ISMP Practice Questions
Prepare for ISMP with more than an answer.
- 1
A project manager for a new software development project wants to incorporate security into the lifecycle but is concerned about budget overruns. The Information Security Manager (ISM) recommends adopting a Secure Software Development Lifecycle (SSDLC). What is the primary benefit the ISM should emphasize to the project manager?
Show answer details
Correct answer: B
The cost to fix a security vulnerability increases exponentially the later it is found in the development lifecycle. Finding and fixing a flaw during the design or coding phase is far cheaper than fixing it after the product has been deployed to production. This reduction in remediation cost is the most compelling financial argument for adopting an SSDLC.
- 2
A retail company's security policy requires all terminated employees to have their system access revoked within one hour of notification from HR. This is an example of what type of control?
Show answer details
Correct answer: C
This control is designed to prevent a potential security incident (unauthorized access by a former employee) before it can happen. By revoking access promptly upon termination, the organization is proactively stopping a known threat. Therefore, it is a preventive control.
- 3
True or False: In a well-structured ISMS, the 'Statement of Applicability' (SoA) primarily serves as a public declaration of the organization's commitment to information security.
Show answer details
Correct answer: B
The Statement of Applicability (SoA) is a core document in an ISO/IEC 27001 ISMS, but it is primarily an internal governance and audit tool, not a public declaration. Its purpose is to list all the controls from Annex A, state whether each is applicable to the organization, justify any exclusions, and reference how the applicable controls are implemented. It links the risk assessment to the control implementation.
- 4
A marketing firm outsources its IT help desk to a Managed Service Provider (MSP). The contract requires the MSP to handle all security incidents related to end-user devices. When an employee's laptop is infected with ransomware, who holds the ultimate accountability for ensuring the incident is managed in compliance with the firm's policies and legal obligations?
Show answer details
Correct answer: B
A fundamental principle of governance and risk management is that an organization can outsource responsibility for a task, but it cannot outsource accountability. The marketing firm is ultimately accountable to its clients, regulators, and stakeholders for the security of its data and systems. While the MSP is responsible for performing the incident response tasks, the marketing firm's management is accountable for ensuring those tasks are done correctly and meet all compliance obligations.
- 5
A pharmaceutical company is conducting a business impact analysis (BIA) for its research and development (R&D) data. The analysis determined that the Maximum Tolerable Downtime (MTD) for the primary R&D database is 24 hours. How should this MTD value be used?
Show answer details
Correct answer: C
The Maximum Tolerable Downtime (MTD) is the absolute longest period a business function can be unavailable before causing irreparable harm to the organization. This business requirement is used to derive the technical requirement, the Recovery Time Objective (RTO). The RTO is the targeted time within which a business process must be restored after a disaster to avoid unacceptable consequences. Therefore, the RTO must always be less than or equal to the MTD.
- 6
A financial services firm is classifying its information assets. The CISO needs to explain to the board why the customer transaction database has a higher business value than the internal marketing materials. Which characteristic most directly determines the high business value of the customer transaction database compared to internal marketing collateral?
Show answer details
Correct answer: B
The business value of information is heavily influenced by the consequences of its compromise. For a financial firm, the compromise of a customer transaction database can lead to severe regulatory fines (e.g., under GDPR), significant reputational damage, and loss of customer trust. This direct financial and reputational impact makes its confidentiality and integrity critical and gives it a higher business value than internal materials.
- 7
When a healthcare provider outsources its patient portal to a cloud vendor, what is the most critical aspect of information governance from the customer's (the healthcare provider's) perspective to ensure regulatory compliance?
Show answer details
Correct answer: B
From a governance standpoint, the healthcare provider (data controller) remains ultimately responsible for protecting patient data under regulations like HIPAA. A critical governance requirement is to ensure the vendor (data processor) has robust, compliant processes for handling security incidents, especially data breaches. The vendor's breach notification process directly impacts the provider's legal and regulatory obligations to patients and authorities.
- 8
An e-commerce company integrates a third-party payment gateway into its platform. To gain security assurance, which TWO of the following artifacts are most crucial for the supplier to provide and maintain? (Select TWO)
Show answer details
Correct answer: B, E
A PCI DSS AoC is mandatory proof that a service provider securely handles cardholder data. This is a primary document for security assurance in any payment processing context.
A SOC 2 Type II report provides detailed, independent assurance over a period of time about the effectiveness of a vendor's security controls. It is a standard and crucial document for third-party risk management.
- 9
A risk analyst is conducting a qualitative risk assessment for a new mobile application. The analyst has identified a threat of "unauthorized access to user data" and a vulnerability of "weak session management." What is the next logical step in the risk analysis process?
Show answer details
Correct answer: C
The fundamental principle of risk analysis involves evaluating identified threat/vulnerability pairs. After identifying a threat and a vulnerability, the next step is to assess the likelihood of that threat successfully exploiting the vulnerability and the potential business impact if it does. This assessment is necessary to determine the overall risk level before deciding on treatment. Calculating ALE is for quantitative analysis, while implementing controls and buying insurance are risk treatment options.
- 10
FinSecure Bank's online banking platform processes millions of dollars in transactions daily. The Chief Risk Officer (CRO) has tasked a team with performing a quantitative risk analysis on a specific threat: a sophisticated phishing attack leading to fraudulent wire transfers. The team has determined that the value of an average fraudulent wire transfer (Single Loss Expectancy - SLE) is $10,000.
Historical data and industry threat intelligence suggest that a major phishing campaign targeting the bank's customers occurs approximately four times per year. The bank's current security controls, including email filtering and user awareness training, are estimated to be 75% effective at preventing these attacks from succeeding. The CRO wants to know the residual risk to decide if a new, more advanced anti-phishing solution is justified.
The proposed new solution costs $5,000 per year but claims to increase the effectiveness of controls to 95%. The CRO needs a clear financial justification based on risk reduction.
Which of the following statements accurately represents the current financial risk and the justification for the new control?
Show answer details
Correct answer: C
The calculation is as follows:
- Potential ALE (before controls) = ARO (4) * SLE ($10,000) = $40,000.
- Current residual risk (current ALE) = Potential ALE * (1 - control effectiveness) = $40,000 * (1 - 0.75) = $10,000.
- Projected residual risk (new ALE) = $40,000 * (1 - 0.95) = $2,000.
- Risk reduction (annual benefit) = Current ALE - New ALE = $10,000 - $2,000 = $8,000.
- Net annual benefit = Benefit ($8,000) - Cost of control ($5,000) = $3,000. Since this is positive, the investment is financially justified.
