(ISC)2 Information Systems Security Management Professional (CISSP-ISSMP, Aug 2025 blueprint) (ISC) (ISC) — Questions 76–150

What is the primary role of a Change Advisory Board (CAB)?

Your organization has adopted a cloud-native microservices architecture. Which strategy is most appropriate for maintaining business continuity in the event of a regional cloud provider outage?

An ISSMP is implementing a Disaster Recovery (DR) plan. Which objective is most important to define with business leaders?

When decommissioning an application, which action should the ISSMP prioritize to ensure data privacy requirements (e.g., GDPR) are satisfied?

When transitioning to an Agile development methodology, which security management approach best supports the 'Shift Left' security strategy?

Which risk response strategy is being employed when a company purchases cyber insurance?

In the context of ISO 31000, what is the primary purpose of 'Risk Communication and Consultation'?

What is the primary difference between a 'Risk Assessment' and a 'Vulnerability Assessment'?

In the context of the Google Cloud Security Command Center (SCC), which feature provides a prioritized list of findings based on the criticality of the impacted asset?

Which SOC process ensures that all security tools are configured to log at the same time standard to prevent confusion during timeline analysis?

A firm must adhere to the EU's Digital Operational Resilience Act (DORA). Which activity is the primary compliance requirement for 'Third-Party Risk Management' under this regulation?

Which of the following is an example of a detective control in a risk management program?

An ISSMP is reviewing the Business Continuity Plan (BCP) for a critical application. Which TWO of the following factors should be considered when defining the 'Maximum Tolerable Downtime' (MTD)?

When establishing a security governance framework, what is the most critical element for ensuring long-term program success?

An ISSMP is reviewing the 'Change Control' process for a critical system. Which of the following is an essential element for every change request?

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

What is the primary objective of a 'lessons learned' meeting conducted after a disaster recovery exercise?

During a waterfall-to-Agile transition, the development team wants to bypass formal Security Requirements Traceability Matrix (SRTM) documentation in favor of user stories. How should the ISSMP reconcile this?

When reporting to the board of directors, which presentation method is most effective for communicating security performance?

When presenting a risk treatment plan to the Board of Directors, which THREE elements should be included to ensure executive buy-in?

Which TWO of the following are potential risks if an ISSMP fails to integrate security into the 'Requirements Management' phase?

Your organization uses a 'Hot Site' with hardware-level replication. During a disaster, the primary site becomes unavailable, but the failover fails due to a 'Split-Brain' scenario. What is the fundamental cause of this?

When aligning security with organizational goals, how should an ISSMP address a conflict between security controls and user productivity?

Which feature in Okta is essential for meeting compliance requirements regarding 'Identity Assurance' and 'Strong Authentication' mandated by financial regulations?

When conducting a compliance audit, what is the purpose of a 'Gap Analysis'?

An ISSMP is revising the BCP to account for 'Supply Chain Resiliency'. Which approach is best for verifying that critical third-party vendors can meet the organization's recovery requirements?

Which THREE of the following are essential components of a robust Crisis Management Plan?

You are performing a qualitative risk assessment. Which factor must be prioritized to ensure the assessment is aligned with the organizational risk appetite?

A US-based company is processing data of German citizens. To comply with the Schrems II ruling, which contractual mechanism must they document in their vendor risk management registry?

Which TWO factors must a security officer consider when performing a 'Privacy Impact Assessment' (PIA) for a new cloud application?

Which document is primarily responsible for documenting the security controls applicable to a system during the SDLC's requirements phase?

When configuring CrowdStrike Falcon to isolate a host during an active incident, what is the prerequisite requirement for the agent's communication state?

Which THREE actions should be taken when performing an incident post-mortem according to industry best practices?

A multinational organization needs to align its security policies with various regional privacy regulations (e.g., GDPR, CCPA). What is the best strategy to achieve this?

Your organization is evaluating the procurement of a new SaaS platform. As the ISSMP, you are responsible for integrating security into the vendor risk management process. Which action is most critical during the 'Due Diligence' phase?

When managing a global security team, what is the primary challenge in maintaining a uniform security posture?

Which TWO of the following are critical components of a secure SDLC (Software Development Life Cycle) implementation?

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

A CISO needs to justify an increase in the security budget. Which argument is most persuasive to the Chief Financial Officer (CFO)?

A multinational organization is deploying an automated compliance monitoring solution across its cloud environments. Which GDPR-related mechanism must the security manager prioritize when configuring data residency policies in Microsoft Purview to ensure automated cross-border transfer controls?

Which TWO mechanisms are effective for preventing 'insecure direct object references' (IDOR) in a web application during the development phase?

You are integrating an enterprise risk register with a GRC tool (e.g., Archer). Which method provides the most accurate view of 'Residual Risk' to the board?

Which TWO of the following are primary components of an effective Incident Response (IR) program?

An ISSMP is performing a security assessment on an application using containerized microservices. The team uses Kubernetes. What is the most effective way to ensure security configurations are consistently applied across all clusters?

Which of the following is a 'Leading Indicator' for an enterprise risk management program?

An organization wants to improve its security posture against supply chain attacks. Which action is most effective for an ISSMP?

A data controller is managing personal data under GDPR. Which tool within the AWS ecosystem allows the controller to locate and inventory all instances of 'Personal Data' across S3 buckets to support Data Subject Access Requests (DSARs)?

As a Chief Information Security Officer (CISO), you need to ensure that the security program is aligned with organizational business objectives. Which activity best demonstrates this alignment?

When managing a security incident, what is the primary role of the CISO in a large enterprise?

Which leadership style is most effective for building a strong security team during a period of rapid organizational growth?

In Okta, to restrict administrative access to a specific geographic region during an active session, which policy should be modified?

In Rapid7 InsightVM, what is the best way to categorize assets into groups based on their business function for targeted vulnerability reporting?

An organization is adopting Infrastructure-as-Code (IaC) using Terraform. The ISSMP wants to ensure no insecure configurations (e.g., S3 buckets with public read) are deployed. What should be integrated into the CI/CD pipeline?

When assessing the risk of a third-party service provider, which THREE areas should be evaluated?

Which THREE technical controls are effective for limiting the impact of lateral movement?

To ensure adherence to the PCI DSS 4.0 requirement for log integrity, which configuration in a centralized SIEM like Splunk is mandatory to prevent unauthorized modification of audit logs?

Which TWO of the following are metrics that provide insight into the effectiveness of security leadership?

An organization is concerned about 'Cloud Concentration Risk'. What is the best mitigation strategy?

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Which of the following is the most effective method for testing the efficacy of a Business Continuity Plan without disrupting production operations?

Which THREE of the following are challenges in transitioning to a secure DevSecOps model?

An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?

For an organization to maintain compliance with the GLBA (Gramm-Leach-Bliley Act), which mechanism within Azure Key Vault is required to demonstrate evidence of 'Key Rotation' and 'Access History'?

When configuring a Cisco ASA firewall to log deny events to a remote Syslog server, what is the minimum logging level required to ensure that denied packets are captured?

Which THREE activities are included in the 'Preparation' phase of the IR life cycle?

An organization is deploying a globally distributed application. The ISSMP needs to ensure that code changes are signed to prevent tampering. Which process should be implemented in the build pipeline?

A security manager is drafting a security policy. Which element is essential for ensuring executive support and establishing the policy's organizational authority?

What is the primary function of an 'Exception Process' in a risk management program?

In the context of risk reporting, what does a 'Risk Heat Map' effectively communicate to the board?

As an ISSMP, you are defining the organizational security culture. Which activity is the most effective way to demonstrate executive commitment to security?

When configuring a Qualys scanner to perform authenticated scans on Windows, what is the 'Windows Authentication Record' primarily used for?

Which TWO of the following are primary components of a formal Risk Management policy?

Which TWO communication channels are typically used for emergency incident coordination within a SOC?

Which TWO techniques are effective for securing the software supply chain?

A CISO is presenting a security program roadmap. Which approach is best for managing expectations regarding security maturity?