1.1 Identify Legal, Regulatory, Organizational, and Industry Requirements ISSAP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which publication series from the U.S. National Institute of Standards and Technology provides a catalog of security and privacy controls for federal information systems and organizations?

   • AISO/IEC 27002
   • BNIST SP 800-53
   • CNIST SP 800-37
   • DNIST SP 800-30
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a primary reason for including security requirements in third-party contracts?

   • ATo ensure the third party's security posture aligns with the organization's risk tolerance
   • BTo guarantee the third party will never suffer a data breach
   • CTo transfer all security liability to the third party
   • DTo eliminate the need for ongoing vendor monitoring
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary goal of designing resilient solutions?

   • ATo minimize the cost of IT infrastructure
   • BTo maximize the speed of individual components
   • CTo simplify the architecture by reducing redundancy
   • DTo ensure systems remain available and recoverable during disruptions
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of a business continuity plan (BCP)?

   • ATo restore IT systems after a disaster
   • BTo prevent all security incidents
   • CTo ensure critical business functions can continue during and after a disruption
   • DTo reduce the cost of IT operations
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company outsources its payroll processing to a third-party provider. The provider will handle employee PII, including social security numbers and bank account details. The company's security architect is drafting the outsourcing agreement. Which element is MOST important to include to ensure the provider's security posture is maintained?

   • AA requirement for the provider to maintain a business continuity plan (BCP) and disaster recovery (DR) plan.
   • BA clause that requires the provider to implement and maintain a comprehensive information security program, including access controls, encryption, and incident response.
   • CA service level agreement (SLA) that specifies the provider's system uptime and response times.
   • DA clause that allows the company to terminate the contract with 30 days' notice for any reason.
   Reveal Solution Discussion Select an answer first