How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the ISC exam, each with detailed explanations and wrong-answer analysis.

How should I approach ISC scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to (ISC)2 Information Systems Security Management Professional (CISSP-ISSMP, Aug 2025 blueprint) (ISC) questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise (ISC)2 Information Systems Security Management Professional (CISSP-ISSMP, Aug 2025 blueprint) (ISC) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

ISC

exam code

(ISC)²

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related ISC topic practice pages

Contingency Management practice questions

Systems Lifecycle Management practice questions

Law Ethics And Security Compliance Management practice questions

Risk Management practice questions

Leadership And Organizational Management practice questions

Security Operations practice questions

ISC fundamentals practice questions

ISC scenario practice questions

ISC troubleshooting practice questions

Practice scenarios

Which TWO of the following are effective ways to improve 'Crisis Management Leadership' effectiveness during an incident?

Which TWO aspects of the NIST Cybersecurity Framework (CSF) are most relevant when establishing a 'Compliance Program Management' function?

Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?

Which THREE of the following are important considerations for an ISSMP when outsourcing security functions?

When designing a Disaster Recovery Program, which THREE of the following represent common 'single points of failure' that must be addressed?

Which TWO factors must a security officer consider when performing a 'Privacy Impact Assessment' (PIA) for a new cloud application?

Which THREE of the following strategies should be included in a 'Disaster Recovery Program Oversight' function to ensure long-term viability?

Which TWO of the following are primary risks associated with an 'asynchronous' data replication strategy?

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

Which TWO of the following are metrics that provide insight into the effectiveness of security leadership?

During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?

Which THREE of the following are common indicators that a security program is failing to align with business objectives?

When presenting a security budget request to the Board of Directors, which THREE of the following elements should be included to ensure the request is compelling and understood?

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

Which THREE configurations are necessary to satisfy the 'Technical Safeguards' requirement under HIPAA for data at rest?

Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?

Which TWO of the following are core components of a business-aligned security strategy?

Which TWO of the following are primary components of a formal Risk Management policy?

When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?

Which TWO of the following are essential components of an effective security governance framework?