1.2 Align Security Program with Organizational Governance ISSMP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an effective method for communicating with stakeholders about security initiatives?

   • ASharing information only on a need-to-know basis
   • BUsing the same technical jargon for all audiences
   • CTailoring the message to the audience's interests and level of technical detail
   • DCommunicating only through formal written reports
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team needs additional budget to hire two security analysts. The budget request must be approved by the finance committee. Which action would most likely secure the committee's approval?

   • AProvide a risk assessment showing the potential financial impact of understaffing and how the analysts would reduce that risk
   • BHighlight that competitors have larger security teams
   • CAsk the CISO to personally request the budget from the committee chair
   • DSubmit a request that outlines the analysts' roles and expected salary costs
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A security manager has been delegated authority to approve access requests up to a certain level. What should the manager do when a request exceeds that level?

   • AApprove the request anyway to avoid delays
   • BDeny the request without explanation
   • CIgnore the request
   • DEscalate the request to the appropriate higher authority
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst discovers that a vendor has left a cloud storage bucket publicly accessible, exposing customer data. The analyst wants to immediately restrict access. Which source of authorization should the analyst rely on to take this action?

   • AThe company's social media policy
   • BThe vendor's service level agreement
   • CThe incident response plan, which authorizes immediate containment actions
   • DThe CEO's general statement that security should be a top priority
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization has a decentralized structure where each business unit has its own IT and security teams. The corporate security team wants to implement a unified security incident response plan. What is the most effective way to gain buy-in and ensure consistency?

   • ADevelop the plan independently and present it to the board for approval
   • BEstablish a cross-functional committee with representatives from each business unit to develop and approve the plan
   • CAllow each business unit to create its own plan and share best practices informally
   • DMandate the plan through a corporate directive and require all units to comply
   Reveal Solution Discussion Select an answer first