6.2 Understand, Adhere to, and Promote Professional Ethics ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A multinational corporation is updating its organizational code of ethics. The compliance team wants the code to be effective across diverse regional offices with different cultural norms. The CEO asks the security manager to ensure the code genuinely influences employee behavior rather than being a document that is filed away. Which approach would most effectively achieve this goal?

   • APublish the code on the corporate intranet and require all employees to acknowledge receipt annually.
   • BDevelop the code with input from regional leaders, deliver interactive training, and establish clear reporting channels for violations.
   • CCreate a single, strict global code and terminate any employee who violates it, regardless of local context.
   • DDelegate the code's implementation entirely to each regional office without central oversight.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A technology startup is growing rapidly and has just hired its first security manager. The startup has no formal code of ethics, and the founders are skeptical of bureaucracy. They want to maintain a fast-paced, innovative culture. The security manager must introduce a code of ethics without stifling the startup's agility. What is the most effective approach?

   • ADevelop a concise code focused on core values and provide practical examples relevant to the startup's work.
   • BDelay implementing a code of ethics until the company grows larger and has more resources.
   • CCreate a comprehensive, detailed code of ethics modeled on a large enterprise's code.
   • DRely on the founders' personal integrity to guide the company without a formal code.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A CISSP-certified security consultant is hired to assess a client's network. During the assessment, the consultant discovers evidence of illegal activity originating from the client's systems. The client asks the consultant to keep the finding confidential, citing attorney-client privilege. The consultant is not a lawyer. What should the consultant do in accordance with the ISC2 Code of Ethics?

   • AResign from the engagement and delete all evidence to avoid legal entanglement.
   • BComply with the client's request because confidentiality is a cornerstone of the consulting relationship.
   • CAnonymously leak the information to the media to ensure public awareness.
   • DReport the illegal activity to the appropriate authorities, as the duty to protect society takes precedence.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security director is tasked with implementing a new organizational code of ethics focused on data privacy. The company has a high turnover rate in its IT department, and many staff members have expressed that they do not understand how the code applies to their daily tasks. What should the director do first to address this implementation challenge?

   • ACreate a single, generic training video and require all staff to watch it once.
   • BPost the code on bulletin boards and rely on managers to enforce it informally.
   • CMandate that all IT staff sign the code annually and file the signed copies in HR records.
   • DIntegrate the code into onboarding, provide role-specific examples, and offer periodic refresher training.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security manager is implementing a new code of ethics in an organization where the sales team has a strong culture of aggressive target achievement. The sales team views the code as an obstacle to closing deals. The manager has limited budget for training and must choose one initiative to change the sales team's perception. Which initiative is most likely to be effective?

   • AAdd ethical compliance as a key performance indicator (KPI) in the sales team's performance reviews.
   • BHold a series of facilitated workshops where sales staff discuss real ethical dilemmas and how to handle them.
   • CPublish a monthly newsletter highlighting ethical successes and failures in the sales department.
   • DDevelop a one-hour e-learning module that all sales staff must complete by the end of the quarter.
   Reveal Solution Discussion Select an answer first