ISMP Sample Questions & Answers

The incident response cycle includes stages like Prevention, Detection, Response, and Recovery. Firewalls and encryption are primarily preventive controls. A disaster recovery plan is a recovery/responsive control. A Database Activity Monitoring (DAM) tool is a classic detective control, as its main purpose is to monitor for and alert on suspicious activities that could indicate an ongoing incident, fitting squarely into the Detection stage.

It is practically impossible and financially prohibitive to eliminate all risk. The goal of risk management is to reduce risk to an acceptable level, known as the organization's risk appetite. Residual risk is the risk that remains after controls have been implemented, and some level of residual risk must always be formally accepted by management.

The "Lessons Learned" or post-mortem review is a critical part of the Post-Incident Activity stage. This activity is conducted after the incident has been fully contained, eradicated, and normal operations have been restored. Its purpose is to analyze the incident and the response effort to identify weaknesses and make improvements to prevent future occurrences and enhance future responses. Conducting it earlier would be premature.

The core principle of a Zero Trust architecture is "never trust, always verify." It assumes that threats exist both inside and outside the traditional network perimeter. Therefore, it requires that every request to access a resource is authenticated and authorized based on identity and context, regardless of whether it originates from a supposedly 'trusted' internal network or an external one.

Physical controls can be categorized as preventive, detective, or corrective. A mantrap, biometric scanner, and reinforced door are all preventive controls designed to stop unauthorized access. A motion-activated security camera is a detective control; it does not prevent entry but records the event and can trigger an alert, allowing security personnel to detect and respond to an intrusion.

The core principle of business continuity planning is to align disaster recovery solutions with the specific requirements defined in the Business Impact Analysis (BIA). The BIA states an RTO of 4 hours and an RPO of 15 minutes. Solution 2 (DRaaS) meets these requirements (RTO 3-4 hours, RPO ~15 minutes) and is noted as being more cost-effective. While Solution 1 (hot site) exceeds the requirements, its very high cost is not justified when a cheaper option that still meets the defined business needs is available.

This is a standard best practice. The purpose of the DMZ is to expose only necessary services (like a web server) to the internet on their specific ports.

It is a common and acceptable practice for a web server in the DMZ to initiate connections to a database server on the more secure internal network. The rule should be specific to the required port (e.g., 1433 for MSSQL).

Administrators on the internal network need to manage the servers in the DMZ. Allowing specific, secured management traffic (like SSH or RDP) initiated from the trusted internal zone is a necessary operational rule.

In a typical ISMS documentation hierarchy, a policy is a high-level statement of intent and direction from management (the 'what'). A standard provides the mandatory, specific requirements for how to comply with the policy. For example, a policy might state 'All data must be encrypted', and a standard would specify 'AES-256 must be used for all data-at-rest encryption'. Procedures then detail the step-by-step instructions, and guidelines offer recommendations.

Risk acceptance is a formal risk treatment strategy. For due diligence and governance, it is critical that any decision to accept a known risk is formally documented. This documentation should include a description of the risk, the reasons for accepting it (e.g., cost of mitigation is too high), and clear identification of the management level or authority that approved the decision. This creates an audit trail and ensures accountability.

This option correctly defines the terms. A vulnerability is a weakness in a system or control (outdated TLS 1.1). A threat is an agent or action that could exploit the vulnerability (the attacker). Risk is the combination of the likelihood of the threat exploiting the vulnerability and the resulting impact (interception of sensitive data).