I85PREP
⌘ K
ISSMP study materials
ISSMP study resources

ISSMP practice questions

One question at a time. Build your ISSMP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Leadership and Business Management

What is the primary purpose of information security governance within an organization?

  1. Align security with business goals and assign accountability Correct answer.
  2. Run authenticated vulnerability scans each quarter
  3. Document recovery time objectives for each system
  4. Configure and tune perimeter security devices

Explanation

Governance sets direction, delegates authority, and establishes accountability so that security effort supports business objectives. Device configuration, scanning, and recovery objectives are operational or tactical activities that execute within the governance framework rather than define it.

Question 2Leadership and Business Management

Which document formally states management's security intent and mandatory requirements at the highest level?

  1. Acceptable use guideline
  2. Incident response runbook
  3. Information security policy Correct answer.
  4. Baseline configuration standard

Explanation

The information security policy is issued with executive authority and states management's intent, scope, and mandatory requirements. Standards, procedures, runbooks, and guidelines are derived documents that implement the policy at lower levels of detail.

Question 3Leadership and Business Management

In a RACI chart, how many individuals should be assigned as accountable for a given activity?

  1. Exactly one Correct answer.
  2. Only the executive sponsor
  3. At least two, to satisfy segregation of duties
  4. As many as the activity requires

Explanation

Accountability means owning the outcome and answering for it, so it must rest with exactly one person to avoid diffusion of responsibility. Responsibility, by contrast, may be shared by several people who perform the work.

Question 4Leadership and Business Management

What is the main purpose of a business case supporting a security investment?

  1. To justify the spend in business and risk terms Correct answer.
  2. To satisfy the audit committee's reporting template
  3. To capture the vendor's licensing terms and conditions
  4. To record technical specifications for procurement

Explanation

A business case frames the investment in terms executives can weigh against competing uses of funds: expected benefit, cost, and reduction in risk. Technical specifications and licensing terms are procurement artifacts that follow approval of the business case.

Question 5Leadership and Business Management

Which measure best demonstrates that a security awareness program is working?

  1. The volume of posters distributed to offices
  2. The number of awareness sessions delivered
  3. The count of messages sent to all staff
  4. A measurable drop in risky user behavior Correct answer.

Explanation

Awareness programs exist to change behavior and reduce human-originated risk, so behavioral measures such as reduced risky clicks or improved reporting rates are the most meaningful evidence. Delivery counts show activity, not effect.

Question 6Leadership and Business Management

Which arrangement most clearly establishes a single point of accountability for information security?

  1. Security duties added to the service desk
  2. A virtual team drawn from each business unit
  3. A part-time external consultant retained
  4. A dedicated security function led by a CISO Correct answer.

Explanation

A dedicated function with a named leader and a defined reporting line gives one party clear ownership, budget authority, and a seat in executive decisions. Distributed or part-time arrangements diffuse ownership and weaken escalation paths.

Question 7Leadership and Business Management

What should a security steering committee's charter primarily define?

  1. The annual penetration testing schedule
  2. The approved cryptographic algorithms
  3. Its mandate, membership, and decision rights Correct answer.
  4. The technical configuration baseline for servers

Explanation

A charter or terms of reference establishes why the committee exists, who sits on it, and what decisions it is empowered to make. Technical baselines, testing schedules, and algorithm selections are content the committee may approve, not the definition of its authority.

Question 8Leadership and Business Management

What does a chargeback model accomplish in security budgeting?

  1. Converts capital expense into operational expense
  2. Funds all security work from a central reserve
  3. Freezes security spending at the prior year's level
  4. Recovers security costs from the units that consume them Correct answer.

Explanation

Chargeback allocates the cost of security services back to the business units that use them, making consumption visible and encouraging cost-aware demand. It is a cost-allocation mechanism, not a spending cap or an accounting reclassification.

Question 9Leadership and Business Management

Which of the following is a leading indicator for a security program?

  1. Count of regulatory fines paid
  2. Annual loss attributed to fraud incidents
  3. Percentage of critical patches applied within SLA Correct answer.
  4. Number of breaches in the last fiscal year

Explanation

Leading indicators measure preventative activity that predicts future outcomes, such as how reliably patching keeps pace with exposure. Breach counts, fraud losses, and fines are lagging indicators that report what already happened.

Question 10Leadership and Business Management

A regulator has high influence over the security program and a strong, active interest in its outcomes. Which engagement approach fits best?

  1. Send periodic newsletters only
  2. Engage closely and involve in key decisions Correct answer.
  3. Monitor with minimal communication
  4. Delegate all contact to a technical team

Explanation

On a power/interest grid, stakeholders who are both highly influential and highly interested belong in the manage-closely quadrant, receiving direct engagement and involvement in significant decisions. Lower-touch strategies are appropriate only for stakeholders low on one or both dimensions.

Question 11Leadership and Business Management

Who should ultimately approve the enterprise's stated risk appetite for information security?

  1. Executive management with board oversight Correct answer.
  2. The data center facilities lead
  3. The security operations manager
  4. The internal audit director

Explanation

Risk appetite expresses how much risk the organization is willing to accept in pursuit of its objectives, so it must be set at the top where business strategy is owned. Security and audit staff inform and test the statement but cannot confer that authority.

Question 12Leadership and Business Management

A new authentication process changes how staff perform a daily task. Which action most improves acceptance of the change?

  1. Restrict communication to management levels
  2. Announce it only after full deployment
  3. Involve affected staff early and explain the rationale Correct answer.
  4. Rely on policy text and disciplinary action

Explanation

Change management research consistently shows that participation, early communication, and a clear rationale reduce resistance and build commitment. Relying on authority or late notification leaves staff to interpret the change as a burden imposed without reason.

Question 13Leadership and Business Management

Which security objective is written so that progress can be measured objectively?

  1. Reduce open critical vulnerabilities by 50% within two quarters Correct answer.
  2. Strengthen defenses against advanced threats
  3. Improve the overall security posture significantly
  4. Enhance the security culture across the enterprise

Explanation

A measurable objective specifies a metric, a target, and a timeframe so that achievement can be verified against a baseline. The other statements express intent without a metric or deadline, leaving success open to interpretation.

Question 14Leadership and Business Management

Which approach most effectively manages security risk from a critical third-party supplier?

  1. Obtain a one-time self-attestation at onboarding
  2. Rely on the supplier's published marketing certifications
  3. Embed security requirements in the contract and monitor them Correct answer.
  4. Transfer all risk to the supplier via an indemnity clause

Explanation

Effective third-party risk management makes security obligations contractual and then verifies them through ongoing monitoring, such as audits, attestations, and metrics. A single onboarding attestation goes stale, and contractual transfer never removes the organization's own exposure.

Question 15Leadership and Business Management

A CISO discovers that one engineer alone understands the key management system. What is the most appropriate leadership response?

  1. Outsource the function to a managed provider
  2. Further restrict system access to that engineer
  3. Cross-train other staff and document the process Correct answer.
  4. Raise that engineer's pay to reduce flight risk

Explanation

Concentrating irreplaceable knowledge in one person is a key-person dependency that threatens availability and continuity. Cross-training and documentation reduce the dependency while retaining the expertise in-house; outsourcing may follow but does not itself resolve the immediate knowledge gap.

Question 16Leadership and Business Management

A security project's scope grows while its budget and deadline are fixed. What is the most appropriate leadership action?

  1. Drop the costliest security requirements to protect the date
  2. Extend the deadline unilaterally and notify later
  3. Absorb the extra work without informing the sponsor
  4. Route the change through change control to agree trade-offs Correct answer.

Explanation

Scope, schedule, and cost are interdependent, so an increase in one requires a conscious trade-off decision with the sponsor. Integrated change control keeps that decision explicit and authorized instead of silently degrading quality or slipping the date.

Question 17Leadership and Business Management

When briefing the board on security risk, which presentation approach is most effective?

  1. Walk through detailed packet capture analysis
  2. Express risk in business terms with likelihood, impact, and trend Correct answer.
  3. Provide raw vulnerability scan output for review
  4. Emphasize the number of alerts the team handled

Explanation

Boards govern by weighing risk against strategy, so they need exposure described in business terms with likelihood, impact, and direction of travel. Technical artifacts and activity volumes give no basis for deciding where to direct resources or accept risk.

Question 18Leadership and Business Management

A vendor competing for your contract offers your team expensive event tickets. What is the appropriate response under a typical code of conduct?

  1. Accept and award the contract purely on merit
  2. Accept them, since gifts do not change decisions
  3. Decline and disclose the offer per policy Correct answer.
  4. Accept only if the tickets are shared with the team

Explanation

Codes of conduct require employees to avoid both actual and apparent conflicts of interest, which means declining gifts that could be perceived as influencing an award. Disclosure lets the organization track and manage the situation even where the gift is refused.

Question 19Leadership and Business Management

What most reliably keeps a security architecture aligned with business strategy over time?

  1. Running annual penetration tests on all systems
  2. Benchmarking security spend against industry peers
  3. Adopting the newest security tooling each year
  4. Participating in enterprise architecture and IT planning cycles Correct answer.

Explanation

Alignment is maintained through the same planning and architecture governance processes that shape business and IT change, so security requirements are considered while designs are still fluid. Testing, tool adoption, and benchmarking inform decisions but do not connect security design to business direction.

Question 20Leadership and Business Management

During a major security incident, which leadership behavior best supports sound decision-making?

  1. Establish clear roles and a single chain of command Correct answer.
  2. Let each team escalate independently to executives
  3. Hold all communications until complete information is available
  4. Join the technical troubleshooting directly to accelerate analysis

Explanation

Incident leadership depends on unambiguous roles, a single decision authority, and a structured cadence so that information and decisions flow predictably under pressure. Leaders who dive into troubleshooting or allow fragmented escalation create conflicting decisions and gaps in accountability.

Question 21Leadership and Business Management

A CISO wants to show that security enables rather than slows the business. Which measure best demonstrates that value?

  1. Number of security policies published this year
  2. Median time to complete security review of new initiatives Correct answer.
  3. Total malware events detected across the estate
  4. Percentage of budget spent on tooling

Explanation

Value-demonstrating metrics capture how security affects business throughput and risk-adjusted outcomes, such as how quickly reviews clear so initiatives can launch. Policy counts, detection totals, and budget mix describe internal activity rather than business enablement.

Question 22Leadership and Business Management

A control costs $200,000 per year and is expected to reduce annualized loss expectancy from $900,000 to $300,000. What is the net annual benefit?

  1. $200,000
  2. $600,000
  3. $400,000 Correct answer.
  4. $700,000

Explanation

The control reduces annualized loss expectancy by $600,000, and subtracting the $200,000 annual cost leaves a net benefit of $400,000. Comparing net benefit against cost gives the basis for prioritizing the investment against alternatives.

Question 23Leadership and Business Management

Why does it weaken assurance when the information security function reports directly to the IT operations leader?

  1. It is prohibited by recognized control frameworks
  2. It compromises independence because one function both operates and assures Correct answer.
  3. It has no effect provided the leader holds a certification
  4. It increases cost because two leaders share one budget

Explanation

Assurance loses credibility when the party being evaluated controls the evaluator, because findings that criticize operations can be suppressed or softened. Separating the security reporting line from the functions it oversees preserves objectivity in risk reporting to executive management.

Question 24Leadership and Business Management

During due diligence on an acquisition, which finding most warrants escalation to the board before signing?

  1. The target has an undisclosed breach still exposing regulated data Correct answer.
  2. The target uses a different firewall vendor
  3. The target has no formal awareness program
  4. The target reviewed its security policy 14 months ago

Explanation

Board escalation is driven by materiality and ongoing exposure, and an undisclosed breach of regulated data creates live legal, financial, and reputational liability that affects valuation and deal terms. Process maturity gaps matter to remediation planning but can be priced and scheduled after closing.

Question 25Leadership and Business Management

A new regulation requires controls beyond current practice, and full compliance by the deadline is not achievable. What is the most defensible leadership action?

  1. Certify compliance now on the basis that remediation will follow shortly
  2. Suspend business operations until full compliance is achieved
  3. Delay disclosure until the gap can be closed without attention
  4. Document a risk assessment, apply compensating controls, and report residual risk with a remediation plan Correct answer.

Explanation

When a deadline cannot be met, regulators and boards expect evidence of a documented, risk-based approach: assessed gaps, interim compensating controls, a funded remediation plan, and transparent reporting of residual risk. Certification without substance, concealment, or halting the business all create greater exposure than disclosed, managed nonconformity.

Question 26Leadership and Business Management

Which statement best distinguishes information security governance from information security management?

  1. Governance is performed by the security team; management is performed by internal audit.
  2. Governance is a one-time project activity; management is the ongoing steady state.
  3. Governance applies to technology assets; management applies to business processes.
  4. Governance sets direction and oversight; management executes and operates. Correct answer.

Explanation

Governance concerns decision rights, direction setting, and accountability, and it sits with executive leadership and the board. Management translates that direction into plans, controls, and day-to-day operations. The two are complementary layers rather than a division between technology and business or between project and steady state.

Question 27Leadership and Business Management

A CISO is classifying a multi-year purchase of security appliances for the annual budget. Which treatment is most appropriate?

  1. Capital expense, because it removes the need for an annual operating budget.
  2. Operating expense, because the devices support day-to-day operations.
  3. Operating expense, because security is consumed continuously as a service.
  4. Capital expense, because the asset delivers benefit across multiple periods. Correct answer.

Explanation

Long-lived assets that provide benefit beyond the current fiscal period are typically capitalized and depreciated over their useful life. Consumable or subscription items that are used within the period are treated as operating expense. The classification affects how the spend appears in financial statements and how funding is approved.

Question 28Leadership and Business Management

Which executive behavior most strongly signals that information security is treated as a business priority?

  1. Delegating all security matters to the CISO without further involvement.
  2. Making risk-based security decisions explicitly in business planning forums. Correct answer.
  3. Requiring security awareness training for all newly hired staff.
  4. Approving the largest security budget among peer organizations.

Explanation

Tone at the top is demonstrated when leaders visibly weigh security risk alongside other business considerations in the forums where priorities and resources are decided. Budget size and mandatory training are supportive but can be delegated administrative acts. Absent visible engagement, staff infer that security is a technical sideshow.

Question 29Leadership and Business Management

Who should be accountable for defining the recovery time objectives used in a business impact analysis?

  1. The infrastructure and operations manager, working from current backup schedules.
  2. The business process owners, based on tolerable outage. Correct answer.
  3. The internal audit function, applying the chosen control framework.
  4. The disaster recovery coordinator, based on vendor recovery guarantees.

Explanation

Recovery objectives express how long the organization can tolerate a process being unavailable, which only the accountable business owner can determine. Technical teams then design recovery capabilities to meet those objectives. Deriving objectives from current technical capability inverts the relationship and institutionalizes existing gaps.

Question 30Leadership and Business Management

Which outcome best indicates that a security champion program is achieving its intended purpose?

  1. Business units raise and resolve security issues without escalation. Correct answer.
  2. The security team's ticket backlog falls quarter over quarter.
  3. Champions log the highest training hours in the organization.
  4. Champions are given security job titles and report to the CISO.

Explanation

A champion model exists to distribute security decision-making into business teams so issues are handled locally and earlier. Reduced escalation and self-resolution demonstrate that capability has moved into the business. Training volume and ticket metrics can improve without any real change in local behavior.

Question 31Leadership and Business Management

Where in a project's lifecycle should security requirements be baselined?

  1. During user acceptance testing, when defects are cheapest to log.
  2. During the go-live readiness review, alongside operations sign-off.
  3. During post-implementation review, once real usage data exists.
  4. During requirements definition, before design is approved. Correct answer.

Explanation

Security requirements must be established before design decisions lock in architecture, since later changes carry far higher cost and schedule impact. Baselining during requirements definition allows controls to be designed in rather than retrofitted. Testing and go-live reviews verify compliance with requirements; they cannot substitute for them.

Question 32Leadership and Business Management

A CISO uses a capability maturity model to plan the program's evolution. What is the primary value of this approach?

  1. It yields a single composite score comparable across all industries.
  2. It provides a structured progression for prioritizing capability investments. Correct answer.
  3. It removes the need for risk assessment by defining target controls.
  4. It guarantees that regulatory obligations are satisfied at every level.

Explanation

A maturity model gives a common language and a sequenced set of levels that help leaders decide which capabilities to build next. It is a planning and communication aid, not a compliance certificate or a substitute for risk-based judgment. Scores are meaningful mainly against a defined scope and consistent use over time.

Question 33Leadership and Business Management

A CISO has no direct authority over business unit leaders but must reduce unsanctioned data sharing. Which approach is most likely to succeed?

  1. Publish a prohibiting policy and require annual signed attestations.
  2. Restrict network access until each business unit completes a security review.
  3. Escalate every instance of noncompliance to the executive committee for sanction.
  4. Frame the risk in business terms and co-design controls with unit leaders. Correct answer.

Explanation

Without positional authority, influence depends on shared ownership of outcomes, so translating risk into business consequences and designing controls jointly builds commitment. Escalation and technical blocking may force short-term compliance while eroding the relationship needed for sustained change. Policy alone rarely alters behavior when the underlying business driver is unaddressed.

Question 34Leadership and Business Management

A business unit has adopted an unapproved analytics SaaS tool and reports it is essential to a quarterly commitment. What is the most appropriate CISO action?

  1. Assess the risk, then agree interim safeguards and a review date. Correct answer.
  2. Refer the matter to internal audit for a formal finding.
  3. Accept the tool as-is, since the business unit owns the resulting risk.
  4. Order immediate termination of the subscription to enforce policy.

Explanation

The situation combines a live business dependency with unassessed risk, so the leader must first understand exposure, then contain it while preserving the commitment. Interim safeguards such as data restrictions or contract review buy time for a proper decision. Purely punitive or purely permissive responses both leave the organization worse off.

Question 35Systems Lifecycle Management

Which life cycle phase produces the approved statement of user needs and functional requirements?

  1. Construction
  2. Requirements Correct answer.
  3. Transition
  4. Detailed design

Explanation

The requirements phase elicits, analyzes, and documents what the system must do and the constraints it must satisfy. Design then translates those needs into technical specifications, construction builds and tests the solution, and transition moves it into operational use.

Question 36Systems Lifecycle Management

In a waterfall life cycle, which characteristic is a primary advantage?

  1. Rapid user feedback
  2. Continuous deployment
  3. Defined stage gates Correct answer.
  4. Minimal planning

Explanation

Waterfall uses sequential phases with formal approvals, so each stage gate provides documented control and visibility. This structure suits stable requirements and regulated environments, but it delays user feedback until later phases.

Question 37Systems Lifecycle Management

What is the main purpose of configuration management in a system life cycle?

  1. Negotiate vendor contracts
  2. Schedule user training
  3. Approve project funding
  4. Control artifact changes Correct answer.

Explanation

Configuration management identifies configuration items, controls changes to them, records status, and verifies completeness and correctness. It ensures that approved artifacts remain consistent and traceable throughout the life cycle.

Question 38Systems Lifecycle Management

What does user acceptance testing (UAT) primarily confirm?

  1. Code meets peer review standards
  2. Unit tests cover all branches
  3. Users accept business fit Correct answer.
  4. Infrastructure handles peak load

Explanation

UAT is performed by intended users or their representatives to confirm that the system satisfies business needs and is fit for use. It validates the solution against acceptance criteria rather than verifying internal code quality or infrastructure capacity.

Question 39Systems Lifecycle Management

A configuration baseline is best described as which of the following?

  1. Log of open defects
  2. Vendor price sheet
  3. Approved item set Correct answer.
  4. Draft coding schedule

Explanation

A baseline is a set of configuration items that has been formally reviewed and approved, then frozen as a reference for future changes. Changes to a baseline must go through formal change control.

Question 40Systems Lifecycle Management

What is the main objective of a post-implementation review?

  1. Compare with objectives Correct answer.
  2. Freeze the project budget
  3. Assign blame for defects
  4. Close vendor contracts

Explanation

A post-implementation review evaluates whether the delivered system achieved its intended business objectives, benefits, and performance targets. Lessons learned are captured to improve future projects rather than to assign individual blame.

Question 41Systems Lifecycle Management

A feasibility study is conducted mainly to determine what?

  1. Release note format
  2. Acceptance test cases
  3. Detailed design details
  4. Project viability Correct answer.

Explanation

Feasibility studies assess whether a proposed system is technically, economically, operationally, and legally viable before major investment. They inform the decision to proceed, defer, or reject the initiative.

Question 42Systems Lifecycle Management

What is the primary role of a change control board (CCB)?

  1. Negotiate software licenses
  2. Authorize baseline changes Correct answer.
  3. Perform unit testing
  4. Write user documentation

Explanation

The CCB reviews proposed changes against baselines and decides whether to approve, reject, or defer them. It provides governance so that changes are evaluated for impact before affecting approved configuration items.

Question 43Systems Lifecycle Management

A project has stable, fully documented requirements and a fixed regulatory deadline. Which approach is most appropriate?

  1. Spiral
  2. Scrum
  3. Waterfall Correct answer.
  4. Prototyping

Explanation

Waterfall is appropriate when requirements are well understood and changes are expected to be limited, because sequential phases and formal approvals provide predictable control. Scrum and prototyping suit evolving requirements, while the spiral model emphasizes repeated risk analysis.

Question 44Systems Lifecycle Management

A requirements traceability matrix primarily helps a project team to do what?

  1. Estimate server capacity
  2. Map requirements to tests Correct answer.
  3. Schedule production backups
  4. Approve vendor invoices

Explanation

A traceability matrix links each requirement to design elements, code, test cases, and deliverables so coverage and impact can be verified. It supports verification that all requirements are implemented and tested, and it helps assess the effect of changes.

Question 45Systems Lifecycle Management

A hospital cannot tolerate service interruption during a system cutover. Which approach gives the safest fallback?

  1. Phased conversion
  2. Pilot conversion
  3. Parallel running Correct answer.
  4. Direct cutover

Explanation

Parallel running operates the old and new systems simultaneously, so the old system remains available if the new one fails. It reduces risk at the cost of duplicate operations and reconciliation effort.

Question 46Systems Lifecycle Management

A COTS vendor may go out of business. Which safeguard protects access to source code?

  1. Service level agreement
  2. Acceptance testing
  3. Capacity plan
  4. Software escrow Correct answer.

Explanation

Software escrow places source code and related materials with a neutral third party for release if the vendor fails or breaches support obligations. It mitigates vendor viability risk when an organization depends on closed-source COTS software.

Question 47Systems Lifecycle Management

An agile team must incorporate security requirements. Which practice best integrates them into delivery?

  1. Assign security to separate team
  2. Perform pen test after release
  3. Document threats at project close
  4. Put security criteria in backlog Correct answer.

Explanation

Security requirements should be expressed as backlog items with clear acceptance criteria so they are estimated, built, and tested with other work. This makes security a continuous part of delivery rather than a late add-on.

Question 48Systems Lifecycle Management

What is the main purpose of regression testing after a change?

  1. Verify vendor pricing
  2. Measure user satisfaction
  3. Validate network bandwidth
  4. Catch unintended effects Correct answer.

Explanation

Regression testing re-executes selected tests to confirm that a change did not break existing functionality. It targets unintended side effects in areas that should have remained unchanged.

Question 49Systems Lifecycle Management

When evaluating vendor proposals, which practice improves objectivity?

  1. Limit review to one evaluator
  2. Rely on vendor demos alone
  3. Use weighted scoring criteria Correct answer.
  4. Choose the lowest price only

Explanation

Predefined weighted criteria let evaluators compare proposals consistently across requirements, cost, risk, and support. The weights should be established before proposals are opened to reduce bias.

Question 50Systems Lifecycle Management

Which activity best validates a data migration before go-live?

  1. Reconcile record counts Correct answer.
  2. Refresh the test plan
  3. Review source code comments
  4. Update the project charter

Explanation

Reconciliation compares source and target record counts, key values, totals, and rejected records to confirm that data migrated completely and accurately. It provides measurable evidence that the migration met its acceptance criteria.