1.9 Manage Security Programs ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security manager is mediating a conflict between the data privacy officer (DPO) and the data analytics team. The analytics team wants to use a new dataset that contains personal data for a marketing analysis project. The DPO has stated that using the data for this purpose is not compliant with the organization's privacy policy. The analytics team argues that the project is critical for revenue growth. The security manager must resolve this conflict. What is the most appropriate action?

   • ASupport the DPO's position and inform the analytics team that the project cannot proceed under any circumstances.
   • BFacilitate a meeting between the DPO and the analytics team to explore whether the data can be used in a compliant manner, such as through anonymization or a revised purpose.
   • CSupport the analytics team's position because the revenue impact is a critical business need that should take priority.
   • DEscalate the conflict to the CEO for a final business decision, since the issue involves a trade-off between compliance and revenue.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization is implementing a new identity and access management (IAM) system. The security team is leading the project, but the human resources (HR) department is a key stakeholder because they manage the employee onboarding and offboarding processes. The security manager wants to ensure the new IAM system works well with HR's processes. What is the best way to build this cross-functional relationship?

   • AInclude an HR representative on the IAM project steering committee from the beginning.
   • BWait until the IAM system is fully built and then train HR on how to use it.
   • CHave the security team independently design the IAM system and then present the final design to HR for approval.
   • DAsk HR to provide a list of their requirements and then proceed without further consultation.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   The sales department wants to use a new cloud-based file-sharing service to collaborate with external partners. The security team has identified that the service does not meet the organization's data encryption standards. The sales director is frustrated and demands the service be approved immediately. What is the best way for the security manager to resolve this conflict?

   • AWork with the sales director to identify the specific business need and evaluate alternative secure file-sharing solutions that meet both requirements.
   • BEscalate the issue to the CEO and let them make the final decision.
   • CApprove the service with a temporary exception while the security team evaluates alternatives.
   • DDeny the request and tell the sales director that the service is not secure and cannot be used.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a typical organization, which role is primarily responsible for the day-to-day implementation and operation of security controls?

   • AInternal Auditor
   • BSecurity Analyst
   • CChief Information Security Officer (CISO)
   • DBoard of Directors
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization is updating its procurement process. The security team wants to ensure that all new software purchases are reviewed for security before they are acquired. The procurement team is concerned this will slow down the purchasing process. What is the best way to integrate the security review into the procurement workflow?

   • AAsk the procurement team to informally check with the security team before making any purchases.
   • BAdd a mandatory security review step to the procurement workflow, with a defined service-level target for completion.
   • CRequire the security team to review all purchases after they have been made.
   • DProvide the procurement team with a list of approved vendors and allow them to purchase from those vendors without further review.
   Reveal Solution Discussion Select an answer first