A software development company is subject to multiple external standards, including ISO 27001 and GDPR. The company is developing a new product that will process personal data of EU citizens. You need to ensure that the security policy framework addresses the requirements of both standards. What should you do?

Adopt ISO 27001 as the primary framework and ignore GDPR since it is a legal requirement.

Wait for the product to be fully developed before updating the policy framework.

Create separate policies for each standard to ensure all requirements are covered.

Map the requirements of both standards to existing policies and identify gaps.

A company's security policy framework was developed five years ago. Since then, the company has migrated to cloud services and new data protection regulations have been introduced. The framework has not been updated. What is the most important reason to conduct a review now?

To align the framework with the latest industry best practices.

To prepare for an upcoming external audit.

To reduce the number of policies in the framework.

To ensure the framework reflects the current regulatory and technological environment.

A university is developing a security policy for research data. The policy must comply with federal regulations and also support the university's mission of open research. You need to balance these requirements. What should you do?

Focus only on federal regulations and ignore the open research mission.

Adopt a policy from another university without modification.

Develop a policy that classifies research data based on sensitivity and allows for controlled sharing where appropriate.

Create a policy that prohibits all sharing of research data to ensure compliance.

A security manager is proposing a new policy that will require all employees to use hardware tokens for authentication. The policy is expected to cost $500,000 to implement. The CFO is concerned about the cost and asks for justification. What is the best way to justify the policy?

Offer to reduce the cost by using software tokens instead of hardware tokens.

Present a cost-benefit analysis that shows the potential losses from a security breach.

Explain that the policy is required by an external standard and cannot be changed.

Argue that the cost is minimal compared to the company's overall budget.

Information Systems Security Management Professional

Domain 1Objective 4

1.4 Define and Maintain Security Policy Framework ISSMP Practice Questions (Page 4)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

21%of the exam

Questions 16–20

16application · medium
A software development company is subject to multiple external standards, including ISO 27001 and GDPR. The company is developing a new product that will process personal data of EU citizens. You need to ensure that the security policy framework addresses the requirements of both standards. What should you do?
Select an answer first
17application · medium
A company's security policy framework was developed five years ago. Since then, the company has migrated to cloud services and new data protection regulations have been introduced. The framework has not been updated. What is the most important reason to conduct a review now?
Select an answer first
18application · medium
A university is developing a security policy for research data. The policy must comply with federal regulations and also support the university's mission of open research. You need to balance these requirements. What should you do?
Select an answer first
19foundation · easy
An organization processes credit card payments and must identify applicable external requirements. Which external standard is most directly applicable to the organization's payment card processing operations?
Select an answer first
20expert · hard
A security manager is proposing a new policy that will require all employees to use hardware tokens for authentication. The policy is expected to cost $500,000 to implement. The CFO is concerned about the cost and asks for justification. What is the best way to justify the policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

1.4 Define and Maintain Security Policy Framework ISSMP Practice Questions (Page 4)

Questions 16–20

A company's security policy framework was developed five years ago. Since then, the company has migrated to cloud services and new data protection regulations have been introduced. The framework has not been updated. What is the most important reason to conduct a review now?

A university is developing a security policy for research data. The policy must comply with federal regulations and also support the university's mission of open research. You need to balance these requirements. What should you do?

An organization processes credit card payments and must identify applicable external requirements. Which external standard is most directly applicable to the organization's payment card processing operations?

A security manager is proposing a new policy that will require all employees to use hardware tokens for authentication. The policy is expected to cost $500,000 to implement. The CFO is concerned about the cost and asks for justification. What is the best way to justify the policy?

Keep studying — Leadership and Organizational Management