1.3 Define and Implement Information Security Strategies ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An organization's security strategy includes a requirement for annual risk assessments. After a recent assessment, it was found that the organization's risk tolerance has changed due to new business priorities. What should the security manager do to ensure the strategy remains aligned?

   • AIncrease security controls across the board to reduce risk further.
   • BUpdate the security strategy to reflect the new risk tolerance and adjust controls accordingly.
   • CKeep the existing strategy and ignore the change in risk tolerance.
   • DConduct a new risk assessment to confirm the findings.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization is planning to implement a new identity and access management (IAM) system. The implementation will affect all employees and require changes to existing workflows. What should the implementation plan include to ensure a smooth transition?

   • AA budget that allocates funds for the software license but not for training.
   • BA plan to decommission the old system immediately after the new one is installed.
   • CA communication and training plan for employees, along with a phased rollout schedule.
   • DA detailed technical specification of the IAM system only.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is implementing a new data loss prevention (DLP) solution. The implementation plan includes a pilot phase in the finance department before company-wide rollout. What is the primary benefit of this phased approach?

   • AIt allows the company to avoid regulatory compliance during the pilot.
   • BIt allows the security team to identify and resolve issues in a controlled environment.
   • CIt reduces the total cost of the DLP solution.
   • DIt ensures that all employees are trained before the rollout.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization wants to adopt a zero-trust security model. The security team is small and has limited experience with micro-segmentation and continuous verification. What should the security manager do to increase the likelihood of successful implementation?

   • AOutsource the entire implementation to a vendor without internal involvement.
   • BLimit the zero-trust model to a single network segment to reduce complexity.
   • CProceed with implementation immediately to gain experience.
   • DAssess the team's current capabilities and provide targeted training before implementation.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During the planning phase of a security strategy, the project lead identifies that employees will need to change their daily workflows and schedules communication sessions to address resistance. Which aspect of planning is being addressed?

   • AChange management
   • BRisk assessment
   • CTimeline development
   • DResource allocation
   Reveal Solution Discussion Select an answer first