1.1 Establish Security's Role in Organizational Culture, Vision, and Mission ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which strategy is most effective for positively shaping organizational culture to enhance security?

   • AImplementing strict penalties for any security policy violation.
   • BIncreasing the number of security policies and procedures.
   • CProviding regular security awareness training that is relevant to employees' roles and encourages positive security behaviors.
   • DLimiting security communication to the security team only.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A technology startup has a culture that prizes speed and autonomy, with minimal formal process. The new security manager wants to integrate security initiatives with the company's operational objectives and core values. Which approach is most likely to gain buy-in from the engineering teams?

   • AIntroduce a comprehensive security policy manual and require all teams to follow it without exception.
   • BFrame security as a set of engineering best practices that enable reliable product delivery, and embed security reviews into the existing development workflow.
   • CCreate a separate security team that works independently from engineering to audit all code changes after deployment.
   • DOutsource all security functions to a managed security service provider to avoid burdening the internal teams.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which element is typically included in an information security program mission statement?

   • AThe detailed step-by-step procedures for incident response.
   • BThe program's purpose, scope, and primary responsibilities.
   • CThe long-term aspirational goals for the security program.
   • DThe specific security technologies and vendors the organization will use.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a key reason for aligning security initiatives with the organization's operational objectives?

   • ATo ensure security does not disrupt business operations.
   • BTo make security policies more complex and comprehensive.
   • CTo transfer security responsibilities to operational managers.
   • DTo reduce the number of security controls required.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A regional bank is launching a new mobile banking platform to increase customer engagement, a strategic priority for the next two years. The CISO is asked to ensure the security program supports this initiative. The bank's culture is risk-averse, with a history of security reviews that slow down projects. What should the CISO do FIRST to align security with this strategic goal?

   • AMandate a new secure coding standard for the mobile platform team and require sign-off from the CISO before each release.
   • BConduct a penetration test on the mobile platform to identify vulnerabilities before it goes live.
   • CCreate a security roadmap that lists all compliance requirements for the mobile platform and assign owners to each item.
   • DDraft a security vision statement that emphasizes customer trust and secure innovation, then socialize it with the mobile platform team.
   Reveal Solution Discussion Select an answer first