3.4 Manage Risk Controls ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   During a control coverage analysis, an organization discovers that a critical application is protected by both a network firewall and a host-based firewall, but a less critical application has no firewall protection. What does this scenario illustrate?

   • AControl overlap and a coverage gap
   • BProper defense-in-depth implementation
   • CA single point of failure in the network
   • DAn example of compensating controls
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A regional bank has deployed a new online banking platform. To protect customer data, they implemented multi-factor authentication (MFA) for all users, a Web Application Firewall (WAF) to block common attack patterns, and a Security Information and Event Management (SIEM) system that generates alerts on suspicious login activity. During a risk assessment, the bank's CISO asks which of these controls is primarily detective in nature. Which control should the CISO identify?

   • AWeb Application Firewall
   • BMulti-factor authentication
   • CRisk assessment itself
   • DSecurity Information and Event Management (SIEM) system
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of conducting a control coverage analysis?

   • ATo determine the cost-effectiveness of each control
   • BTo test whether individual controls are functioning as intended
   • CTo assign ownership for each control to a specific individual
   • DTo identify areas where controls are missing or redundant across the organization
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company has implemented an intrusion prevention system (IPS) to block known attack signatures. The security team wants to assess whether the IPS is effective against new, unknown attacks. Which approach would best evaluate this?

   • AReview IPS logs for blocked attacks over the past month
   • BCheck that the IPS is running the latest signature updates
   • CVerify the IPS is inline in the network path
   • DConduct penetration testing using custom exploit techniques
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail company's security team has completed a quarterly assessment of control effectiveness and coverage. The results show that 95% of controls are operating effectively, but there is a significant gap in coverage for cloud storage assets. The CISO needs to report this to the board. Which report format would best support the CISO's decision-making?

   • AAn email with a list of all identified risks and their scores
   • BA high-level summary with a heat map showing control effectiveness and coverage gaps
   • CA detailed technical report listing every control and its test results
   • DA verbal update during the board meeting without written materials
   Reveal Solution Discussion Select an answer first