6.2 Understand, Adhere to, and Promote Professional Ethics ISSMP Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A security team leader notices that several junior analysts are sharing passwords and using unofficial workarounds to access systems, believing this improves efficiency. The leader wants to promote adherence to the ISC2 Code of Ethics and the organization's security policies. What is the most effective first step?

   • ACreate a new, more convenient password-sharing tool to accommodate the analysts' needs.
   • BHold a team meeting to discuss the ethical and security implications of password sharing and the proper procedures.
   • CQuietly change the passwords and hope the analysts will learn from the inconvenience.
   • DImmediately report the analysts to HR for disciplinary action.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A CISSP-certified security architect is designing a new system for a government client. The client's project manager, who is not security-certified, insists on a design that the architect knows will leave a critical vulnerability exploitable. The project manager argues that the vulnerability is acceptable because the system is not internet-facing and the threat model is low. The architect has raised concerns twice, but the project manager has overruled them. The architect's employment contract includes a clause requiring compliance with all client directives. What is the most appropriate action for the architect?

   • AAnonymously report the vulnerability to a public disclosure forum to force the client to address it.
   • BComply with the project manager's directive because the contract requires it and the threat model is low.
   • CResign from the project immediately to avoid any liability for the vulnerability.
   • DDocument the risk, escalate the concern to the client's senior leadership, and refuse to sign off on the design.
   Reveal Solution Discussion Select an answer first