219 questions total · 3pages · All types, answers revealed
Page 1 of 3
Page 2Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?
Techniques represent the specific methods an adversary uses to achieve their goal.
Why this answer
The 'Technique' ID is the core component that describes the 'how' of an adversary's action.
When evaluating a third-party SaaS provider, which activity is most critical for assessing the vendor's security commitment?
This is the industry standard for validating third-party security posture.
Why this answer
Reviewing independent audit reports (such as SOC 2 Type II) provides verified evidence of the vendor's controls, which is more reliable than self-assessments.
Which of the following is the most important factor in the success of a security governance program?
Governance requires the mandate that only executive leadership can provide.
Why this answer
Executive leadership support is the foundation upon which the security program is built; without it, policies lack authority and resources remain scarce.
Your organization uses a 'Warm Site' for its disaster recovery strategy. During a recent audit, you find that the site lacks the necessary bandwidth to support peak production traffic. What is the most appropriate management response?
Managing capacity through service degradation is a legitimate risk mitigation strategy when infrastructure is limited.
Why this answer
A warm site must be periodically validated against current production loads to ensure the SLA can be met.
A security manager is evaluating organizational security culture. Which indicator provides the most reliable evidence of a 'security-first' culture?
This indicates an empowered and vigilant workforce.
Why this answer
The reporting of near-misses by employees shows that staff are actively engaged in security awareness and feel safe identifying potential threats, which is a key trait of a mature security culture.
You are auditing a third-party disaster recovery service provider. Which metric provides the most accurate evidence that the provider can meet your organization's required recovery point for a database cluster?
Replication lag directly indicates the age of the data at the secondary site, which is the definition of RPO.
Why this answer
RPO is defined by data loss tolerance, which is best measured by the age of the last successful backup or replication point.
An ISSMP needs to ensure compliance with global data privacy regulations in a multinational environment. Which governance strategy provides the most consistent approach?
This creates a unified, compliant, and manageable framework.
Why this answer
Implementing a global privacy framework that defaults to the strictest common denominator ensures compliance across all jurisdictions, simplifying operational management.
In Splunk Enterprise Security, which dashboard should the SOC manager review to evaluate the effectiveness of the current correlation searches and the volume of notable events?
This dashboard displays the health and performance metrics of correlation searches.
Why this answer
The Content Management dashboard provides insights into the performance, trigger volume, and status of correlation searches.
A CISO is aligning the organizational information security strategy with the NIST Cybersecurity Framework (CSF) 2.0. Which specific function should the CISO prioritize to ensure that the organizational security culture promotes the identification of risks before they impact business operations?
The Govern function provides the oversight necessary to inform the organization's cybersecurity strategy and culture.
Why this answer
The 'Govern' function in NIST CSF 2.0 is specifically designed to establish the organizational context, risk management strategy, and cybersecurity supply chain risk management, which are foundational for aligning security culture with business objectives.
A Chief Information Security Officer (CISO) is establishing an ethics program. Which framework provides the most comprehensive international standard for establishing an Information Security Management System (ISMS) encompassing compliance and ethical conduct?
ISO/IEC 27001 is the standard for building and certifying an ISMS.
Why this answer
ISO/IEC 27001 is the global standard for ISMS, which inherently includes compliance and governance management.
During a merger, you identify two different risk assessment methodologies. What is the best strategy for the ISSMP?
A unified framework ensures consistency and comparable risk data.
Why this answer
Harmonizing methodologies allows for a unified risk view across the enterprise, which is essential for consistent governance.
Which THREE factors should an ISSMP consider when selecting security controls for a new system?
Controls must be relevant to the threats the organization faces.
Why this answer
Selecting controls involves balancing business requirements, regulatory compliance, and the actual threat landscape to ensure a proportionate risk response.
In the context of the SDLC, what is the primary purpose of a 'Software Bill of Materials' (SBOM)?
SBOMs are the standard for tracking dependencies for supply chain risk management.
Why this answer
An SBOM provides a comprehensive list of all components, libraries, and modules used in an application, which is crucial for managing supply chain security risks (e.g., identifying vulnerable dependencies).
Which TWO of the following are essential components of an effective security governance framework?
This ensures that people are assigned to execute and uphold the policies.
Why this answer
A comprehensive framework needs defined policies (what) and a structure of accountability (who) to ensure execution.
An ISSMP is leading a strategic security planning initiative using the balanced scorecard approach. Which perspective should be used to track metrics related to the workforce's proficiency and security awareness training success?
This perspective specifically tracks training, skills, and organizational culture.
Why this answer
In the balanced scorecard framework, the 'Learning and Growth' perspective focuses on the human capital, infrastructure, and culture necessary to achieve the organization's security goals.
Which of the following is a 'Key Risk Indicator' (KRI) for an organization's email security program?
An increasing failure rate indicates rising risk of compromise.
Why this answer
A KRI provides an early signal of increasing risk exposure. Phishing click-through rates measure effectiveness and exposure.
Which TWO of the following are primary components of an effective strategic security planning process as defined by (ISC)2 best practices for an ISSMP?
Fundamental for ensuring security supports rather than hinders business outcomes.
Why this answer
Strategic planning requires aligning security goals with business objectives and conducting a formal gap analysis to determine the current state versus the future state.
An organization is expanding into a new region. What is the most important first step for the ISSMP?
This provides the foundation for all subsequent security and compliance activities.
Why this answer
Conducting a regulatory and legal gap analysis ensures that the organization understands the compliance requirements of the new jurisdiction before initiating operations.
A CISO is aligning security objectives with the enterprise's Balanced Scorecard. Which perspective should the CISO focus on to demonstrate the value of security investments in achieving organizational mission readiness?
This aligns security controls with the key internal operations needed to achieve mission objectives.
Why this answer
The Internal Process perspective of the Balanced Scorecard focuses on the processes at which the organization must excel to satisfy shareholders and customers, which directly links security program maturity to organizational mission readiness.
Which THREE pieces of information should be included in an 'Incident Notification' for executive stakeholders?
Executives need to know how the incident is being resolved.
Why this answer
Executives need the business impact, the current status, and the next planned actions.
Which document defines the security requirements that must be met for a third-party vendor to integrate with the company's internal systems?
The ISA is the technical document governing the secure connection between systems.
Why this answer
The Interconnection Security Agreement (ISA) specifically outlines the security requirements and responsibilities for connecting two systems.
Which principle of 'Ethics in Security Leadership' dictates that a manager should prioritize the safety and privacy of the user over organizational convenience?
Stewardship requires putting the protection of the resource and user rights first.
Why this answer
The principle of stewardship and duty of care requires leaders to act in the best interest of the data subject.
Which TWO of the following are effective ways to promote a strong security culture?
This encourages transparency and learning over secrecy.
Why this answer
Culture is driven by leadership example and the empowerment of employees to take ownership of security as a shared responsibility.
A security analyst is troubleshooting a failed connection to an internal application that is protected by Zscaler Private Access (ZPA). Which tool should the analyst use to verify if the policy is blocking the request?
ZPA Diagnostics allows viewing the logs of connection attempts and the associated policy decisions.
Why this answer
The Zscaler 'Diagnostics' or 'Insights' portal provides detailed logs on why a specific user-to-app connection was denied or allowed.
Which TWO data sources are most critical for detecting lateral movement within a corporate network?
Authentication logs show the 'who' and 'where' of credential usage on other hosts.
Why this answer
Lateral movement is characterized by network traffic between internal hosts and authentication logs indicating access attempts.
Which THREE of the following strategies should be included in a 'Disaster Recovery Program Oversight' function to ensure long-term viability?
Business priorities shift; the BIA must be validated to keep DR efforts focused.
Why this answer
Oversight involves continuous validation through testing, alignment with changing business goals, and periodic audits of the documentation.
Which TWO of the following are key responsibilities of the CISO regarding corporate risk management?
Ensuring controls match the risk appetite is a primary CISO duty.
Why this answer
The CISO is responsible for translating technical risks into business impact and for ensuring that the organization's risk appetite is reflected in security controls.
In an environment governed by SOX (Sarbanes-Oxley), which feature of AWS IAM must be utilized to maintain strict 'Segregation of Duties' for account administrative tasks?
SCPs provide the guardrails necessary to prevent administrative overlap.
Why this answer
IAM Policies with explicit denies or restricted permission sets (like Service Control Policies) enforce segregation of duties in AWS.
A security manager is conducting a third-party risk assessment using the NIST Cybersecurity Framework. Which tool in the AWS Artifact portal is most appropriate for obtaining the necessary SOC 2 Type II reports to fulfill compliance auditing requirements?
AWS Artifact is the designated portal for obtaining compliance reports.
Why this answer
AWS Artifact provides on-demand access to AWS compliance reports, including SOC 2 Type II, for auditing purposes.
When integrating risk management with the SDLC, which activity represents the most effective 'Shift-Left' approach to mitigate design-level risk?
Threat modeling is the gold standard for identifying design risks early.
Why this answer
Threat modeling during the design phase identifies architectural risks before code is written.
Which THREE types of data should be ingested by a SIEM to improve its threat detection capabilities?
Identity logs allow detection of credential misuse.
Why this answer
A robust SIEM needs endpoint logs, network logs, and identity/access logs to correlate threats.
Your organization has decided to use a 'Cloud Disaster Recovery' service. The vendor provides a 'Pilot Light' strategy. What does this mean for your organization's recovery capability?
This is the definition of a pilot light approach, balancing cost and speed.
Why this answer
A pilot light maintains critical core components (e.g., database) in a running state, while application tiers are spun up on-demand during a disaster.
An ISSMP is conducting a security awareness program. What is the primary metric for measuring the success of this program?
This directly reflects the effectiveness of the training.
Why this answer
A reduction in actual security incidents or improved response to simulated phishing tests are direct indicators of improved security behavior, which is the program's goal.
When executive leadership discusses 'Acceptable Risk', they are referring to:
This is the definition of acceptable risk.
Why this answer
Acceptable risk is the remaining risk after controls are applied that remains within the organizational risk tolerance.
When designing the Crisis Communication Plan, why is it essential to establish pre-approved communication templates?
Pre-approved templates minimize time spent drafting messages and reduce the likelihood of inconsistent communication.
Why this answer
During a crisis, speed and accuracy are critical. Templates reduce cognitive load and prevent errors in messaging.
Your organization is performing a supply chain risk assessment. Which factor is most critical when evaluating a critical software vendor?
Assessing how they build software is the highest priority for supply chain security.
Why this answer
Vendor financial stability and their own security development lifecycle (SDL) are paramount for long-term supply chain risk.
Which THREE of the following should be included in an annual strategic security plan?
You must understand where you are to plan where to go.
Why this answer
A strategic plan must look at current maturity, future initiatives (projects), and the resources required to achieve those goals.
A project team is using Jira for issue tracking and wants to implement a formal change control board (CCB) approval workflow. Which feature should the ISSMP configure to ensure changes cannot be merged without approval?
Validators ensure that specific conditions, such as the presence of an approval comment or a specific flag, are met before a workflow transition occurs.
Why this answer
Using Jira's 'Workflow Validator' or 'Conditions' on the transition to the 'Ready for Production' status enforces that approvals (e.g., from an authorized manager) are logged before code can be merged.
A company is migrating legacy applications to AWS. The ISSMP mandates that changes to the production environment must follow a strict change control process. Which AWS native tool provides the necessary auditing and change management history for infrastructure changes?
CloudTrail logs every action taken in the AWS account, providing the audit log required for change management.
Why this answer
AWS CloudTrail provides the audit trail of API calls and infrastructure changes, which is the cornerstone of change control auditing.
A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?
Purview DLP identifies and restricts the sharing of PHI content.
Why this answer
Data Loss Prevention (DLP) policies in Microsoft 365 can be configured to detect PHI patterns and block or encrypt emails accordingly.
An organization uses a microservices architecture. How can the ISSMP ensure that inter-service communication is encrypted and that services are authenticated to one another?
A service mesh handles mTLS and identity at the infrastructure layer, independent of the application code.
Why this answer
Implementing a Service Mesh (e.g., Istio) provides mutual TLS (mTLS) for encrypted communication and cryptographic identity verification between services.
A Chief Risk Officer is utilizing the FAIR framework to quantify cyber risk. Which input is required to calculate the Loss Event Frequency?
Correct, these are the two components of Loss Event Frequency.
Why this answer
FAIR defines Loss Event Frequency as a function of Threat Event Frequency and Vulnerability. Threat Capability and Threat Event Frequency are primary drivers.
An organization uses Microsoft Sentinel. To ensure that an automated incident response playbook only triggers when a high-severity alert originates from a specific production subnet, where should the condition be defined?
Automation rules allow filtering by alert severity and entity values before triggering the playbook.
Why this answer
The logic app trigger conditions or the Sentinel Automation Rule 'If' conditions allow filtering based on alert properties like severity and entity fields.
Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?
Audit logs are mandatory to provide accountability for financial transactions.
Why this answer
SOX focuses on financial reporting integrity, specifically requiring access controls and audit trails.
When performing a risk assessment on a new SaaS implementation, which document is most useful for understanding the vendor's risk profile?
Provides verified information on control effectiveness.
Why this answer
A SOC 2 Type II report provides an independent auditor's assessment of the vendor's security controls over time.
An organization wants to monitor its compliance with CIS Benchmarks automatically. Which tool is best suited to provide an automated 'Compliance Score' against these benchmarks in a multi-cloud environment?
Defender for Cloud offers built-in regulatory compliance dashboards and CIS benchmark tracking.
Why this answer
Microsoft Defender for Cloud provides automated assessments against industry standards, including CIS Benchmarks.
Which THREE configurations are necessary to satisfy the 'Technical Safeguards' requirement under HIPAA for data at rest?
Encryption is the primary technical safeguard for data at rest.
Why this answer
HIPAA requires encryption and access control to protect ePHI at rest.
An ISSMP is reviewing an organizational risk register. Which field is essential for effective risk prioritization?
The rating allows for comparative prioritization of threats.
Why this answer
Risk Rating (often Impact x Likelihood) is necessary to rank risks for treatment.
You are implementing a disaster recovery strategy for a database that uses synchronous replication. What is the most significant trade-off you must accept by enforcing this configuration?
Synchronous replication mandates that the primary site waits for confirmation from the secondary, increasing write latency.
Why this answer
Synchronous replication guarantees zero data loss (RPO=0) but introduces latency overhead on write operations because the commit must wait for the acknowledgment from the secondary site.
When conducting a risk assessment on an IoT ecosystem, which THREE factors are specifically critical?
Many IoT devices are unpatchable.
Why this answer
IoT devices often have poor security (patching challenges), high network exposure, and physical access vulnerabilities.
When evaluating the effectiveness of a risk mitigation strategy, which stakeholder is most critical to involve in the sign-off process?
They own the risk and must accept the residual level.
Why this answer
The Business Process Owner is the ultimate owner of the risk and must accept the residual risk.
Which TWO of the following are primary risks associated with an 'asynchronous' data replication strategy?
Because there is a lag, some data loss is inevitable if the primary site fails suddenly.
Why this answer
Asynchronous replication introduces a lag, meaning if the primary fails, the latest data might not have reached the secondary, risking data loss.
What is the primary objective of a 'Security Gate' in an SDLC?
Security gates act as validation points to prevent security defects from moving downstream.
Why this answer
Security gates are checkpoints placed at the end of SDLC phases to verify that security requirements have been satisfied before proceeding to the next stage.
When reporting risk to the Board of Directors, which metric is most effective for demonstrating the value of an investment in a new EDR solution?
ALE reduction directly correlates to financial risk management.
Why this answer
Risk reduction is best demonstrated by showing the shift in risk posture (heat map movement) or cost-avoidance metrics.
A company is integrating a Third-Party API into their application. What must the ISSMP ensure is included in the risk assessment process?
Reviewing independent audit reports is a standard method for assessing third-party security posture.
Why this answer
The ISSMP must perform a 'Third-Party Risk Assessment' (TPRA) that evaluates the vendor's security controls, such as their SOC2 Type II report or ISO 27001 certification, to ensure the integration does not violate company security standards.
Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?
This ensures the processor does not exceed its authority.
Why this answer
GDPR Article 28 lists mandatory items for DPAs, including security obligations and rights of the data subject.
Which of the following best describes the 'Risk Management Framework' (RMF) process step of 'Assess'?
Assessment evaluates the implementation and effectiveness of selected controls.
Why this answer
In NIST SP 800-37, 'Assess' involves evaluating the controls to determine if they are implemented correctly and effective.
A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?
MFA is the mandatory control for explicit identity verification.
Why this answer
Requiring MFA and device compliance is the core component of explicit verification in Zero Trust.
The board of directors requests a quantitative risk assessment for a new cloud-based initiative. Which metric provides the best representation of potential financial exposure to the organization for a single, significant security event?
SLE is the direct product of the asset value and the exposure factor.
Why this answer
Single Loss Expectancy (SLE) is the monetary loss expected from a single security incident, making it the most direct metric for board-level financial exposure discussions.
A risk assessment reveals that a legacy system stores PII without encryption. The business cannot replace it. What is the most appropriate risk management action?
Implementing network segmentation or egress filtering mitigates the risk when encryption is impossible.
Why this answer
Mitigating the risk (compensating controls) is the standard professional approach when avoidance is not feasible.
Which THREE of the following are important considerations for an ISSMP when outsourcing security functions?
The organization cannot outsource its legal and regulatory responsibility.
Why this answer
Outsourcing requires careful legal review, performance monitoring (SLAs), and ensuring that the provider is properly integrated into the organization's overall risk management.
An organization is conducting a risk assessment and identifies a critical vulnerability in a legacy system that cannot be patched. Which of the following is the most appropriate risk management strategy to address this vulnerability?
Compensatory controls are designed to mitigate risk when the primary control (patching) cannot be implemented.
Why this answer
When patching is not possible, implementing compensatory controls (such as network segmentation or enhanced monitoring) is the standard approach to reduce the residual risk to an acceptable level.
When designing a security program, which TWO of the following factors should be considered to ensure the program can successfully scale with organizational growth?
Modular design allows for easier integration into new environments as the organization grows.
Why this answer
Scalability depends on automating processes where possible and ensuring the security architecture is modular and flexible to adapt to new business units or technologies.
During a software audit, it is found that developers have administrative access to the production database to troubleshoot errors. What change should the ISSMP implement?
JIT access provides temporary, audited credentials, minimizing standing privileges.
Why this answer
The ISSMP should implement a 'break-glass' access policy where developers can request temporary, audited access via a tool like HashiCorp Boundary or AWS IAM Identity Center, rather than having persistent standing access.
Which TWO aspects of the NIST Cybersecurity Framework (CSF) are most relevant when establishing a 'Compliance Program Management' function?
The 'Identify' function helps define the scope and regulatory requirements.
Why this answer
The CSF provides structure; 'Govern' and 'Identify' are the pillars for compliance management.
Which THREE of the following represent the primary responsibilities of executive leadership in fostering a strong organizational security culture?
Ensures security is a shared responsibility across the organization.
Why this answer
Executive leadership is responsible for setting the tone, providing resources, and ensuring accountability, which directly shapes the security culture of the organization.
Which document serves as the primary governing authority to define the triggers, escalation paths, and communication roles during a declared crisis event?
The CMP specifically addresses leadership, communication, and decision-making during crisis events.
Why this answer
The Crisis Management Plan provides the governance for decision-making during a crisis, whereas the DRP focuses on technical restoration.
During a disaster recovery simulation for a hybrid cloud environment, you discover that the automated orchestration tool fails to restore dependencies in the correct order because the cloud provider's metadata tags were purged. What is the most effective administrative control to prevent this during a real event?
Policy-based enforcement ensures metadata persistence required for automated recovery orchestration.
Why this answer
Maintaining configuration drift control and metadata persistence through Infrastructure as Code (IaC) is essential for automated recovery.
In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?
These enforce security standards including the prohibition of privileged containers.
Why this answer
Pod Security Admissions (formerly Pod Security Policies) can explicitly forbid privileged containers to maintain security benchmarks.
When managing a FortiGate firewall, which feature allows the SOC to dynamically update network objects based on external threat feeds?
External Connectors integrate with threat feeds to update dynamic address objects.
Why this answer
FortiGate 'External Connectors' allow the ingestion of dynamic threat intelligence lists.
Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?
The Govern function addresses organizational context and risk management strategy.
Why this answer
The 'Govern' function was elevated in CSF 2.0 to encompass enterprise risk management, strategy, and policy.
Which TWO factors should be used to weigh the 'Impact' in a risk assessment?
A direct financial component of impact.
Why this answer
Impact is generally measured by the potential loss to the business, focusing on availability, confidentiality, and integrity.
Which THREE actions are necessary when preparing to decommission a cloud-based Virtual Machine (VM)?
Snapshots can contain sensitive data that persists after the VM is deleted.
Why this answer
Decommissioning in the cloud involves ensuring data is wiped, access rights are removed, and the resources are actually terminated to prevent billing and security exposure.
When managing cross-functional security projects, which stakeholder communication strategy is most effective for securing project resources?
Demonstrating value in business terms is the most effective way to secure resources.
Why this answer
Linking security initiatives to business outcomes, such as reduced downtime or faster time-to-market, ensures that non-technical stakeholders understand the necessity of resource allocation.
When classifying business processes for BCP, what is the 'Recovery Time Objective' (RTO) most effectively used for?
RTO drives the technical design (e.g., hot vs. cold site) to meet the business window.
Why this answer
RTO informs the investment and technology choices for the recovery strategy to ensure service restoration occurs within the business-defined window.
Page 1 of 3
Page 2Practice ISC by domain
Target a specific domain to shore up weak areas.