1.1 Establish Security's Role in Organizational Culture, Vision, and Mission ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What does an information security program mission statement primarily communicate?

   • AThe current purpose, scope, and responsibilities of the security program.
   • BThe desired future state of the organization's security posture.
   • CThe specific security awareness training schedule for employees.
   • DThe budget allocation for security tools and personnel.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the relationship between information security and IT governance?

   • AIT governance is a subset of information security, focusing on compliance.
   • BIT governance replaces the need for a separate security program.
   • CSecurity is a component of IT governance, ensuring that IT decisions consider security risks and requirements.
   • DSecurity and IT governance are independent and do not interact.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a component of organizational culture that influences security behavior?

   • AThe physical layout of the office space.
   • BThe organization's shared values and beliefs about risk and security.
   • CThe specific security software and hardware in use.
   • DThe organization's legal structure (e.g., LLC, corporation).
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary benefit of mapping information security objectives to the organization's strategic goals?

   • AIt helps security initiatives receive funding and support by demonstrating their contribution to business outcomes.
   • BIt ensures security measures are consistently applied across all departments.
   • CIt simplifies the security architecture by reducing the number of controls.
   • DIt eliminates the need for separate security policies.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A government agency has a culture of strict hierarchy and formal approval processes. A new cybersecurity framework is being introduced, and the security director knows that top-down mandates are the norm. However, the agency also has a strong value of public service. How should the security director introduce the new framework to maximize adoption?

   • AIssue a formal directive from the agency head mandating compliance with the new framework.
   • BPilot the framework in one department and share success stories before rolling it out agency-wide.
   • CCreate a working group of employees from various levels to design the implementation plan.
   • DFrame the framework as a way to enhance the agency's ability to serve the public by protecting citizen data and ensuring service continuity.
   Reveal Solution Discussion Select an answer first