6.2 Understand, Adhere to, and Promote Professional Ethics ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security manager at a financial institution discovers that a colleague is selling customer data to a third-party marketing firm. The colleague is a CISSP holder and claims that the data is anonymized and the sale is permitted under a loophole in the company's privacy policy. The manager reviews the policy and confirms the loophole exists. What should the manager do?

   • APublicly expose the colleague on social media to warn other organizations.
   • BAllow the sale to continue because the company policy permits it and the data is anonymized.
   • CReport the activity to the appropriate internal governance body and recommend closing the policy loophole.
   • DConfront the colleague privately and ask them to stop, but take no further action if they refuse.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security manager is leading a team of engineers who frequently bypass security review processes to meet tight project deadlines. The manager wants to promote a culture of ethical security practice without creating resentment. Which strategy is most likely to encourage the engineers to voluntarily follow the security review process?

   • AExplain the ethical and business rationale for the reviews and recognize team members who consistently follow the process.
   • BIncrease the severity of penalties for any engineer who skips the security review process.
   • CRemove the security review requirement for projects under a certain size to reduce friction.
   • DAssign a dedicated compliance officer to audit every project and report violations to senior management.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A CISSP-certified security manager is part of a professional association's ethics committee. The committee is reviewing a case where a member knowingly submitted falsified penetration test results to a client. The member argues that the falsification was justified because the client was going to use the results to terminate employees. The committee must decide on a recommendation. What should the committee's recommendation be?

   • ARecommend a warning because the member's intent was to protect employees from unfair termination.
   • BRecommend a suspension but allow the member to continue practicing under supervision.
   • CRecommend no action because the client was not harmed and the member's motives were ethical.
   • DRecommend revocation of the member's certification because falsifying results violates the canon to act honorably.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a key step in implementing an organizational code of ethics?

   • AEnforcing the code only for senior management.
   • BCommunicating the code to all employees and providing training.
   • CKeeping the code confidential to avoid legal liability.
   • DWriting the code in complex legal language.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An ISC2-certified security manager discovers that a colleague has been selling confidential customer data to a third party. According to the ISC2 Code of Ethics, what is the manager's primary ethical obligation?

   • AConfront the colleague privately and give them a chance to stop.
   • BReport the colleague to the appropriate authorities or management.
   • CResign from the organization to avoid involvement.
   • DIgnore the situation because it is not the manager's responsibility.
   Reveal Solution Discussion Select an answer first