1.1 - Understand, Adhere to, and Promote Professional Ethics CISSP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is updating its organizational code of ethics. The security team wants to ensure the code effectively guides employee behavior regarding data handling. Which component is most essential to include?

   • AA statement that employees should follow their personal moral compass when making decisions.
   • BA requirement that all employees sign the code annually, with no further training or communication.
   • CA clear statement of the organization's core values and principles related to integrity and confidentiality.
   • DA detailed list of every possible violation and the corresponding disciplinary action.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A security analyst notices a colleague bypassing access controls to retrieve data for a personal project. What is the most appropriate ethical action for the analyst to take?

   • AReport the incident through the organization's established reporting channel
   • BIgnore the incident to avoid conflict
   • CUse the same bypass to see what data is accessible
   • DConfront the colleague publicly to shame them
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When faced with an ethical dilemma in daily security practice, what is the first step a professional should take?

   • AIgnore the dilemma until it resolves itself
   • BIdentify the ethical issues and stakeholders involved
   • CMake a decision based on personal convenience
   • DImmediately escalate to the media
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An ISC2 member is asked by a manager to perform a security assessment that the member knows is not thorough enough to identify significant vulnerabilities. The manager wants to save time and money. What should the member do?

   • ARefuse to perform the assessment and explain the ethical obligation to provide a thorough and accurate assessment.
   • BPerform the assessment as requested and do not mention the limitations to avoid conflict.
   • CPerform the assessment as requested but document the limitations in the report.
   • DPerform the assessment as requested and add a disclaimer that the results are incomplete.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst discovers that a vendor's software contains a backdoor that could allow unauthorized access to the company's network. The vendor is a major partner and the company's leadership is reluctant to report the issue, fearing contractual penalties. The analyst is an ISC2 member. What is the most ethical course of action?

   • AKeep the backdoor confidential to avoid contractual penalties and protect the company's relationship with the vendor.
   • BSilently patch the backdoor in the company's environment without informing anyone.
   • CWait until the contract with the vendor expires before taking any action.
   • DReport the backdoor to the appropriate internal authority and, if necessary, to the vendor and relevant external parties.
   Reveal Solution Discussion Select an answer first