1.3 Define and Implement Information Security Strategies ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A financial institution is designing a new online banking platform. The business wants to provide a seamless user experience, but regulators require strong authentication and audit logging. The security architect must balance these requirements. Which approach best satisfies both?

   • AUse a single-factor authentication for all users to simplify the experience.
   • BDisable audit logging to improve system performance.
   • CRequire multi-factor authentication for every transaction, regardless of risk.
   • DImplement adaptive authentication that requires step-up verification for high-risk transactions.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization's security strategy includes a requirement for annual penetration testing. After two years, the security manager notices that the same vulnerabilities are being found each year. What should be done to improve the effectiveness of the strategy?

   • AReview the remediation process and update the strategy to include a vulnerability management program.
   • BRemove penetration testing from the strategy since it is not effective.
   • CReplace the penetration testing vendor with a different one.
   • DIncrease the frequency of penetration testing to quarterly.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security manager creates a detailed plan that assigns specific team members to tasks, sets milestones, and schedules training sessions to help staff adapt to new security processes. Which activity is being performed?

   • ASecurity requirements elicitation
   • BSecurity architecture design
   • CSecurity strategy execution
   • DSecurity strategy implementation planning
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A global company is merging with another organization. The merger will combine two different IT environments and require integrating security policies. The security manager must develop a unified security strategy. What is the most critical first step?

   • AImmediately implement the stricter security policies from either organization.
   • BAssign a single security team to manage both environments without changes.
   • CDesign a new security architecture based on industry best practices.
   • DConduct a joint security requirements elicitation with stakeholders from both organizations.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A manufacturing company is implementing an IoT system to monitor production equipment. The system will collect operational data and send it to a cloud platform. The company is concerned about potential cyberattacks that could disrupt production. Which security architecture approach best addresses this concern?

   • ACollect data in a proprietary format to prevent unauthorized access.
   • BRely on the cloud provider's security features without additional controls.
   • CUse a single vendor for all IoT devices and cloud services to simplify management.
   • DIsolate the IoT network from the corporate network and implement strict access controls.
   Reveal Solution Discussion Select an answer first