Which of the following is an example of a regulatory source of authorization for security actions?

A security vendor's white paper

A data protection regulation such as GDPR

A personal blog on security best practices

What is the primary goal of advocating for a security initiative to decision-makers?

To demonstrate technical expertise

To bypass the need for governance approval

To obtain formal support and approval for the initiative

To create fear and uncertainty among executives

Which of the following best describes an organizational governance structure?

The collection of all security policies and procedures

The process of hiring and training security personnel

The set of technical controls used to enforce security policies

The formal and informal arrangements that define decision-making authority and reporting lines

A multinational company is rolling out a new data classification standard. The CISO wants to enforce it globally, but regional business units have their own compliance teams and report to different regional heads. The board has delegated security policy approval to the executive risk committee. Which governance body should the CISO engage first to obtain formal authority for the global rollout?

The regional heads of business units

A security team wants to implement a security operations center (SOC) but lacks the budget for additional staff. The team proposes using a managed security service provider (MSSP) instead. Which argument would most effectively persuade the CFO to approve the MSSP budget?

The MSSP is a popular choice among peer companies

The MSSP provides 24/7 monitoring at a predictable cost, reducing the risk of a costly breach

The MSSP will eliminate the need for any internal security staff

The MSSP will reduce the need for capital investment in security tools

Information Systems Security Management Professional

Domain 1Objective 2

1.2 Align Security Program with Organizational Governance ISSMP Practice Questions (Page 5)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

21%of the exam

Questions 21–25

21foundation · easy
Which of the following is an example of a regulatory source of authorization for security actions?
Select an answer first
22foundation · easy
What is the primary goal of advocating for a security initiative to decision-makers?
Select an answer first
23foundation · easy
Which of the following best describes an organizational governance structure?
Select an answer first
24application · medium
A multinational company is rolling out a new data classification standard. The CISO wants to enforce it globally, but regional business units have their own compliance teams and report to different regional heads. The board has delegated security policy approval to the executive risk committee. Which governance body should the CISO engage first to obtain formal authority for the global rollout?
Select an answer first
25application · medium
A security team wants to implement a security operations center (SOC) but lacks the budget for additional staff. The team proposes using a managed security service provider (MSSP) instead. Which argument would most effectively persuade the CFO to approve the MSSP budget?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.