最新的ISC CISSP-ISSMP - Information Systems Security Management Professional - CISSP-ISSMP免費考試真題

A. Request control

B. Configuration control

C. Change control

D. Release control

A. Editor

B. Owner

C. Security auditor

D. Custodian

E. User

A. IT systems located in dark rooms

B. A penetration testing technique

C. Unauthorized technology/systems used by employees without organizational approval or visibility, creating unmanaged risk

D. A backup data center

A. SLAs define measurable performance expectations (e.g., detection time, response time) and accountability mechanisms for outsourced security services

B. SLAs apply only to uptime, never security-specific metrics

C. SLAs replace the need for ongoing vendor oversight

D. SLAs are a formality with no enforceable value

A. Key management has no governance implications

B. Poor key management (e.g., lost keys, inadequate access controls, no rotation policy) can undermine the value of encryption and create business continuity/access risk

C. Encryption keys should never be rotated once created

D. Key management is solely the responsibility of end users

A. Incidents should always be handled in the order they are reported

B. Prioritization is unnecessary if the SOC has enough staff

C. Only incidents involving external attackers are prioritized

D. Incidents are prioritized based on business impact, criticality of affected assets, and potential for escalation

A. Contingency planning is exclusively a technical IT responsibility

B. Effective contingency planning requires business-wide prioritization, resource commitment, and cross-functional coordination that only executive sponsorship can provide

C. Contingency planning has no strategic business implications

D. IT departments should independently determine business recovery priorities without business input

A. All risk is eliminated

B. Security decisions align with organizational objectives and are subject to appropriate oversight

C. Technical staff can bypass policy for efficiency

D. Compliance replaces the need for risk management

A. Team members who receive additional security training and act as liaisons, promoting security awareness and practices within their local team

B. Security champions have no defined role or responsibility

C. Individuals who replace the need for a centralized security function

D. Security champions are only relevant in large enterprises

A. ZOPA

B. BATNA

C. Bias

D. PON

A. It's an optional best practice with no real requirement

B. Management review only occurs once, at initial certification

C. Periodic leadership review ensures the ISMS remains suitable, adequate, and effective, and drives continual improvement

D. It replaces the need for internal audits

A. Explainability is irrelevant if the AI model has high statistical accuracy

B. Explainability only matters for marketing purposes

C. Stakeholders (including auditors, affected users, and regulators) may need to understand why an automated decision was made, supporting accountability and trust

D. AI decisions should never be reviewed or challenged by humans

A. An internal HR policy

B. A high-level agreement of general cooperation

C. A detailed document defining specific deliverables, timelines, and requirements for a vendor engagement

D. A financial audit report

A. Only notify the jurisdiction where the company is headquartered

B. Immediately notify all regulators simultaneously without analysis

C. Wait until the internal investigation is fully complete before considering notification

D. Work with Legal to determine which jurisdictions' laws apply and their respective notification timelines and thresholds