219 questions total · 3pages · All types, answers revealed
Page 3 of 3
During an incident, which document is used by the SOC to record evidence, timestamps, and actions taken to ensure admissibility in a legal proceeding?
This document ensures the integrity and legal admissibility of evidence.
Why this answer
The Chain of Custody document tracks the handling of evidence from discovery through to investigation.
An organization wants to improve its security posture by adopting a continuous monitoring approach. Which approach is most effective for an ISSMP to champion?
This approach enables real-time visibility and faster response to emerging threats, which is central to continuous monitoring.
Why this answer
Continuous monitoring requires integrated data collection, automated analysis, and real-time reporting to provide actionable insights, which is the definition of a robust monitoring strategy.
When building an Enterprise Risk Management (ERM) program, which THREE factors must be considered to ensure integration with the organization?
Seamless operation is key to adoption.
Why this answer
ERM is successful when it aligns with the culture, business goals, and organizational structure.
An ISSMP is overseeing the integration of security into a new DevOps pipeline using Jenkins. Which stage of the SDLC should the ISSMP enforce the execution of SAST tools to ensure security requirements are met early?
SAST is most effective when integrated into the build/development phase to provide immediate feedback.
Why this answer
Security integration requires SAST (Static Application Security Testing) to be performed during the development phase, specifically as part of the commit or build process.
When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?
Playbooks are the workflows that define the automated steps and cross-tool actions.
Why this answer
The XSOAR 'Playbook' engine manages the logic flow and script execution across various integrated products.
Which TWO methods are commonly used to identify new risks in an enterprise environment?
Provides external context for new threats.
Why this answer
Risk identification is often driven by systematic reviews (audits/assessments) and data-driven analysis (threat intelligence).
Which TWO of the following are common challenges in quantitative risk analysis?
Requires specialized skills and significant time.
Why this answer
Quantitative risk analysis suffers from lack of reliable data and the complexity of modeling.
Which THREE of the following are key indicators of a mature security governance program?
Active oversight by the board is a hallmark of maturity.
Why this answer
Mature programs are characterized by metrics-driven processes, integration with enterprise functions, and active, informed oversight by the board.
You are utilizing a quantitative risk analysis. What is the 'SLE' in the context of an ARO-based calculation?
Correct definition.
Why this answer
The Single Loss Expectancy (SLE) is the monetary value of a single loss event.
An organization must comply with CCPA/CPRA requirements regarding 'Right to Delete'. In a hybrid environment utilizing Google Cloud Platform, which mechanism is best suited for implementing automated lifecycle policies to satisfy deletion requests across Cloud Storage buckets?
Lifecycle rules are designed to automate object deletion to meet compliance retention/deletion needs.
Why this answer
Lifecycle management policies in Cloud Storage are the standard way to automate data deletion based on specific conditions to meet privacy regulations.
Which TWO of the following are core components of a business-aligned security strategy?
This ensures the most significant risks are addressed first.
Why this answer
Alignment requires understanding the business's current state and risk profile, and ensuring that security projects are prioritized to support the most important business functions.
A CISO is managing a security budget with high pressure for cost optimization. Which strategy provides the best balance between security and cost efficiency?
This ensures investments are directed where they provide the most protection.
Why this answer
Risk-based resource allocation allows the security team to prioritize investments on the highest-impact threats, ensuring maximum ROI on security spending.
An ISSMP is developing a cross-functional incident response team. Which THREE roles or functions are absolutely critical to include to ensure comprehensive handling of a major security breach?
Legal is essential for handling regulatory notifications, liability, and evidence handling.
Why this answer
A major incident requires more than just technical response; it requires legal oversight, communication strategies, and executive decision-making capabilities.
To ensure security requirements are integrated into the System Development Life Cycle (SDLC), what is the most effective approach for the security team?
This allows for continuous security advocacy and integration.
Why this answer
Embed security champions within development teams to act as liaisons, ensuring security is considered throughout the development process rather than treated as a final check.
Which organizational structure is most effective for a CISO to influence security behavior across geographically dispersed and independent business units?
Provides the balance of authority and influence needed in large, complex organizations.
Why this answer
A matrix management structure allows the CISO to exert influence through both functional and operational lines, ensuring security standards are consistent while respecting business unit autonomy.
Which TWO actions are part of the 'Risk Monitoring' process?
KRIs provide continuous visibility into risk trends.
Why this answer
Monitoring ensures that risks remain within appetite and that mitigation strategies are actually working.
In an incident response plan, which metric is most useful for measuring the 'dwell time' of a threat actor?
MTTD directly relates to how long a threat remains active before it is discovered.
Why this answer
Dwell time is the period between the initial compromise and the time the organization detects the breach.
During the maintenance phase, a production database needs a schema change. The ISSMP requires that this change be tested in a staging environment that mirrors production. Which process best demonstrates compliance with the 'Separation of Duties' principle?
This ensures that development, approval, and deployment are performed by different entities.
Why this answer
Separation of duties requires that the person who develops the change (DBA) is different from the person who approves the change (Change Manager) and the person who performs the production deployment (Release Engineer).
Which THREE factors must be considered during the 'Compliance Program Management' phase when evaluating whether to adopt a new cloud-based tool?
If you cannot audit it, you cannot prove compliance.
Why this answer
Adopting new tools requires balancing risk, regulatory adherence, and technical capability.
You are managing third-party risk. Which tool or method is most appropriate for a continuous assessment of a cloud service provider (CSP)?
CSPM tools offer the continuous visibility required for modern cloud risk management.
Why this answer
Cloud security posture management (CSPM) provides continuous monitoring against compliance and risk frameworks.
Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?
This phase includes cleaning systems and returning them to production.
Why this answer
Recovery includes restoring systems to normal operation and confirming they are secure.
Which THREE criteria are essential for establishing a successful 'Risk Committee'?
Diverse viewpoints are essential for enterprise risk.
Why this answer
A successful committee needs diverse perspectives, executive support, and a defined mandate.
Which THREE components should be included in an application security requirements document?
MFA is a standard security requirement for most applications.
Why this answer
Requirements must include authentication, authorization, and data encryption standards to ensure the application is secure by design.
Which THREE factors are required to calculate the 'Risk' of a vulnerability for reporting purposes?
Impact depends on how critical the asset is to the business.
Why this answer
Risk is typically calculated as Likelihood x Impact, where Likelihood is influenced by Threat and Vulnerability, and Impact is determined by Asset Criticality.
Which phase of the SDLC is most appropriate for conducting a formal Threat Modeling exercise?
The design phase is the optimal time to identify threats against the architecture.
Why this answer
Threat modeling is most effective during the design phase because it allows architects to identify and mitigate design-level security flaws before implementation begins.
An organization is migrating to a hybrid cloud environment and is updating its security architecture. Which of the following is the MOST effective way to ensure consistent security policy enforcement across both on-premises and cloud environments?
A unified policy framework provides a consistent set of rules and controls, which simplifies management and auditing while reducing the risk of configuration errors.
Why this answer
Implementing a unified security policy framework ensures that security requirements are standardized and consistently applied regardless of the underlying infrastructure. This approach reduces complexity and human error in policy management.
What is the primary objective of a Business Impact Analysis (BIA)?
The BIA focuses on availability and process continuity.
Why this answer
The BIA identifies critical business processes and the impact of their disruption, which informs the BCP/DR plan.
Which THREE items are typically verified in a Security Gate check before a production deployment?
Governance requires proof of approval before production changes.
Why this answer
Production gates check for vulnerability remediation, passing functional/security tests, and the presence of required documentation (like the change request).
Which document establishes the high-level security objectives and the roles/responsibilities of senior management within an organization?
This defines the purpose and authority of the security function.
Why this answer
The Security Charter or Security Governance Framework outlines the scope, mandate, and leadership roles required to oversee the security program.
During a cross-functional security planning session, the IT operations team argues that security controls are negatively impacting system performance. As an ISSMP, what is the most appropriate management approach to resolve this conflict?
A BIA allows all stakeholders to quantify the risk and make a consensus-based decision.
Why this answer
Effective security management involves balancing security needs with business operational requirements through a collaborative risk-based approach, ensuring security is integrated rather than imposed.
A project manager wants to bypass a security vulnerability finding because 'the patch will break the application'. What is the correct ISSMP response?
When a security control cannot be implemented, the risk must be formally accepted by the accountable business owner.
Why this answer
The ISSMP must initiate a formal Risk Acceptance process, requiring the business owner to acknowledge the residual risk and documenting it in the risk register.
An organization is adopting a Zero Trust Architecture (ZTA). Which management principle is critical for the long-term success of this transition?
ZTA relies on the assumption that no user or device is inherently trusted.
Why this answer
Continuous monitoring and verification are the fundamental principles of ZTA; without them, the architecture cannot adapt to changing threat landscapes.
When presenting a security budget request to the Board of Directors, which THREE of the following elements should be included to ensure the request is compelling and understood?
Demonstrating the value of the spend is essential for executive approval.
Why this answer
Board members prioritize risk-based arguments over technical jargon. They need to understand the impact on business outcomes, the current risk level, and the return on investment (or cost of inaction).
Which THREE of the following are critical for successfully managing cross-functional security initiatives?
Business leaders are more likely to support initiatives that help them reach their goals.
Why this answer
Success in cross-functional work requires stakeholder involvement, clear communication of the business value, and shared ownership of the outcomes.
Which TWO items must be documented in a Change Control Log after a successful production change?
Audit trails require precise timestamps for all changes.
Why this answer
A change log must include the final outcome (status) and the timestamp to ensure traceability and audit accuracy.
Which THREE of the following are common indicators that a security program is failing to align with business objectives?
This shows that business units are solving problems without IT/security approval.
Why this answer
Lack of executive support, high levels of friction, and shadow IT are all strong indicators of a disconnect between security strategy and business goals.
In VMware Carbon Black Cloud, which feature should be enabled to block unauthorized scripts while allowing signed binaries from trusted software vendors?
ATP policies provide granular control over process execution based on trust.
Why this answer
The 'Advanced Threat Prevention' policies allow for specific exclusion and blocking rules based on file reputation and signing certificates.
An ISSMP is evaluating a Cloud Access Security Broker (CASB) implementation. Which management goal is most effectively addressed by this tool?
CASB is specifically designed to bridge the visibility gap in cloud environments.
Why this answer
A CASB provides visibility and control over cloud usage, enabling the enforcement of corporate security policies on data stored or accessed in cloud applications.
An enterprise is moving to a 'Zero Trust' architecture. How does this impact the risk assessment process?
Zero Trust assumes breach; therefore, risk must be assessed per transaction and per asset.
Why this answer
Zero Trust shifts the focus from network perimeters to identity and device health, requiring a more granular, asset-centric risk assessment.
In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?
VPR uses real-time threat intelligence to measure the urgency of remediation.
Why this answer
The Vulnerability Priority Rating (VPR) incorporates threat intelligence and exploit code availability, making it more accurate for risk-based prioritization than CVSS alone.
When designing a Disaster Recovery Program, which THREE of the following represent common 'single points of failure' that must be addressed?
If only one person can declare a disaster, the process fails if that person is incapacitated.
Why this answer
Resilience requires removing dependencies on single, irreplaceable entities (people, physical locations, or specific gateway devices).
When drafting an organizational 'Acceptable Use Policy' (AUP), which element is most critical to ensure legal enforceability in a professional environment?
The signature provides the evidence needed to hold users accountable.
Why this answer
A signed acknowledgement of the AUP is necessary to establish legal evidence that the user was aware of the policy expectations.
In a decentralized organization, which approach to BCP management ensures both local agility and global alignment?
This provides the balance of local flexibility and enterprise-wide compliance.
Why this answer
A federated model allows individual business units to customize plans to their specific needs while adhering to a common global framework/policy.
Which of the following is the most important factor to consider when evaluating the effectiveness of a security training and awareness program?
The primary goal of security awareness is to reduce human risk, which is best measured by behavioral changes.
Why this answer
Behavioral changes, such as reduced click rates on phishing simulations and increased reporting of suspicious activities, are the best indicators of a successful security awareness program.
Which document describes the specific steps an analyst should take when a 'Phishing' alert is triggered in the SIEM?
Playbooks provide the operational, step-by-step instructions for specific incident types.
Why this answer
A Playbook or Runbook provides step-by-step guidance for specific, repeatable incident types.
During a BIA review, you need to identify critical assets and their recovery requirements. Which TWO of the following inputs are essential for this classification process?
Business owners identify which processes are critical to business survival.
Why this answer
The BIA requires both understanding of the process importance and the technical dependencies (what systems are actually used).
When implementing FIM (File Integrity Monitoring) in Tripwire Enterprise, what is the specific purpose of a 'Promotion' action?
Promotion is the mechanism to officially acknowledge a change as authorized and update the baseline.
Why this answer
Promotion updates the 'Known Good' baseline with the state of the monitored file from a current scan.
When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?
Defining the scope is the prerequisite for all subsequent steps.
Why this answer
Identification of regulatory requirements (scope) is the foundation of any compliance program.
Which TWO of the following are effective communication strategies for a CISO interacting with senior executives?
This connects security to the executive's world.
Why this answer
Executives need concise, business-focused information that allows them to make informed decisions about risk and resource allocation.
Which metric provides the best insight into the effectiveness of the security program within the SDLC?
MTTR measures how quickly security issues are resolved, which is a key indicator of effective security lifecycle management.
Why this answer
The 'Vulnerability Density' (vulnerabilities per KLOC) or 'Mean Time to Remediation' (MTTR) are the most effective metrics for demonstrating SDLC security health.
When analyzing network traffic in Wireshark for potential exfiltration, what specific filter allows you to isolate TCP traffic where the payload size exceeds 10MB?
The 'tcp.len' field represents the length of the TCP payload, and the filter evaluates this against the 10MB threshold.
Why this answer
While Wireshark does not have a single simple filter for payload size without complex length calculations, the correct syntax involves identifying TCP segments that contain payload.
An ISSMP is managing a merger where two organizations use different identity providers. Which strategy best mitigates identity-related risk during the integration phase?
Federation provides a secure, scalable way to manage cross-organizational identities.
Why this answer
Establishing a federated identity model allows for centralized management and consistent access control policies across both entities without forcing an immediate migration.
Which TWO of the following are effective ways to improve 'Crisis Management Leadership' effectiveness during an incident?
Having a single point of truth for communication prevents misinformation.
Why this answer
Leadership requires clear delegation and effective, structured communication to prevent panic and ensure well-informed decisions.
To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?
XAI allows for feature attribution, providing the 'right to explanation'.
Why this answer
Vertex AI Explainable AI provides insights into how models make predictions, satisfying transparency requirements.
Which document is the primary source for defining the 'Risk Appetite' of an enterprise?
This defines the amount of risk an organization is willing to accept.
Why this answer
The Risk Appetite Statement is the foundational document authorized by the board/senior management.
Which THREE of the following are considered 'Risk Assessment' methodologies?
The NIST guide for conducting risk assessments.
Why this answer
Common risk assessment methodologies include NIST RMF, FAIR, and ISO 27005.
Which of the following is a key component of a successful security awareness training program?
This ensures the message is understood and remembered.
Why this answer
Regular, relevant, and engaging content is necessary to keep security top-of-mind for employees and to ensure long-term retention of good security practices.
During a BCP planning session, the executive team is debating the 'Maximum Tolerable Downtime' (MTD) for a legacy internal application. What is the correct way to define this metric?
MTD represents the upper limit of downtime tolerance before irreversible business impact occurs.
Why this answer
MTD is the total time a process can be down before the organization suffers catastrophic/irreversible harm.
Which SOC metric is most appropriate to present to executive leadership to demonstrate the business value of security investments?
MTTR demonstrates operational efficiency and reduced risk exposure time.
Why this answer
Executive leadership cares about the reduction in risk and the financial impact of incidents, not technical metrics like 'events per second'.
Which TWO metrics are essential for evaluating the performance of a SOC team in identifying and containing threats?
Measures how fast the SOC identifies a potential breach.
Why this answer
MTTD and MTTC are standard industry metrics used to measure SOC efficiency.
You are reviewing the organization's Incident Response Plan (IRP). According to the NIST SP 800-61 framework, which phase requires the highest level of coordination between legal, human resources, and IT departments?
This phase necessitates the most complex multi-departmental decision-making during an active event.
Why this answer
The 'Containment, Eradication, and Recovery' phase requires intense cross-functional coordination, especially when legal and HR involvement is needed for evidence preservation or employee-related policy enforcement.
As an ISSMP developing a security governance program, which THREE of the following activities are essential to ensure the program remains effective and compliant?
Provides the governance structure and oversight required.
Why this answer
Governance requires continuous monitoring, clear policy oversight, and defined accountability structures, which are achieved through these three activities.
Which TWO of the following are valid responses to a high-risk finding?
A standard way to transfer financial impact.
Why this answer
Risk treatment options are generally to mitigate, transfer, avoid, or accept.
Which document is considered the primary 'source of truth' for defining the SOC's roles, responsibilities, and communication paths during a major security incident?
The IRP outlines the management, roles, and escalation procedures for incidents.
Why this answer
The Incident Response Plan (IRP) defines the strategy and governance for responding to incidents.
What is the primary purpose of an Incident Response (IR) plan?
Standardization ensures efficiency and reduces panic during incidents.
Why this answer
An IR plan provides a structured, predefined approach to handling security incidents to minimize impact and ensure business continuity.
An ISSMP is overseeing a BCP program and notes that the current Business Impact Analysis (BIA) is heavily focused on RTO but lacks a critical dependency mapping for cross-functional business processes. Which specific action should the ISSMP prioritize to address the systemic risk of cascading failure during a disaster?
The Supply Chain Operations Reference (SCOR) model is effective for mapping internal process dependencies.
Why this answer
BIA must move beyond simple RTO/RPO metrics to identify upstream and downstream process dependencies to ensure that recovery orchestration remains viable.
An organization is moving from a reactive security posture to a proactive threat-informed defense. As the ISSMP, you are implementing the MITRE ATT&CK framework. Which executive-level metric best demonstrates the maturity of the security program to the Board of Directors regarding this transition?
This metric directly ties the security program's capabilities to real-world adversary behaviors.
Why this answer
Mapping security coverage to MITRE ATT&CK techniques provides a quantifiable measure of defensive maturity that boards can understand, representing the shift from reactive compliance to proactive threat management.
Following a ransomware attack, the organization must decide whether to invoke the DRP or remain in a degraded state while security teams perform forensics. What is the ISSMP's primary responsibility in this decision-making process?
The ISSMP acts as an advisor to ensure the chosen path reflects the established risk appetite.
Why this answer
The ISSMP must facilitate the risk-based decision between recovery speed (DRP) and evidence preservation (Forensics).
A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?
This action explicitly forces the revocation of all currently active refresh tokens.
Why this answer
The 'Revoke sessions' action in the Entra ID user blade forces the user to re-authenticate and clears all current refresh tokens.
Page 3 of 3
Practice ISC by domain
Target a specific domain to shore up weak areas.