Information Systems Security Management Professional
Domain 3Objective 4
3.4 Manage Risk Controls ISSMP Practice Questions (Page 1)
Part of the Risk Management domain, which accounts for 20% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)
23questions here
5free pages
5concepts
20%of the exam
Questions 1–5
- 1
A hospital has a legacy patient records system that cannot support modern encryption at rest. To mitigate the risk of data exposure, the security team has implemented a compensating control: all access to the legacy system is logged and reviewed weekly. The hospital's compliance officer questions whether this compensating control is adequate. Which additional measure would most strengthen the compensating control?
Select an answer first - 2
An organization wants to ensure that its intrusion detection system (IDS) continues to detect new types of attacks. Which ongoing process is most appropriate for this purpose?
Select an answer first - 3
An organization uses a security information and event management (SIEM) system to collect and analyze logs from various systems. What type of control effectiveness assessment does this primarily support?
Select an answer first - 4
Which element is most important for a report on risk control effectiveness to be actionable for senior management?
Select an answer first - 5
A multinational corporation has implemented a security control that blocks USB devices on all employee workstations. The control was tested in the headquarters office and found to be 100% effective. However, the security team is concerned about the control's effectiveness in remote offices. Which factor is most important to consider when assessing the control's effectiveness across the entire organization?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.