1.1 Establish Security's Role in Organizational Culture, Vision, and Mission ISSMP Practice Questions (Page 7)

Questions 31–33

1. 31expert · hard

   A hospital's culture is deeply rooted in patient care, where clinicians often bypass security controls to access patient data quickly in emergencies. The security team has implemented strict access controls, but clinicians find them too slow. The hospital's leadership values patient outcomes above all. What is the most effective way to address this conflict?

   • ARemove the strict access controls to allow clinicians unrestricted access to patient data.
   • BWork with clinicians to design a 'break-glass' access process that is fast and auditable for emergency situations.
   • CEnforce the strict access controls and discipline clinicians who bypass them.
   • DProvide additional security training to clinicians on the importance of access controls.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A consulting firm has a culture where billable hours are the primary metric of success. Employees often skip security training to maximize client-facing time. The security manager wants to improve security awareness without hurting billable hours. Which strategy is most effective?

   • AIntegrate security awareness into existing client project workflows, such as brief security reminders during project kickoffs.
   • BOutsource security awareness training to an external provider to reduce internal effort.
   • CMake security training mandatory and require completion before employees can access the network.
   • DCreate a new, longer security training module that covers all topics in depth.
   Reveal Solution Discussion Select an answer first
3. 33foundation · easy

   Which statement best describes the purpose of an information security program vision statement?

   • AIt lists the daily operational tasks of the security team.
   • BIt details the specific security controls and technologies to be implemented.
   • CIt provides a forward-looking, aspirational description of the desired future state of security within the organization.
   • DIt defines the legal and regulatory requirements the organization must meet.
   Reveal Solution Discussion Select an answer first