Organizational Culture CISM Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement best defines organizational culture in the context of information security governance?

   • AThe hierarchical structure and reporting lines that define authority and responsibility for security decisions
   • BThe shared values, beliefs, and behaviors that shape how employees perceive and respond to security expectations
   • CThe collection of security awareness training materials and communication campaigns used to educate employees
   • DThe formal policies, procedures, and technical controls that an organization implements to protect information assets
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security manager is evaluating why a new security policy is being ignored by employees. The policy requires two-factor authentication for all remote access. Which cultural factor is most likely contributing to the resistance?

   • AThe security team did not purchase the most expensive two-factor authentication solution.
   • BEmployees value convenience and find the extra step burdensome.
   • CThe policy was not communicated through the company newsletter.
   • DEmployees do not understand how to use two-factor authentication.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's governance objectives emphasize data protection and regulatory compliance, but the prevailing culture rewards 'getting things done' over following processes. The security manager wants to align the culture with governance objectives. What is the most effective first step?

   • AConduct a culture assessment to understand the values and behaviors that drive the 'getting things done' mindset.
   • BRedesign the governance objectives to be more flexible and less burdensome.
   • CLaunch a broad awareness campaign highlighting the importance of data protection.
   • DImmediately implement a strict enforcement program with penalties for non-compliance.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's governance objectives emphasize continuous improvement, but the culture is risk-averse and resistant to change. The security manager wants to align the culture with the objective of continuous improvement in security practices. What is the best approach?

   • AFocus on technical improvements only, without changing processes or culture.
   • BIntroduce small, incremental changes to security processes and celebrate each success.
   • CWait for external pressure, such as a regulatory requirement, to force change.
   • DMandate a complete overhaul of security processes to meet the objective quickly.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company wants to embed security awareness into its daily operations. The security team has limited budget and resources. Which initiative is most cost-effective and sustainable?

   • AImplement a mandatory annual security training course for all employees.
   • BIntegrate security reminders into existing communication channels, such as team meetings and project kickoffs.
   • CHire a dedicated security awareness manager to lead culture change.
   • DPurchase a commercial security awareness platform with gamified modules.
   Reveal Solution Discussion Select an answer first