A newly appointed CISO is asked by the board to align the security program with the organization's vision and mission. Which approach BEST establishes security's role in organizational culture?
Issmp Leadership Business
Question · Easy
New hire access: Expectation vs Reality
Short
Which metric is BEST classified as a Key Risk Indicator (KRI) rather than a Key Performance Indicator (KPI)?
Question · Hard
A CISO must justify a $1.2M investment in a new endpoint detection and response (EDR) platform. Which financial metric BEST demonstrates security-specific return on investment?
Question · Medium
Tech Exam Prep Podcast
Listen on Spotify
Podcast
When reporting to the board of directors, which presentation style is MOST appropriate for a CISO?
Which framework is MOST appropriate for aligning a U.S. organization's enterprise security program with widely adopted, voluntary cybersecurity outcomes?
AWS or YOU?
A security program manager wants to drive durable behavior change after repeated phishing failures. Which organizational change management approach is MOST effective?
Which document defines the high-level intent and management commitment for the information security program?
A CISO is building a security awareness program. Which is the MOST important success factor at the management level?
An organization is evaluating whether to insource or outsource its 24x7 SOC. Which factor is MOST important from an ISSMP governance perspective?
Which RACI assignment is MOST appropriate for the executive sponsor of a major security program?
A CISO is preparing the annual security budget. Which approach BEST demonstrates fiduciary stewardship to the audit committee?
Which structure BEST positions the CISO to influence enterprise risk decisions independent of operational IT pressure?
A CISO inherits a program with no documented strategy. Which deliverable should be produced FIRST to align with management best practice?
Which document type is signed by senior leadership to define top-level enterprise security objectives and is reviewed at least annually?
A CISO must select metrics for a quarterly executive dashboard. Which set BEST balances leading and lagging indicators?
An ISSMP candidate is evaluating two security investments with different time horizons. Which financial technique BEST accounts for the time value of money?
Which is the BEST way for a CISO to engage internal stakeholders during a major security policy rewrite?
A board asks the CISO 'Are we secure?' What is the BEST response?
Which best describes the ISC2 Code of Ethics canons in their official order of precedence?
A CISO discovers two senior managers withholding incident information from the ethics committee. Per ISC2 ethics canons, what is the appropriate first action?
A CISO must communicate to the workforce that security incident reporting will not be punished. Which leadership concept does this BEST embody?
Which gate represents the EARLIEST point at which security requirements should formally enter a Secure SDLC?
Issmp Systems Lifecycle
A CISO governs a portfolio of 50 SaaS applications. Which control BEST manages risk introduced by new SaaS adoption?
Which Secure SDLC activity provides the EARLIEST structured analysis of architectural security risks before code is written?
An organization is acquiring custom software from a third-party developer. Which contractual clause is MOST important to ensure long-term security maintainability?
Which configuration management practice BEST prevents unauthorized changes to production systems?
When governing a microservices migration, which security architecture pattern should the CISO mandate to limit lateral movement?
Which decommissioning control is MOST critical when retiring a system that processed regulated data?
An organization is adopting DevSecOps. Which management decision MOST directly enables 'shift-left' security?
Which artifact BEST documents the security characteristics, controls, and accreditation status of a single information system?
Which NIST publication provides the canonical Risk Management Framework (RMF) used by U.S. federal systems?
Issmp Risk Management
An asset is valued at $500,000 and a fire is expected to destroy 40% of it. The annualized rate of occurrence (ARO) is 0.1. What is the Annualized Loss Expectancy (ALE)?
A risk owner decides to purchase cyber insurance to cover residual ransomware loss. Which risk treatment is this?
Which ISO standard provides the canonical guidelines for information security risk management?
A vendor failed a SOC 2 Type II audit and cannot remediate before contract renewal. Which response is MOST aligned with ISSMP-level third-party risk management?
Which quantitative risk methodology is widely adopted in enterprise risk programs and uses Monte Carlo simulation to express loss as a probability distribution?
Risk appetite differs from risk tolerance in which way?
Which document records risks, owners, treatment decisions, controls, and review dates for the enterprise security program?
An asset has SLE = $80,000 and ARO = 0.25. A control reduces ARO to 0.05 and costs $5,000 annually. What is the annual ROSI?
Which category of risk treatment requires formal sign-off because the organization explicitly chooses to live with the risk?
A supply chain attack is discovered against a fourth-party library used by a critical SaaS vendor. Which BEST describes the risk relationship the CISO must manage?
Which qualitative risk analysis tool plots likelihood against impact to prioritize risks?
A CISO is establishing a risk committee. Which membership composition BEST supports enterprise-wide risk governance?
Which type of risk arises from the failure of internal processes, people, or systems and is monitored separately from cyber-specific risk?
A control is defined as 'preventing an event before it occurs.' Which control category does this describe?
Loading more…