A security manager is presenting a new security policy to the executive team. What is the most effective way to advocate for the policy and obtain their support?

Avoiding discussion of costs and resources required

Demonstrating how the policy reduces risk and supports business objectives

Focusing only on technical details of the policy

Emphasizing that the policy is mandatory and cannot be changed

A manufacturing company is implementing a new security policy framework to comply with industry standards. The CEO is concerned that the new policies will slow down production and is hesitant to approve them. As the security manager, what should you do to gain the CEO's support?

Implement the policies without approval to demonstrate their effectiveness.

Present the policies as mandatory and explain that non-compliance could result in legal penalties.

Delay the implementation until the CEO fully understands every technical detail.

Emphasize the benefits of the policies, such as reduced risk of data breaches and improved customer trust.

An organization is defining data classification levels. Which factor is most important for determining the classification level of a data asset?

The storage location of the data

The sensitivity of the data and its regulatory obligations

The number of users who access the data

What is the primary purpose of a security baseline?

To provide a minimum level of security configuration for systems

To define the organization's overall security vision

To offer optional recommendations for improving security

To replace the need for security policies

A retail company's security policy framework has not been reviewed in three years. During this time, the company has adopted new payment processing technologies and new data protection regulations have been enacted. What should you do to ensure the framework remains effective?

Conduct a comprehensive review of the framework and update it to reflect the new technologies and regulations.

Only update the policies that directly relate to payment processing.

Wait until the next scheduled audit to review the framework.

Replace the entire framework with a new one based on the latest industry best practices.

Information Systems Security Management Professional

Domain 1Objective 4

1.4 Define and Maintain Security Policy Framework ISSMP Practice Questions (Page 3)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

21%of the exam

Questions 11–15

11foundation · easy
A security manager is presenting a new security policy to the executive team. What is the most effective way to advocate for the policy and obtain their support?
Select an answer first
12application · medium
A manufacturing company is implementing a new security policy framework to comply with industry standards. The CEO is concerned that the new policies will slow down production and is hesitant to approve them. As the security manager, what should you do to gain the CEO's support?
Select an answer first
13foundation · easy
An organization is defining data classification levels. Which factor is most important for determining the classification level of a data asset?
Select an answer first
14foundation · easy
What is the primary purpose of a security baseline?
Select an answer first
15application · medium
A retail company's security policy framework has not been reviewed in three years. During this time, the company has adopted new payment processing technologies and new data protection regulations have been enacted. What should you do to ensure the framework remains effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.