ISC Practice Questions

Question 1

Which THREE of the following are considered 'Risk Assessment' methodologies?

Accepted Answer

NIST SP 800-30. Common risk assessment methodologies include NIST RMF, FAIR, and ISO 27005.

Answer

HTML 5.0

Answer

TCP/IP protocol

Question 2

What is the primary function of an 'Exception Process' in a risk management program?

Accepted Answer

To manage temporary deviations from security standards. An exception process allows for documented, time-bound deviations from security standards when compliance cannot be met immediately.

Answer

To bypass the change management process

Answer

To punish non-compliant employees

Answer

To permanently ignore security policies

Question 3

In the context of risk reporting, what does a 'Risk Heat Map' effectively communicate to the board?

Accepted Answer

The relative prioritization of risks across the enterprise. A Risk Heat Map plots risks on a grid of likelihood versus impact (or similar axes) with color coding, giving the board a visual, prioritized view of which risks matter most across the enterprise. It communicates relative prioritization, not raw technical detail or financial precision. This makes it an executive-level communication tool rather than an operational one.

Answer

The history of past audit findings

Answer

The exact cost of every security control

Answer

Technical vulnerability lists

Question 4

As an ISSMP, you are defining the organizational security culture. Which activity is the most effective way to demonstrate executive commitment to security?

Accepted Answer

Actively chairing the cross-functional Security Steering Committee. The tone at the top is the most significant factor in shaping security culture. Direct executive participation in security steering committees signals that security is a business priority.

Answer

Sending an automated email newsletter regarding password policies

Answer

Appointing a dedicated Security Awareness Officer

Answer

Increasing the budget for the security operations center

Question 5

When configuring a Qualys scanner to perform authenticated scans on Windows, what is the 'Windows Authentication Record' primarily used for?

Accepted Answer

To perform deep local configuration checks. A Windows Authentication Record in Qualys stores credentials (domain, username, password, or hash) that the scanner uses to log into the target host. Once authenticated, the scanner can read the registry, installed software, file permissions, and other local configuration details that are invisible to an unauthenticated scan — enabling deep local configuration checks.

Answer

To perform a packet capture

Answer

To deploy patches to the host

Answer

To bypass the local firewall

Question 6

Which TWO of the following are primary components of a formal Risk Management policy?

Accepted Answer

Clear identification of roles and responsibilities. A risk management policy must define roles/responsibilities and the risk appetite/tolerance.

Answer

Detailed technical firewall configuration steps

Answer

The specific hardware vendors approved for purchase

Answer

The yearly budget for the IT department

Question 7

Which TWO communication channels are typically used for emergency incident coordination within a SOC?

Accepted Answer

Dedicated bridge line (conference call). A dedicated bridge line (conference call) is correct because it provides a real-time, always-available voice channel that lets incident responders, management, and stakeholders coordinate synchronously during an active emergency without depending on compromised systems. Encrypted out-of-band messaging such as Signal is correct because it uses a separate, end-to-end encrypted channel outside the potentially breached corporate network, preserving confidentiality and availability if primary infrastructure is down or untrusted. Public social media feeds do not belong because they are unauthenticated, unencrypted, and publicly visible, making them unsuitable for sensitive incident coordination. Internal corporate email does not belong because it is often the compromised or monitored channel and is asynchronous, so it cannot be trusted or relied upon during an emergency. The company-wide intranet homepage does not belong because it is a one-way broadcast medium hosted on internal infrastructure that may itself be unavailable or compromised during an incident.

Answer

Public social media feeds

Answer

Internal corporate email

Answer

Company-wide intranet homepage

Question 8

When establishing a security governance framework, what is the most critical element for ensuring long-term program success?

Accepted Answer

Securing ongoing executive sponsorship and clear accountability.. Executive sponsorship and clear accountability are the pillars of effective governance; without them, policies and frameworks lack the authority and resources needed for implementation.

Answer

Ensuring the framework is fully automated.

Answer

Outsourcing security oversight to a third-party audit firm.

Answer

Selecting the most robust technical security tools available.

Question 9

When managing a global security team, what is the primary challenge in maintaining a uniform security posture?

Accepted Answer

Cultural differences and local regulations. Cultural differences and local regulatory requirements make it difficult to enforce a single, global standard, requiring a balance between global directives and local adaptation.

Answer

Lack of global email systems

Answer

Time zone differences

Answer

Language barriers

Question 10

What is the primary purpose of an Incident Response (IR) plan?

Accepted Answer

To provide a structured approach to incident handling. An IR plan provides a structured, predefined approach to handling security incidents to minimize impact and ensure business continuity.

Answer

To identify all vulnerabilities in the network

Answer

To punish employees who cause incidents

Answer

To replace the need for security policies

Question 11

During an incident, which document is used by the SOC to record evidence, timestamps, and actions taken to ensure admissibility in a legal proceeding?

Accepted Answer

Chain of Custody. The Chain of Custody document tracks the handling of evidence from discovery through to investigation.

Answer

Runbook

Answer

Lessons Learned Report

Answer

Risk Register

Question 12

A security manager at a U.S. publicly traded healthcare technology company is notified by a forensic firm that an attacker exfiltrated 40,000 patient records and also altered financial reporting data used for quarterly earnings. The security manager must decide how to sequence regulatory notifications under the HIPAA Breach Notification Rule and the SEC's material cybersecurity incident disclosure rules. Which action BEST aligns with the organization's legal and regulatory obligations?

Accepted Answer

Notify the SEC on Form 8-K within four business days of determining the incident is material, and notify affected individuals and HHS within 60 days of discovering the PHI breach.. When an incident implicates both protected health information and material financial data, HIPAA and SEC obligations run concurrently and independently. The HIPAA Breach Notification Rule requires notice to individuals without unreasonable delay and no later than 60 days after discovery, with HHS notification depending on breach size. The SEC requires Form 8-K disclosure within four business days of determining a cybersecurity incident is material. Coordinating legal, privacy, and disclosure counsel ensures neither timeline is missed.

Answer

Notify the SEC within 60 days to align with the HIPAA Breach Notification Rule timeline, consolidating both notifications into a single regulatory filing.

Answer

Notify HHS within 24 hours of discovery and delay all SEC reporting until the forensic investigation is fully complete to avoid inaccurate disclosures.

Answer

Notify affected patients first, then notify the SEC only if the Department of Health and Human Services (HHS) determines the breach is reportable under HIPAA.

Question 13

An organization wants to improve its security posture by adopting a continuous monitoring approach. Which approach is most effective for an ISSMP to champion?

Accepted Answer

Implementing integrated security telemetry and automated analysis.. Continuous monitoring requires integrated data collection, automated analysis, and real-time reporting to provide actionable insights, which is the definition of a robust monitoring strategy.

Answer

Relying on manual logs review on a monthly basis.

Answer

Implementing a firewall with default deny rules.

Answer

Conducting annual penetration tests.

Question 14

A security operations manager is designing a threat intelligence program to improve detection of advanced persistent threats (APTs). The organization wants to prioritize intelligence that is actionable and relevant. Which TWO characteristics of threat intelligence are MOST important for driving effective detection engineering? (Choose two.)

Accepted Answer

Intelligence that is mapped to the MITRE ATT&CK framework and describes adversary tactics, techniques, and procedures (TTPs).. Effective detection engineering benefits most from intelligence that describes adversary TTPs mapped to MITRE ATT&CK, and from intelligence that is timely and machine-readable for automation. TTPs provide durable behavioral context, while timeliness and structured formats ensure the intelligence can be operationalized quickly. IOCs are perishable, free sources may lack relevance, and high volume can be counterproductive.

Answer

Intelligence that includes a high volume of indicators to maximize coverage.

Answer

Intelligence that is free and sourced from open-source communities.

Answer

Intelligence that includes specific indicators of compromise (IOCs) such as file hashes and domain names.

Question 15

A security manager is drafting the organization's acceptable use policy and wants to address the ethical expectation that employees report observed security violations. Which statement best reflects a professionally recognized ethical obligation for information security practitioners?

Accepted Answer

Employees should report suspected violations through designated channels promptly and cooperate with authorized investigations. Recognized professional codes require practitioners to act honorably, protect the organization and public, and report concerns through proper channels. An acceptable use policy should therefore direct employees to report suspected violations promptly and cooperate with authorized investigations. Conditioning reports on personal risk, requiring self-verification, or encouraging direct confrontation all conflict with these ethical expectations and with sound investigative practice.

Answer

Employees should report violations only when doing so cannot harm their own performance ratings or team relationships

Answer

Employees should report violations only after independently confirming that a policy breach actually occurred

Answer

Employees should confront the suspected violator directly and attempt to resolve the matter informally before escalating

(ISC)2 Information Systems Security Management Professional (CISSP-ISSMP, Aug 2025 blueprint) ISC practice test

Three ways to study

Study ISC by domain

Study ISC by topic

Security Operations practice questions

Law Ethics And Security Compliance Management practice questions

Systems Lifecycle Management practice questions

Contingency Management practice questions

Risk Management practice questions

Leadership And Organizational Management practice questions

ISC fundamentals practice questions

ISC scenario practice questions

ISC troubleshooting practice questions

(ISC)2 Information Systems Security Management Professional (CISSP-ISSMP, Aug 2025 blueprint) (ISC) practice questions