A company is implementing a new security awareness training program. The training will include simulated phishing emails sent to employees. Which stakeholders must be consulted before launching the simulation?

Marketing and public relations, to manage external communications about the program

The board of directors, to approve the training budget

HR and legal, to ensure the simulation aligns with employment policies and privacy regulations

IT and facilities, to ensure the simulation does not disrupt network operations

A security architect wants to replace the company's legacy VPN with a zero-trust network access (ZTNA) solution. The CEO is supportive but the IT operations team is concerned about the complexity of managing a new system. Which approach would best address the IT team's concerns and secure their support?

Present a cost-benefit analysis showing long-term savings

Emphasize that ZTNA is a proven technology used by many companies

Provide training and involve the IT team in the pilot deployment to build their confidence

Ask the CEO to mandate the change to overcome resistance

A CISO has been given authority by the CEO to 'take all necessary actions' to protect the company from cyber threats. The CISO plans to deploy a network monitoring tool that captures employee communications, citing this broad delegation. Legal and HR have not been consulted. What is the most appropriate action for the CISO?

Return the delegation to the CEO, as no CISO should accept such broad authority

Proceed with the deployment, as the CEO's delegation is explicit and broad

Consult legal and HR to confirm the scope of authority and compliance requirements before deploying

Deploy the tool only after notifying employees, as transparency satisfies all legal requirements

What is the primary purpose of engaging stakeholders in the security program?

To incorporate their needs and expectations into security decisions

To inform them only after decisions are made

To delegate all security responsibilities to them

To bypass formal governance processes

A security manager wants to implement a new identity and access management (IAM) system. The CFO is concerned about the cost, and the COO is worried about potential disruption to operations. Which approach would most effectively gain their support?

Present a detailed technical architecture of the IAM system

Request a meeting with the CEO to mandate the implementation

Implement the system in a pilot department first to demonstrate success

Emphasize the security risks of the current system and the potential financial and operational impact of a breach

Information Systems Security Management Professional

Domain 1Objective 2

1.2 Align Security Program with Organizational Governance ISSMP Practice Questions (Page 2)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

21%of the exam

Questions 6–10

6application · medium
A company is implementing a new security awareness training program. The training will include simulated phishing emails sent to employees. Which stakeholders must be consulted before launching the simulation?
Select an answer first
7application · medium
A security architect wants to replace the company's legacy VPN with a zero-trust network access (ZTNA) solution. The CEO is supportive but the IT operations team is concerned about the complexity of managing a new system. Which approach would best address the IT team's concerns and secure their support?
Select an answer first
8application · medium
A CISO has been given authority by the CEO to 'take all necessary actions' to protect the company from cyber threats. The CISO plans to deploy a network monitoring tool that captures employee communications, citing this broad delegation. Legal and HR have not been consulted. What is the most appropriate action for the CISO?
Select an answer first
9foundation · easy
What is the primary purpose of engaging stakeholders in the security program?
Select an answer first
10application · medium
A security manager wants to implement a new identity and access management (IAM) system. The CFO is concerned about the cost, and the COO is worried about potential disruption to operations. Which approach would most effectively gain their support?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

1.2 Align Security Program with Organizational Governance ISSMP Practice Questions (Page 2)

Questions 6–10

A company is implementing a new security awareness training program. The training will include simulated phishing emails sent to employees. Which stakeholders must be consulted before launching the simulation?

What is the primary purpose of engaging stakeholders in the security program?

A security manager wants to implement a new identity and access management (IAM) system. The CFO is concerned about the cost, and the COO is worried about potential disruption to operations. Which approach would most effectively gain their support?

Keep studying — Leadership and Organizational Management