A CISSP-certified consultant is hired to assess a client's security posture. During the assessment, the consultant discovers that the client is knowingly violating a data protection regulation. The client asks the consultant to omit this finding from the final report to avoid regulatory penalties. The consultant is an ISC2 member. What should the consultant do?

Refuse to omit the finding and include it in the report, explaining the ethical and legal obligations.

Include the finding only if the client agrees to fix the issue within a reasonable time.

Report the violation to the regulatory authority immediately without informing the client.

Omit the finding to maintain a good relationship with the client and secure future business.

What is the primary purpose of an organizational code of ethics?

To ensure all employees achieve the same performance metrics

To establish a hierarchy of authority within the organization

To provide a framework for ethical decision-making and expected behavior

To replace legal and regulatory requirements

A security team wants to ensure that all employees understand the organizational code of ethics. Which approach is most effective?

Require employees to sign the code of ethics annually, but do not provide any training.

Post the code of ethics on the company intranet and assume employees will read it.

Incorporate ethics training into the onboarding process and provide annual refresher courses.

Send a one-time email to all employees with the code of ethics attached.

How can a security leader promote professional ethics by leading by example?

Publicly praising only their own ethical achievements

Making ethical decisions only when they are convenient

Demonstrating ethical decision-making in their own actions

Delegating all ethical decisions to subordinates

A security professional is asked to sign a non-disclosure agreement (NDA) that prevents them from reporting any security vulnerabilities they discover to anyone, including regulatory authorities. The professional is an ISC2 member. What should they do?

Sign the NDA but report vulnerabilities anonymously to avoid legal consequences.

Sign the NDA and only report vulnerabilities that could cause immediate harm.

Sign the NDA and comply with its terms, as it is a legal contract.

Refuse to sign the NDA and negotiate terms that allow reporting to appropriate authorities when required by law or ethics.

Certified Information Systems Security Professional

Domain 1Objective 1

1.1 - Understand, Adhere to, and Promote Professional Ethics CISSP Practice Questions (Page 5)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

16%of the exam

Questions 21–25

21expert · hard
A CISSP-certified consultant is hired to assess a client's security posture. During the assessment, the consultant discovers that the client is knowingly violating a data protection regulation. The client asks the consultant to omit this finding from the final report to avoid regulatory penalties. The consultant is an ISC2 member. What should the consultant do?
Select an answer first
22foundation · easy
What is the primary purpose of an organizational code of ethics?
Select an answer first
23application · medium
A security team wants to ensure that all employees understand the organizational code of ethics. Which approach is most effective?
Select an answer first
24foundation · easy
How can a security leader promote professional ethics by leading by example?
Select an answer first
25expert · hard
A security professional is asked to sign a non-disclosure agreement (NDA) that prevents them from reporting any security vulnerabilities they discover to anyone, including regulatory authorities. The professional is an ISC2 member. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.