1.1 Establish Security's Role in Organizational Culture, Vision, and Mission ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A manufacturing company has a long-standing culture where 'getting the job done' is valued over following procedures. Employees routinely share passwords to expedite machine access, and safety incidents are underreported to avoid production delays. The new security director must improve security posture without halting production. What is the most effective first step?

   • ALaunch a security awareness campaign that highlights the risks of password sharing and the importance of reporting incidents.
   • BTerminate employees who are found sharing passwords or underreporting incidents to send a strong message.
   • CConduct a cultural assessment to understand the drivers of the 'get it done' mindset and identify where security can align with production goals.
   • DImplement multi-factor authentication (MFA) across all systems and enforce a strict password policy.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial services firm has a culture where security is viewed as the sole responsibility of the IT department. Employees see security as an obstacle to their work. The CISO wants to foster a culture of shared security accountability. Which strategy is most likely to achieve this?

   • AEstablish a security champions program where representatives from each business unit receive extra training and act as liaisons to their teams.
   • BIncrease the frequency of phishing simulations and publicly report the click rates of each department.
   • CPurchase a new security awareness training platform and require all employees to complete the modules annually.
   • DCentralize all security decisions within the IT department to ensure consistency and control.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A manufacturing company's strategic goal is to become the industry leader in smart, connected products. The CISO wants to ensure the security program supports this goal. The company's current security posture is focused on compliance and prevention. What should the CISO do to align security with the new strategic direction?

   • ACreate a new security policy that restricts the use of cloud services to reduce attack surface.
   • BIncrease the security budget for traditional perimeter defenses to protect the new products.
   • CDevelop a security vision that emphasizes enabling secure innovation and connectivity for smart products.
   • DMaintain the current compliance-focused security program to avoid introducing risk.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why is it important to align information security objectives with the organization's strategic goals?

   • ATo guarantee that all security risks are eliminated.
   • BTo reduce the need for security awareness training.
   • CTo make the security team independent from business decisions.
   • DTo ensure security initiatives directly support and enable business success.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A software development company has a culture that celebrates 'heroic' efforts, where developers who work long hours to fix critical bugs are rewarded. This has led to security shortcuts being taken during crunch times. The security manager wants to change this aspect of the culture. What is the most effective strategy?

   • AReward developers who follow secure coding practices and meet deadlines without taking security shortcuts.
   • BIncrease the severity of penalties for developers who are found to have taken security shortcuts.
   • CImplement a code review process that catches security issues before they are deployed.
   • DProvide more security training to developers to improve their awareness of secure coding practices.
   Reveal Solution Discussion Select an answer first