1.2 Align Security Program with Organizational Governance ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A CISO has been delegated authority to 'implement security measures' but not to 'change business processes.' The CISO wants to enforce a new policy that requires all employees to use a password manager, which will change how employees access applications. The CISO believes this is a security measure. What is the most appropriate action?

   • AConsult the executive sponsor to clarify whether the policy falls within the delegated authority
   • BImplement the password manager but only for the IT department
   • CIgnore the delegation and implement the policy anyway, as security is paramount
   • DImplement the password manager, as it is clearly a security measure
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is most effective when advocating for a security initiative to senior executives?

   • ALinking the initiative to business objectives and risk reduction
   • BAvoiding any discussion of risks
   • CPresenting only the costs without benefits
   • DFocusing only on technical details and vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is implementing a new data classification scheme. The legal department wants to classify all contracts as 'confidential,' while the sales team wants contracts to be 'internal' to facilitate sharing with partners. The security team needs to resolve this conflict. What is the most effective approach?

   • AClassify contracts as 'internal' but require legal approval for any external sharing
   • BAdopt the legal department's classification to minimize risk
   • CAdopt the sales team's classification to support business operations
   • DFacilitate a meeting between legal and sales to agree on a classification that balances risk and operational needs
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a typical corporate governance structure, which body is usually responsible for overseeing the organization's overall direction and holding executives accountable?

   • AThe IT department
   • BThe security operations center
   • CThe board of directors
   • DThe project management office
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security manager is leading a project to implement multi-factor authentication (MFA) for all remote access. The sales team has expressed concerns that MFA will slow down their workflow. What is the most effective way to address their concerns and gain their support?

   • ADelay the MFA implementation until the sales team requests it
   • BInvolve sales representatives in the selection of MFA methods to balance security and usability
   • CExplain the security benefits of MFA and how it protects customer data
   • DImplement MFA without consulting the sales team, as security is non-negotiable
   Reveal Solution Discussion Select an answer first