A global company processes credit card data in multiple regions and is also a U.S. federal contractor. The company wants to adopt a single security framework to satisfy both PCI DSS and FedRAMP requirements. What is the most practical approach?

Adopt ISO/IEC 27001 as the single framework and map it to both PCI DSS and FedRAMP.

Adopt FedRAMP as the single framework since it is more comprehensive.

Adopt PCI DSS as the single framework since it is more stringent.

Use a common control framework and map to both PCI DSS and FedRAMP requirements.

Which of the following best describes the concept of due diligence in security governance?

Identifying and assessing risks and vulnerabilities to make informed decisions

Purchasing cyber insurance to transfer all security risks

Implementing security controls and practices that are actually put into operation

Delegating security responsibilities to external vendors

Which of the following best describes the role of the board of directors in security governance?

Providing oversight and ensuring that security risks are managed in line with the organization's risk appetite

Writing detailed security policies and procedures

Implementing specific security controls and technical safeguards

Conducting daily security monitoring and incident response

A security manager is preparing the annual security program plan. To best support the organization's business strategy, the plan should primarily be derived from which of the following?

The latest industry threat intelligence reports

Compliance requirements from the most recent audit report

The organization's mission, goals, and strategic objectives

The security team's preferred technologies and tools

Certified Information Systems Security Professional

Domain 1Objective 3

1.3 - Evaluate and Apply Security Governance Principles CISSP Practice Questions (Page 2)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

16%of the exam

Questions 6–10

6expert · hard
A global company processes credit card data in multiple regions and is also a U.S. federal contractor. The company wants to adopt a single security framework to satisfy both PCI DSS and FedRAMP requirements. What is the most practical approach?
Select an answer first
7foundation · easy
Which of the following best describes the concept of due diligence in security governance?
Select an answer first
8foundation · easy
Which of the following best describes the role of the board of directors in security governance?
Select an answer first
9foundation · easy
A security manager is preparing the annual security program plan. To best support the organization's business strategy, the plan should primarily be derived from which of the following?
Select an answer first
10foundation · easy
Which security control framework is specifically designed for the payment card industry and is required for organizations that handle credit card data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.