A company's security policy requires that all sensitive data be encrypted in transit. The network team is unsure which encryption protocols are acceptable. What should you develop to provide clear guidance?

A procedure that explains how to configure encryption on each network device.

A guideline that suggests using strong encryption without specifying protocols.

A baseline that defines the minimum encryption strength but not the protocols.

A standard that specifies the approved encryption protocols (e.g., TLS 1.2 or higher).

A security manager is identifying external requirements for an organization that operates in the European Union and handles personal data of EU citizens. Which regulation is most directly applicable to the organization's data protection obligations?

Federal Information Security Management Act (FISMA)

General Data Protection Regulation (GDPR)

Health Insurance Portability and Accountability Act (HIPAA)

What is the primary purpose of advocating for security policies and obtaining organizational support?

To ensure policies are implemented and enforced effectively

To increase the number of security policies

To avoid any changes to the policies

To reduce the need for security awareness training

A global company operates in multiple jurisdictions with conflicting data protection laws. One country requires data to be stored locally, while another requires data to be accessible for law enforcement. The company is developing a unified security policy framework. What is the best approach?

Adopt the laws of the company's headquarters country as the global standard.

Develop a single global policy that applies the most restrictive requirements to all jurisdictions.

Avoid creating policies for data protection until the laws are harmonized.

Create a global framework with regional policies that address local legal requirements.

A company's security policy framework is reviewed annually. This year, the review team has identified a conflict between a new regulatory requirement and an existing policy. The new regulation requires data retention for 10 years, but the existing policy requires data deletion after 5 years. What should you do?

Keep the existing policy and ignore the new regulation until it is enforced.

Seek an exemption from the regulatory requirement.

Update the policy to align with the new regulatory requirement and document the change.

Compromise by retaining data for 7 years.

Information Systems Security Management Professional

Domain 1Objective 4

1.4 Define and Maintain Security Policy Framework ISSMP Practice Questions (Page 1)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

21%of the exam

Questions 1–5

1application · medium
A company's security policy requires that all sensitive data be encrypted in transit. The network team is unsure which encryption protocols are acceptable. What should you develop to provide clear guidance?
Select an answer first
2foundation · easy
A security manager is identifying external requirements for an organization that operates in the European Union and handles personal data of EU citizens. Which regulation is most directly applicable to the organization's data protection obligations?
Select an answer first
3foundation · easy
What is the primary purpose of advocating for security policies and obtaining organizational support?
Select an answer first
4expert · hard
A global company operates in multiple jurisdictions with conflicting data protection laws. One country requires data to be stored locally, while another requires data to be accessible for law enforcement. The company is developing a unified security policy framework. What is the best approach?
Select an answer first
5expert · hard
A company's security policy framework is reviewed annually. This year, the review team has identified a conflict between a new regulatory requirement and an existing policy. The new regulation requires data retention for 10 years, but the existing policy requires data deletion after 5 years. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.