6.2 Understand, Adhere to, and Promote Professional Ethics ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security director at a large corporation discovers that a senior executive has been using company resources to run a side business that competes with the company. The executive is also a CISSP holder. The director is unsure whether to report this because the executive is powerful and could retaliate. The company has a code of ethics that prohibits conflicts of interest. What is the director's most appropriate course of action?

   • AIgnore the issue because the executive's side business is small and does not significantly harm the company.
   • BConfront the executive privately and give them a chance to resign before reporting.
   • CAnonymously leak the information to the board to avoid personal retaliation.
   • DReport the conflict of interest through the company's established ethics reporting channel.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security manager is responsible for enforcing the organizational code of ethics in a company where a popular and high-performing sales executive has been found to be exaggerating the company's security capabilities in client proposals. The executive's sales numbers are critical to the company's quarterly earnings. The CEO is aware of the exaggeration but has not acted. What is the most appropriate action for the security manager?

   • AConfront the executive and ask them to stop, but take no further action if they refuse.
   • BIgnore the exaggeration because the executive's sales performance benefits the company.
   • CResign from the company to avoid being associated with the unethical behavior.
   • DDocument the exaggeration and escalate it to the board of directors or an independent ethics committee.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A CISSP-certified manager is asked by their employer to sign a compliance report that the manager knows contains inaccurate statements about the company's security posture. The employer says the report is only for internal use and will never be seen by regulators. What should the manager do?

   • AResign immediately and publicly denounce the company's practices.
   • BRefuse to sign the report and document the reasons for the refusal.
   • CSign the report because it is internal and will not affect external parties.
   • DSign the report but add a private note to the employer expressing concerns.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A senior security manager discovers that a vendor's product, which the company has already purchased and deployed, contains a critical vulnerability. The vendor has privately disclosed the flaw to the manager and asked for 90 days to develop a patch before public disclosure. The manager's CISO, under pressure from the board, instructs the manager to keep the vulnerability secret indefinitely to avoid reputational damage and potential stock impact. The manager holds the CISSP certification. What is the manager's most appropriate course of action under the ISC2 Code of Ethics?

   • AResign from the position immediately to avoid any personal liability associated with the vulnerability.
   • BComply with the CISO's directive because organizational policy takes precedence over personal ethical judgment.
   • CAdvocate for responsible disclosure, escalate the concern to higher governance, and refuse to participate in concealing the vulnerability.
   • DPublicly disclose the vulnerability immediately, without notifying the vendor, to protect the public interest.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary role of an organizational code of ethics?

   • ATo ensure the organization maximizes profits.
   • BTo provide a framework for ethical decision-making and expected behavior within the organization.
   • CTo serve as a legally binding contract with customers.
   • DTo replace external laws and regulations.
   Reveal Solution Discussion Select an answer first