Which of the following is a key element of a supply chain security program?

Relying solely on contractual clauses

Eliminating all third-party vendors

What does the recovery time objective (RTO) define in disaster recovery planning?

The maximum acceptable time to restore systems and data after a disruption

The maximum acceptable amount of data loss measured in time

The minimum time required to back up data

The time between security audits

A financial institution is required by its regulator to have a business continuity plan (BCP) that is tested at least annually. The institution's security architect is responsible for ensuring the BCP is effective. Which activity is MOST critical to include in the annual test?

A full-scale test that includes failing over to the alternate site, restoring data from backups, and validating system functionality.

A walkthrough of the BCP with the IT team to confirm they understand the procedures.

A tabletop exercise where key stakeholders discuss their roles and responsibilities during a simulated disruption.

A review of the BCP document to ensure it is up to date with current contact information.

What is the primary purpose of a data classification scheme?

To delete data that is no longer needed

To encrypt all data regardless of its sensitivity

To assign a level of sensitivity to data so that appropriate handling and protection controls can be applied

To store all data in a single location for easier management

A software company offers a consumer app that collects personal data from users in California and the EU. The company wants to support user requests for data deletion. The security architect must design the data lifecycle. Which requirement must be addressed FIRST?

Anonymize the data instead of deleting it, since anonymized data is no longer personal data.

Delete the data from the primary database immediately and then handle backups later.

Implement a process to verify the identity of the requester before processing the deletion request.

Obtain a new consent from the user before deleting their data.

Information Systems Security Architecture Professional

Domain 1Objective 1

1.1 Identify Legal, Regulatory, Organizational, and Industry Requirements ISSAP Practice Questions (Page 1)

Part of the Governance, Risk, and Compliance (GRC) domain, which accounts for 21% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 8–13 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

12concepts

21%of the exam

Questions 1–5

1foundation · easy
Which of the following is a key element of a supply chain security program?
Select an answer first
2foundation · easy
What does the recovery time objective (RTO) define in disaster recovery planning?
Select an answer first
3application · medium
A financial institution is required by its regulator to have a business continuity plan (BCP) that is tested at least annually. The institution's security architect is responsible for ensuring the BCP is effective. Which activity is MOST critical to include in the annual test?
Select an answer first
4foundation · easy
What is the primary purpose of a data classification scheme?
Select an answer first
5application · medium
A software company offers a consumer app that collects personal data from users in California and the EU. The company wants to support user requests for data deletion. The security architect must design the data lifecycle. Which requirement must be addressed FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.