1.1 Establish Security's Role in Organizational Culture, Vision, and Mission ISSMP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A multinational corporation is integrating its security program with IT governance. The IT governance board is composed of senior leaders from various business units, each with different risk appetites. The security director must ensure that security decisions are consistent across the organization. What is the most effective approach?

   • AAllow each business unit to define its own security risk tolerance to accommodate their unique needs.
   • BDelegate all security decisions to the IT department to ensure technical consistency.
   • CCreate a security committee that includes representatives from each business unit to review all security decisions.
   • DEstablish a security risk appetite statement that is approved by the board and used as a basis for all security decisions.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   How does information security integrate with the organization's risk management process?

   • ASecurity identifies and assesses risks, and recommends controls to mitigate them to acceptable levels.
   • BSecurity only focuses on technical risks, while risk management handles business risks.
   • CSecurity operates independently from risk management to avoid conflicts of interest.
   • DSecurity is responsible for eliminating all risks identified by the organization.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a potential effect of a culture that does not value security awareness?

   • AThe security team will have more resources to invest in technology.
   • BEmployees may be less likely to report security incidents or suspicious activity.
   • CThe organization will have fewer security incidents.
   • DEmployees will automatically follow all security policies.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A retail company is integrating its security program with the enterprise risk management (ERM) process. The ERM team uses a specific risk scoring methodology, while the security team uses a different one. This has led to conflicting risk reports to the board. What should the security director do to improve integration?

   • AAsk the ERM team to adopt the security team's methodology because it is more detailed.
   • BContinue using the security team's methodology and present a separate report to the board.
   • CAdopt the ERM team's risk scoring methodology and map security risks to the enterprise risk taxonomy.
   • DCreate a third, new risk methodology that combines elements of both approaches.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which characteristic is most associated with an organization's culture?

   • AThe formal job descriptions and reporting lines.
   • BThe type of security certifications held by the staff.
   • CThe unwritten rules and shared assumptions that guide employee behavior.
   • DThe number of security policies and procedures in place.
   Reveal Solution Discussion Select an answer first