A multinational corporation is acquiring a smaller company that handles sensitive customer data. The acquisition is being finalized quickly. Which governance process is most appropriate to ensure security risks are identified and addressed?

Wait until after the acquisition and then conduct a security assessment of the new subsidiary.

Rely on the target company's existing security certifications to assume adequate protection.

Appoint a security manager from the acquirer to oversee the target's security after the deal closes.

Perform a comprehensive security due diligence review of the target company before the acquisition closes.

A company's business strategy is to be the fastest innovator in its industry. The security team wants to implement a comprehensive security framework that requires extensive documentation and controls. The CIO is concerned this will slow down development. What is the best approach?

Implement the full framework as planned to ensure security.

Adopt a risk-based approach that applies controls based on the sensitivity of the data and systems.

Implement only the minimum required by law.

Delay the framework implementation until the business strategy changes.

During an acquisition, when should the security function be involved to ensure security governance is integrated into the organizational process?

Only after the acquisition is finalized and systems are integrated

During the due diligence phase, before the acquisition is finalized

Only if the target company has experienced a data breach

After the acquisition, only if the integration team requests it

A company is divesting a business unit that includes a legacy IT system with sensitive customer data. The divestiture is scheduled to close in 60 days. What is the most important security governance action to take during this process?

Immediately disable all access to the legacy system to prevent data loss.

Transfer all data to the buyer without review to expedite the process.

Conduct a full security audit of the buyer's entire organization.

Ensure the buyer accepts responsibility for the data and that data is properly transferred or deleted.

Certified Information Systems Security Professional

Domain 1Objective 3

1.3 - Evaluate and Apply Security Governance Principles CISSP Practice Questions (Page 3)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

16%of the exam

Questions 11–15

11application · medium
A financial services company must demonstrate to regulators that it has implemented a comprehensive set of security controls. The company wants to use a framework that is widely recognized and certifiable. Which framework is most appropriate for this purpose?
Select an answer first
12application · medium
A multinational corporation is acquiring a smaller company that handles sensitive customer data. The acquisition is being finalized quickly. Which governance process is most appropriate to ensure security risks are identified and addressed?
Select an answer first
13expert · hard
A company's business strategy is to be the fastest innovator in its industry. The security team wants to implement a comprehensive security framework that requires extensive documentation and controls. The CIO is concerned this will slow down development. What is the best approach?
Select an answer first
14foundation · easy
During an acquisition, when should the security function be involved to ensure security governance is integrated into the organizational process?
Select an answer first
15application · medium
A company is divesting a business unit that includes a legacy IT system with sensitive customer data. The divestiture is scheduled to close in 60 days. What is the most important security governance action to take during this process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.