1.9 Manage Security Programs ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security manager leads a team of five analysts. One analyst consistently misses deadlines for vulnerability scan reports, which delays the remediation process. The manager has already discussed the issue with the analyst, but performance has not improved. What is the most appropriate next step for the manager?

   • AInitiate a formal performance improvement plan with clear, measurable goals and a timeline for improvement.
   • BReassign the reporting task to another analyst who is more reliable.
   • CIgnore the missed deadlines for now and hope the analyst improves with more experience.
   • DPublicly reprimand the analyst during the next team meeting to motivate them to improve.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is an effective way to overcome a communication bottleneck caused by information silos between security and other departments?

   • ACreating a cross-functional steering committee with representatives from each department
   • BDiscouraging informal communication between departments
   • CLimiting communication to email to avoid interruptions
   • DRequiring all communication to go through the CISO
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is migrating its on-premises applications to a cloud environment. The security team wants to embed security controls into the new cloud deployment process. The cloud engineering team is already using Infrastructure as Code (IaC) templates to deploy resources. The security manager has limited influence over the engineering team's daily work. What is the most effective way to integrate security controls into this process?

   • ADevelop a library of pre-approved, secure IaC modules that the engineering team is required to use for common resources.
   • BRun a security scanning tool against the deployed cloud resources after they are live and report any issues to the engineering team.
   • CProvide the engineering team with a set of approved security baselines and ask them to incorporate them into their templates.
   • DRequire the cloud engineering team to submit their IaC templates for a manual security review before any deployment.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the most effective way to assign accountability for a security task to a team member?

   • ADocument the task, the owner, and the deadline in a tracking system
   • BAssign the task to the team as a whole
   • CVerbally mention the task during a team meeting
   • DWait for a team member to volunteer
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security manager is leading a security program that spans multiple business units. The manager has a small central team but relies on 'security liaisons' in each business unit to implement controls. The manager notices that some liaisons are not completing their assigned tasks on time, and there is no clear way to measure their performance. What is the most effective way for the manager to improve accountability across this distributed team?

   • AEstablish a formal reporting structure where the security liaisons report directly to the security manager for all security-related tasks.
   • BCreate a shared dashboard that tracks the status of all security tasks and is visible to the security manager, the liaisons, and their business unit managers.
   • CHold a quarterly meeting with all liaisons to discuss their progress and address any challenges.
   • DSend a weekly email to all liaisons reminding them of their responsibilities and deadlines.
   Reveal Solution Discussion Select an answer first