Information Systems Security Management Professional (ISSMP)

Last checked November 10, 2026 against the official ISC2 exam page.

1. Question 1Leadership and Organizational Management

   The CISO of a regional hospital wants the security program to reflect the organization's priorities rather than only technical preferences. Which governance approach best achieves this?

   1. ALet the security team set its own priorities and report metrics to the IT director each quarter
   2. BTie the security strategy to business objectives and obtain approval from an executive governance committee
   3. CApply the strictest control framework available to every department so that no business unit is left behind
   4. DHand all strategic planning to an external consultant so that the program stays neutral
   Show answer and explanationHide answer

   Correct answer: B

   Security governance ties the strategy to business objectives and gives executive leadership accountability for approving it. Option A keeps strategy inside the technical team, option C ignores differences in business risk, and option D outsources accountability that should stay internal.

2. Question 2Risk Management

   Which statement correctly distinguishes risk appetite from risk tolerance?

   1. AAppetite is the maximum loss the company can absorb financially; tolerance is the premium paid for cyber insurance
   2. BAppetite is set by the external auditor; tolerance is set by the board of directors for each system
   3. CAppetite is the level of risk pursued in general; tolerance is acceptable variation for a specific objective
   4. DAppetite and tolerance are two names for the same residual-risk threshold used in risk reports
   Show answer and explanationHide answer

   Correct answer: C

   Risk appetite is the broad amount of risk an organization is willing to pursue, while risk tolerance is the acceptable deviation around a specific objective. The other options confuse the terms with loss limits or insurance, assign the wrong owners, or treat them as identical.

3. Question 3Security Operations

   In a tiered SOC, which group usually performs the first triage of alerts and escalates suspicious events to more experienced analysts?

   1. ATier 1 analysts who triage incoming alerts and decide which events need escalation
   2. BThe SOC manager, who approves all containment actions before they are carried out
   3. CForensic engineers who image affected systems once a confirmed incident is declared
   4. DTier 3 threat hunters who develop new detection logic from observed attacker behavior
   Show answer and explanationHide answer

   Correct answer: A

   In a tiered SOC, Tier 1 analysts triage incoming alerts and escalate suspicious events. Threat hunters, SOC managers approving containment, and forensic engineers each handle different work that comes later or runs separately.

4. Question 4Systems Lifecycle Management

   At which lifecycle stage should security requirements be identified so that they shape system architecture and design rather than being added after deployment?

   1. AInitiation and requirements definition, before design work starts
   2. BDisposal and secure sanitization of retired media and equipment
   3. CProduction operations, once monitoring and support processes are in place
   4. DPost-deployment penetration testing, performed by an outside firm
   Show answer and explanationHide answer

   Correct answer: A

   Security requirements belong in initiation, before design, so that they shape the architecture and avoid expensive rework. Disposal, operations and post-deployment testing all happen later, when changes are costlier and less effective.

5. Question 5Law, Ethics and Security Compliance Management

   A company in the European Union plans to send employee records to a processor in a country that has no EU adequacy decision. Which approach is appropriate?

   1. AMake the transfer now and notify the national data protection authority once the records have arrived
   2. BRely on the processor's published privacy policy, which describes how it protects personal data
   3. CTransfer the records because both companies belong to the same corporate group and share policies
   4. DPut an approved transfer safeguard, such as standard contractual clauses, in place before sending data
   Show answer and explanationHide answer

   Correct answer: D

   Under GDPR, transfers to countries without an adequacy decision need appropriate safeguards, such as standard contractual clauses, in place before the data moves. A privacy policy, assumed trust within a corporate group, or notification after the fact does not satisfy that requirement.