Free Information Systems Security Management Professional Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Information Systems Security Management Professional practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which objective should anchor an organization's information security program?

   1. A. Achieving the highest available security rating for every system
   2. B. Supporting the organization's mission through appropriate protection
   3. C. Standardizing all business processes around one security product
   4. D. Minimizing security expenditure regardless of business exposure

   Answer: B

   Explanation: NIST states, "Information security, therefore, is a means to an end and not an end in itself." Protection should enable the organizational mission; neither a rating, a product, nor expenditure alone defines success.

   Reference: An Introduction to Information Security — NIST SP 800-12 Revision 1 — Section 2.1, p. 7

2. 2Why does the SSDF recommend addressing security earlier in the development life cycle?

   1. A. It moves remediation costs from development to operations.
   2. B. It generally lowers total effort and cost for equivalent security.
   3. C. It lowers testing effort by deferring security fixes until release.
   4. D. It makes correction costs largely independent of discovery stage.

   Answer: B

   Explanation: NIST states, "the earlier in the SDLC that security is addressed, the less effort and cost is ultimately required to achieve the same level of security". Earlier correction generally reduces total effort; it does not shift correction to operations, defer fixes, or make cost independent of discovery stage.

   Reference: Secure Software Development Framework (SSDF) Version 1.1 — NIST SP 800-218 — Section 1, p. 1

3. 3What is the principal output of risk framing in NIST SP 800-39?

   1. A. An assessment report estimating identified risk levels
   2. B. An organization-wide risk management strategy
   3. C. An authorization decision accepting one system's risk
   4. D. A monitoring report describing current control status

   Answer: B

   Explanation: NIST states, "Risk framing, as its principal output, produces a risk management strategy". Assessment estimates risks, authorization accepts particular system risk, and monitoring reports current conditions; framing establishes the organization-wide strategy governing these activities.

   Reference: Managing Information Security Risk — NIST SP 800-39 — Section 3.1, p. 33

4. 4What should a SOC playbook primarily provide to its users?

   1. A. High-level policy principles governing authority and acceptable conduct
   2. B. A register of assessed risks, their owners, and selected treatment decisions
   3. C. Actionable scenario-specific steps or tasks for operational personnel
   4. D. A chronological record of observations and evidence from a particular incident

   Answer: C

   Explanation: NIST states, "Playbooks provide actionable steps or tasks for people to perform during various scenarios or situations." Policy principles establish direction, risk registers track decisions, and incident records preserve a case history; the playbook guides scenario execution.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — NIST SP 800-61r3 — Section 2.3, p. 9

5. 5What is the central focus of a business continuity plan in NIST SP 800-34 Revision 1?

   1. A. Investigating the technical cause of cyber attacks
   2. B. Rebuilding a computer facility at an alternate site
   3. C. Sustaining mission and business processes during and after disruption
   4. D. Directing occupants to safety during an immediate building emergency

   Answer: C

   Explanation: NIST states, "The BCP focuses on sustaining an organization’s mission/business processes during and after a disruption." Cyber investigation, facility restoration, and occupant safety have different primary plan purposes.

   Reference: Contingency Planning Guide for Federal Information Systems — NIST SP 800-34 Revision 1 — Section 2.2.1, p. 8

6. 6Personal data is processed in the context of a controller's EU establishment, but its servers are in the United States. Under GDPR Article 3(1), what does server location establish?

   1. A. Processing outside the EU automatically falls outside the Regulation.
   2. B. Only data about EU citizens remains within territorial scope.
   3. C. U.S. hosting alone does not remove processing from GDPR scope.
   4. D. The controller can replace GDPR duties with its hosting contract.

   Answer: C

   Explanation: Article 3(1) applies "regardless of whether the processing takes place in the Union or not". Given the EU-establishment context, offshore hosting alone does not remove applicability; citizenship and contract substitution are not the stated test.

   Reference: Regulation (EU) 2016/679 — General Data Protection Regulation — Article 3(1)

7. 7Before deriving security requirements for a business system, what relationship should a security manager establish?

   1. A. The system's age relative to its planned replacement date
   2. B. The system's vendor relative to the approved supplier list
   3. C. The system's control count relative to peer organizations
   4. D. The system's role in supporting the organizational mission

   Answer: D

   Explanation: NIST explains, "After a system's role has been defined, the security requirements implicit in that role can also be defined." Mission contribution provides the basis for requirements; age, vendor approval, and control counts do not establish that contribution.

   Reference: An Introduction to Information Security — NIST SP 800-12 Revision 1 — Section 2.1, p. 7

8. 8When defining security requirements for a software life cycle, which combination of sources does SSDF PO.1 explicitly include?

   1. A. Product marketing and competitors' feature lists
   2. B. Developer preferences and the release calendar
   3. C. Internal policies and applicable external laws
   4. D. Testing results and production logs without business requirements

   Answer: C

   Explanation: PO.1 includes "internal sources" such as policies, objectives, and risk strategy and "external sources" such as laws. Requirements cannot be derived solely from preferences, marketing, or late-stage observations.

   Reference: Secure Software Development Framework (SSDF) Version 1.1 — NIST SP 800-218 — Table 1, PO.1, p. 5

9. 9Which statement defines organizational risk tolerance in NIST SP 800-39?

   1. A. The expected frequency of a particular threat event
   2. B. The total number of weaknesses discovered in a system
   3. C. The maximum financial expenditure approved for one control
   4. D. The level of risk or degree of uncertainty acceptable to the organization

   Answer: D

   Explanation: NIST states, "Risk tolerance is the level of risk or degree of uncertainty that is acceptable to organizations". Likelihood, vulnerability counts, and a control budget describe different inputs or constraints.

   Reference: Managing Information Security Risk — NIST SP 800-39 — Section 2.3.3, p. 14

10. 10How can a SOC verify that its documented operating procedures accurately reflect usable technical processes?

    1. A. Periodically test or exercise the procedures against the technical process.
    2. B. Infer execution accuracy from a desk comparison with the approved policy.
    3. C. Infer operational success from staff completing training on the written sequence.
    4. D. Infer technical accuracy from the procedure owner's approval of the document.

    Answer: A

    Explanation: NIST states, "Procedures can be tested or exercised periodically to verify their accuracy". Policy alignment, training completion, and owner approval can support governance, but do not by themselves demonstrate that the technical steps execute accurately.

    Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — NIST SP 800-61r3 — Section 2.3, p. 9