A government agency has implemented a security control to encrypt all sensitive data at rest. The agency's security team wants to establish a monitoring process to ensure the encryption is consistently applied. Which of the following would be the most effective monitoring approach?

Rely on the cloud provider's compliance certifications

Conduct an annual audit of encryption configurations

Review encryption key management logs monthly

Implement automated scanning to identify unencrypted data stores

Which method is most appropriate for determining whether a firewall rule is actually blocking the intended traffic in a production environment?

Checking the firewall's uptime statistics

Interviewing the network administrator about the rule

Reviewing the firewall configuration documentation

Conducting a penetration test against the firewall

What is the primary purpose of reporting risk control effectiveness and coverage to stakeholders?

To document the organization's compliance with industry standards

To provide a detailed technical analysis of each control's configuration

To satisfy regulatory requirements for public disclosure

To support informed risk management decisions

Information Systems Security Management Professional

Domain 3Objective 4

3.4 Manage Risk Controls ISSMP Practice Questions (Page 5)

Part of the Risk Management domain, which accounts for 20% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

20%of the exam

Questions 21–23

21application · medium
A government agency has implemented a security control to encrypt all sensitive data at rest. The agency's security team wants to establish a monitoring process to ensure the encryption is consistently applied. Which of the following would be the most effective monitoring approach?
Select an answer first
22foundation · easy
Which method is most appropriate for determining whether a firewall rule is actually blocking the intended traffic in a production environment?
Select an answer first
23foundation · easy
What is the primary purpose of reporting risk control effectiveness and coverage to stakeholders?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

3.4 Manage Risk Controls ISSMP Practice Questions (Page 5)

Questions 21–23

A government agency has implemented a security control to encrypt all sensitive data at rest. The agency's security team wants to establish a monitoring process to ensure the encryption is consistently applied. Which of the following would be the most effective monitoring approach?

Which method is most appropriate for determining whether a firewall rule is actually blocking the intended traffic in a production environment?

What is the primary purpose of reporting risk control effectiveness and coverage to stakeholders?

Keep studying — Risk Management