CISSP-ISSMP sample questions

Question 1

A multinational financial services firm is restructuring its governance framework to align with the Three Lines of Defense model. As the Information Systems Security Management Professional (ISSMP), you are defining the specific responsibilities of the second line of defense regarding information security. Which of the following responsibilities is MOST appropriate for this line?

Accepted Answer

Defining security policies, monitoring risk, and overseeing compliance with the risk framework.

Answer

Implementing security controls and executing daily security operations tasks.

Answer

Providing independent assurance to the board regarding the effectiveness of governance and controls.

Answer

Owning the risks and managing the daily performance of the security infrastructure.

Question 2

During a strategic review, the CISO presents a new security roadmap to the Board of Directors. The Board questions the return on investment (ROI) for a proposed $2 million Identity and Access Management (IAM) overhaul. Which metric would BEST demonstrate the strategic value of this initiative beyond simple financial savings?

Accepted Answer

Reduction in average user onboarding time from 5 days to 4 hours, accelerating employee productivity.

Answer

Reduction in the number of password reset tickets logged by the helpdesk.

Answer

Total number of unauthorized access attempts blocked by the new system.

Answer

The percentage of users compliant with the new password complexity policy.

Question 3

A global enterprise is acquiring a smaller regional competitor. As the ISSMP leading the due diligence, you discover the target company uses a decentralized security model with no formal CISO. Which immediate action represents the BEST approach to managing the security risk during the integration phase?

Accepted Answer

Establish a transitional governance committee to map the target's controls to the acquirer's standards and manage exceptions.

Answer

Immediately enforce the acquirer's security policies on the target company's infrastructure.

Answer

Isolate the target company's network permanently and only allow data transfer via air-gapped media.

Answer

Request the resignation of all IT staff at the target company to prevent insider threats.

Question 4

You are defining the Key Risk Indicators (KRIs) for a cloud-native organization. Which of the following metrics serves as a Leading KRI rather than a Lagging KRI?

Accepted Answer

Percentage of cloud resources deployed without associated security tags or compliance checks.

Answer

Number of critical incidents reported in the last quarter.

Answer

Percentage of unpatched vulnerabilities exceeding the SLA.

Answer

Percentage of employees who have completed annual security training.

Question 5

When establishing a security steering committee in a highly federated organization, which TWO stakeholders are MOST critical to include to ensure successful policy enforcement across disparate business units? (Select TWO)

Accepted Answer

Business Unit Leaders (P&L Owners)

Accepted Answer

General Counsel / Legal

Answer

External External Auditors

Answer

System Administrators

Question 6

A security manager is developing a RACI matrix for a new vulnerability management program. Who should be designated as 'Accountable' for the remediation of vulnerabilities within a specific business application?

Accepted Answer

The Application Owner / Business Process Owner

Answer

The Security Operations Center (SOC) Manager

Answer

The CISO

Answer

The System Administrator

Question 7

True or False: In a mature security program, the primary purpose of a security vision statement is to define the specific technical controls and tools the organization will implement over the next 12 months.

Accepted Answer

False

Answer

True

Question 8

You are negotiating a contract with a SaaS provider for processing PII. The provider refuses to allow your team to conduct penetration tests on their environment. Which alternative clause is the MOST acceptable compromise to maintain governance?

Accepted Answer

Requiring provision of a current SOC 2 Type 2 report and a summary of their most recent third-party penetration test results.

Answer

Accepting their standard Terms of Service without modification.

Answer

Implementing a CASB (Cloud Access Security Broker) to decrypt and inspect all traffic to the provider.

Answer

Demanding the provider place the source code in escrow.

Question 9

Which of the following describes the relationship between a Security Policy and a Security Standard?

Accepted Answer

A Policy defines 'what' needs to be done; a Standard defines the mandatory 'how' (specific technologies or parameters).

Answer

A Policy is mandatory and high-level; a Standard is optional and detailed.

Answer

A Policy is created by IT; a Standard is created by Senior Management.

Answer

A Policy applies to external vendors only; a Standard applies to internal staff.

Question 10

A software development company is shifting from Waterfall to DevOps. The security team is struggling because manual security reviews are delaying releases. What is the MOST effective leadership strategy to address this conflict?

Accepted Answer

Shift the security culture to 'Security as Code' by automating security gates within the CI/CD pipeline and training developers on secure coding.

Answer

Mandate that all deployments must be halted until a manual security sign-off is obtained.

Answer

Outsource the development function to a vendor with better security practices.

Answer

Remove security requirements from the development lifecycle to ensure speed to market.

Information Systems Security Management Professional (ISSMP) Free Sample Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Lifetime One

Two

Pro Four

Premium Twelve

CISSP-ISSMP Sample Questions

Trusted by professionals at