1.1 - Understand, Adhere to, and Promote Professional Ethics CISSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is one of the four canons of the ISC2 Code of Professional Ethics?

   • APromote the use of open-source software
   • BMaximize shareholder value above all other considerations
   • CProtect society, the common good, and the infrastructure
   • DEnsure all systems are available 24/7
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst discovers that a senior manager has been using a shared administrative account to access confidential employee records without a legitimate business need. The analyst reports this to the CISO, who dismisses it as a minor issue and instructs the analyst to ignore it. The analyst is an ISC2 member. What should the analyst do first?

   • AIgnore the issue since the CISO, a higher authority, has decided it is not a concern.
   • BPublicly expose the manager's actions on social media to ensure accountability and transparency.
   • CReport the behavior to the appropriate internal authority, such as internal audit or HR, and document the steps taken.
   • DResign from the organization to avoid being associated with unethical behavior.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security professional is investigating a potential data breach and discovers that a colleague accidentally exposed customer data due to a misconfigured database. The colleague is a close friend and has already fixed the misconfiguration. The professional is an ISC2 member. What should they do?

   • AKeep the incident confidential to protect the colleague's career.
   • BReport the incident only if the colleague does not report it themselves.
   • CDo not report the incident because the misconfiguration is fixed and no harm occurred.
   • DReport the incident to the appropriate internal authority, such as the incident response team, even though the misconfiguration is fixed.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An ISC2 member is asked by a client to provide a security assessment report that overstates the effectiveness of the client's security controls to satisfy an insurance requirement. What should the member do?

   • ARefuse to overstate the findings and provide an accurate report.
   • BOverstate the findings as requested to maintain the client relationship.
   • CRefuse the engagement and terminate the relationship with the client.
   • DProvide the overstated report but include a footnote about the inaccuracies.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an effective method to promote ethical behavior within an organization?

   • AConducting regular ethics training and awareness programs
   • BPunishing employees who report ethical concerns
   • CLimiting ethics discussions to senior management only
   • DKeeping the code of ethics confidential
   Reveal Solution Discussion Select an answer first