Organizational Culture CISM Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security manager wants to promote a security-aware culture in a company where employees are competitive and motivated by recognition. Which initiative is most likely to be effective?

   • ASend a monthly email with security tips and reminders.
   • BImplement a mandatory security training course with a test at the end.
   • CCreate a security leaderboard that publicly recognizes departments with the best security practices.
   • DPost security posters in common areas with general reminders.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of aligning organizational culture with information security governance objectives?

   • ATo ensure that employees naturally support and follow security practices as part of their daily work
   • BTo eliminate the need for security policies and technical controls
   • CTo transfer all security responsibilities from management to employees
   • DTo ensure that security decisions are made exclusively by the information security team
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which scenario best illustrates a positive impact of organizational culture on information security governance?

   • AThe organization has a detailed incident response plan that is reviewed annually
   • BThe board of directors approves a new security policy that mandates multi-factor authentication
   • CEmployees routinely report suspicious emails to the security team without being prompted
   • DThe security team conducts quarterly phishing simulations to test employee awareness
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security manager is explaining to the board why a recent security awareness campaign did not change employee behavior. Which statement best describes the role of organizational culture in this situation?

   • ACulture is an individual trait, so training each employee will change the culture.
   • BCulture is determined by the security team's policies and procedures, so changing them will change behavior.
   • CCulture is the set of shared values and norms that influence how employees interpret and respond to security policies.
   • DCulture is the same as employee morale, so improving morale will improve security behavior.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security manager is assessing the impact of organizational culture on security governance. The company has a culture of 'heroic' behavior, where employees are praised for working long hours and solving problems quickly, even if it means bypassing security controls. What is the most likely impact of this culture on security governance?

   • AIt will increase the effectiveness of security governance because employees are motivated to solve problems.
   • BIt will undermine security governance because employees may bypass controls to achieve quick results.
   • CIt will only impact security governance if there is a security incident.
   • DIt will have no impact because security governance is a technical function.
   Reveal Solution Discussion Select an answer first