Free Information Systems Security Management Professional (ISSMP) practice test: 30 questions with answers

Security governance ties the strategy to business objectives and gives executive leadership accountability for approving it. Option A keeps strategy inside the technical team, option C ignores differences in business risk, and option D outsources accountability that should stay internal.

A standard is the mandatory layer that turns policy intent into specific technical requirements. A policy is high-level, a guideline is only advisory, and a procedure is a sequence of task steps rather than a requirement.

The data owner is the accountable business executive who decides how data is classified and used. The database administrator is a custodian who implements controls, the auditor verifies them, and the end user only handles the data.

Security awareness changes attention and everyday behavior across the whole workforce, which is what bulletins and phishing simulations target. Role-based training builds job-specific skills, security education builds deep expertise for security professionals, and certification measures competency against an external standard.

A key risk indicator is an early warning that exposure is rising, and a count of critical open vulnerabilities trended against a threshold does that. Training completion, staff effort and help-desk timing are performance measures (KPIs) rather than early warnings of risk.

Risk appetite is the broad amount of risk an organization is willing to pursue, while risk tolerance is the acceptable deviation around a specific objective. The other options confuse the terms with loss limits or insurance, assign the wrong owners, or treat them as identical.

Before outsourcing personal data, the organization should verify the vendor's independent assessments and make sure the contract requires audit rights and breach notice. Price, placing internal tools on shared servers, and unverified marketing claims do not give that assurance.

Quantitative analysis assigns monetary values, and annualized loss expectancy equals single loss expectancy multiplied by the annualized rate of occurrence. Rating scales describe qualitative analysis, and quantitative analysis does depend on asset value and frequency data.

Qualitative scales are easy to use and can rank risks, but the ratings depend on the assessor's judgment, so results may not be consistent across people. The other options describe quantitative methods or deny the ranking ability that qualitative methods do have.

Design effectiveness shows the control is suitably designed, but operating effectiveness needs evidence that it was performed consistently. A sign-off without checked evidence does not prove operation, and reclassifying a control does not remove the need to test it.

In a tiered SOC, Tier 1 analysts triage incoming alerts and escalate suspicious events. Threat hunters, SOC managers approving containment, and forensic engineers each handle different work that comes later or runs separately.

Indicators such as hashes and IP addresses are technical intelligence that detection tools can match directly. Strategic and operational intelligence describe trends and actor intent, and executive briefings address business impact rather than detection data.

The five whys technique repeatedly asks why to trace a chain of causes to the root. A fishbone diagram sorts causes into categories, SWOT compares strategic factors, and Monte Carlo simulation estimates outcome ranges, so none of them is the repeated why method.

Containment limits the spread and impact of an incident while the threat is still present, which is what isolating the host and disabling the account do. Eradication removes the malware itself, and preparation and post-incident review happen before or after the active response.

Tuning rules against known benign activity and ranking alerts by asset criticality both reduce noise while keeping meaningful coverage. Turning off all rules removes detection, and sending every alert upward adds workload instead of reducing it.

Security requirements belong in initiation, before design, so that they shape the architecture and avoid expensive rework. Disposal, operations and post-deployment testing all happen later, when changes are costlier and less effective.

Remediation should follow risk, so findings are ranked by severity, asset criticality and exposure before patching begins. Patching in scanner order ignores risk, patching only low-severity items skips the most dangerous exposures, and pausing the scanner removes visibility without reducing risk.

An emergency change may be applied first, but it must still be documented and reviewed afterward so that the record and approvals stay accurate. Reversing it without a record, leaving it off the record, or waiting for a window all break change control.

A rollback plan defines how to restore the previous working state if a change fails. The change request, the risk acceptance letter and the code review each serve a different purpose and do not provide a recovery path.

Security testing should happen before release, and any open high findings need a documented, approved risk decision rather than being ignored. Accepting risk without a decision, delaying testing a full year, or removing the security team are all unacceptable.

Under GDPR, transfers to countries without an adequacy decision need appropriate safeguards, such as standard contractual clauses, in place before the data moves. A privacy policy, assumed trust within a corporate group, or notification after the fact does not satisfy that requirement.

The ISC2 Code of Ethics lists its canons in priority order, so the first canon, protecting society and the common good, takes precedence in a conflict. The other canons are also part of the Code but are ranked below it.

The auditor documents the finding with evidence, records management's response, and agrees a corrective action plan with dates. Removing the finding, implementing the fix personally (which impairs independence), or deferring it all weaken the audit function.

Good exception handling assigns an owner, sets an expiry date, and records the compensating controls and residual risk that leadership accepts. Approval by a team lead alone and skipping risk assessment both weaken the exception process.

Localization laws require records to be stored in-country, so the company must confirm the requirement before choosing where data will live. Trusting a provider's global footprint, relying on encryption, or relying on a standard contract alone assumes compliance without checking the requirement.

Maximum tolerable downtime is the longest time a business process can be disrupted before consequences become unacceptable. Recovery point objective measures data loss, mean time between failures measures reliability, and annualized loss expectancy measures expected yearly loss.

A warm site balances cost and speed by keeping some equipment in place, with data and configuration restored on activation. A cold site has no equipment, a hot site is fully live and costlier, and a reciprocal agreement shares another organization's capacity rather than providing a dedicated site.

A tabletop exercise is discussion-based, with staff walking through the plan without disrupting production or switching systems. The full-interruption and parallel tests actually activate recovery systems, and a notification test only checks contact information.

A disaster recovery plan focuses on restoring IT systems, applications and data after a disruption. A business continuity plan covers the broader continuity of critical processes, an incident response plan handles security events, and a crisis communications plan manages messages.

A recovery point objective is the tolerable amount of data loss, and daily backups can lose up to a full day of transactions, which exceeds a few hours. The recovery time objective, a completed analysis and a hot site do not close the gap in backup frequency.