is tasked with ensuring that security requirements are identified and integrated from the very beginning of the systems development life cycle (SDLC). Which action should the ISSMP take FIRST to achieve this?

A security manager is building a compliance monitoring capability for a multinational retailer that accepts payment cards and operates in the EU. The legal team wants assurance that the program can demonstrate ongoing adherence to both PCI DSS 4.0 and GDPR. Which approach BEST provides continuous, auditable evidence of compliance across both regimes?

An organization is moving from a reactive security posture to a proactive threat-informed defense. As the ISSMP, you are implementing the MITRE ATT&CK framework. Which executive-level metric best demonstrates the maturity of the security program to the Board of Directors regarding this transition?

Following a ransomware attack, the organization must decide whether to invoke the DRP or remain in a degraded state while security teams perform forensics. What is the ISSMP's primary responsibility in this decision-making process?

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?