Organizational Culture CISM Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security manager is designing a security awareness program for a company that has a culture of 'not invented here', where employees are skeptical of external ideas and prefer to develop their own solutions. What is the most effective way to promote a security-aware culture in this environment?

   • AFocus on technical controls rather than cultural change.
   • BBring in external security experts to deliver training and best practices.
   • CEncourage employees to develop their own security practices and share them with peers.
   • DAdopt a standard industry security framework and mandate its use.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which approach is most likely to encourage employees to adopt security-conscious behaviors in their daily work?

   • APublishing a comprehensive security policy document on the intranet
   • BProviding a security hotline for employees to report incidents
   • CIntegrating security awareness into regular team meetings and project workflows
   • DRequiring employees to sign an acknowledgment of the security policy annually
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security manager notices that employees frequently use personal cloud storage to share work files, despite a policy prohibiting it. The manager suspects the culture values convenience over security. What is the best way to address this behavior?

   • AIgnore the behavior because it is not causing any known security incidents.
   • BIncrease the severity of penalties for using unauthorized cloud storage.
   • CProvide an approved, easy-to-use file-sharing tool and communicate its benefits.
   • DBlock access to personal cloud storage services at the network level.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A multinational company's security team notices that employees in one regional office frequently share passwords and leave screens unlocked, despite mandatory annual training. The security manager wants to improve the security culture in that office. Which approach is most likely to be effective?

   • AEngage local managers and employees to understand the reasons for the behavior and co-create solutions that fit the local work environment.
   • BIncrease the frequency of mandatory security training for all employees in that office.
   • CTerminate employees who violate security policies to send a strong message to the rest of the office.
   • DImplement stricter technical controls, such as automatic screen locks and password complexity requirements.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which action best demonstrates that an organization has successfully aligned its culture with its security governance objectives?

   • AEmployees proactively identify and report security risks without being required to do so
   • BThe security team has implemented a new firewall with advanced threat detection capabilities
   • CThe board of directors receives a monthly security dashboard showing key performance indicators
   • DThe organization has achieved ISO 27001 certification for its information security management system
   Reveal Solution Discussion Select an answer first