1.1 - Understand, Adhere to, and Promote Professional Ethics CISSP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's code of ethics requires employees to 'act in the best interest of the organization.' A security analyst discovers a vulnerability that could be exploited to steal customer data. The analyst's manager says not to report it because it would damage the company's reputation. What should the analyst do?

   • AResign from the organization to avoid being associated with the decision.
   • BPublicly disclose the vulnerability to force the organization to act.
   • CFollow the manager's instruction and keep the vulnerability confidential.
   • DReport the vulnerability to the appropriate internal authority, such as the CISO or risk management team.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security professional discovers a vulnerability that could be exploited to harm public infrastructure. According to the ISC2 Code of Professional Ethics, what is the professional's primary ethical obligation?

   • ASell the vulnerability to the highest bidder
   • BKeep the vulnerability secret to avoid panic
   • CReport the vulnerability to the appropriate authorities or stakeholders
   • DExploit the vulnerability to test the system's resilience
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An ISC2 member is a security consultant who discovers that a client's security policies are not being enforced, leaving sensitive data at risk. The client's management is aware but does not want to invest in enforcement. What should the consultant do?

   • AReport the client to regulatory authorities without informing the client first.
   • BDocument the risk and clearly communicate the potential consequences to management, recommending remediation.
   • CTerminate the consulting relationship immediately to avoid liability.
   • DIgnore the issue because the client has made an informed business decision.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's organizational code of ethics includes a section on 'conflicts of interest.' A security team member is also a part-time consultant for a vendor that sells security products to the company. What should the team member do?

   • AContinue participating in purchasing decisions but avoid mentioning the relationship.
   • BResign from the security team to avoid any appearance of a conflict.
   • COnly disclose the relationship if the vendor is selected for a contract.
   • DDisclose the relationship to the company's ethics officer or manager and recuse themselves from purchasing decisions involving that vendor.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security professional discovers that a colleague is selling customer data to a third party without authorization. The professional is an ISC2 member and has a close personal friendship with the colleague. What is the most ethical course of action?

   • AWarn the colleague to stop and give them a chance to correct the behavior before reporting.
   • BReport the behavior only if the colleague does not stop after a verbal warning.
   • CReport the colleague's actions to the appropriate internal authority, such as the security manager or legal department.
   • DIgnore the behavior to protect the friendship and avoid conflict.
   Reveal Solution Discussion Select an answer first