1.9 Manage Security Programs ISSMP Practice Questions (Page 6)

Questions 26–27

1. 26expert · hard

   A multinational company is implementing a new security program. The CISO has defined the overall strategy, but there is confusion about who is responsible for day-to-day operational decisions, such as approving exceptions to the firewall policy. The network team believes they own this decision, while the security operations center (SOC) manager believes it is their responsibility. This ambiguity has led to delays and frustration. The CISO wants to resolve this without creating a perception that one team is being 'punished'. What is the most effective approach?

   • AHold a meeting with both teams and ask them to come to a consensus on who should own the decision.
   • BEscalate the decision to the CISO for every firewall exception request.
   • CAllow the network team to continue making the decisions since they have the technical expertise.
   • DCreate a formal decision rights matrix that clearly assigns the authority for firewall policy exceptions to the SOC manager, with the network team responsible for implementation.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security manager is leading a project to deploy a new customer-facing application. The marketing department insists on a feature that requires collecting additional personal data, which the security team believes increases privacy risk beyond the organization's stated risk appetite. The security manager needs to move the project forward without escalating to executive leadership. What is the most effective first step?

   • AInform marketing that the feature cannot be implemented under any circumstances due to security policy.
   • BSchedule a facilitated working session with marketing and security to explore alternative data collection methods that meet both objectives.
   • CRequest that the project sponsor make a final decision on the feature's inclusion.
   • DApprove the feature but document the residual risk in the project risk register for future review.
   Reveal Solution Discussion Select an answer first