1.1 - Comply with Codes of Ethics SSCP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company's organizational code of ethics states that employees must avoid conflicts of interest. A security administrator is also a part-time consultant for a vendor that sells security products to the company. The administrator is asked to evaluate bids from several vendors, including the one they consult for. What is the most appropriate action?

   • ARecommend the vendor they consult for because they know the product is the best
   • BDecline to participate in the evaluation and disclose the relationship to the manager
   • CEvaluate all vendors fairly and disclose the relationship after the decision is made
   • DParticipate in the evaluation but recuse themselves from voting on the vendor they consult for
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security professional is asked to perform a penetration test on a system without proper authorization. The professional knows that the request comes from a senior executive who claims to have the authority. What should the professional do?

   • ARefuse to perform the test under any circumstances
   • BProceed with the test because the senior executive has authority
   • CVerify the authorization in writing before proceeding
   • DPerform the test but document that the executive requested it
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company's code of ethics requires employees to protect the company's reputation. A security analyst discovers that a security breach occurred but the company's management decides not to disclose it to the public to avoid negative publicity. The analyst believes the breach could affect customers. What should the analyst do?

   • AReport the breach to the appropriate regulatory authorities
   • BResign from the position to avoid involvement
   • CRespect the management's decision and keep the breach confidential
   • DDisclose the breach to the public anonymously
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is one of the four canons of the ISC2 Code of Ethics?

   • APrioritize the interests of the employer over all other considerations.
   • BEnsure all systems are compliant with international standards.
   • CProtect society, the common good, necessary public trust and confidence, and the infrastructure.
   • DMaximize shareholder value through efficient security operations.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security professional is working on a project that involves collecting personal data from users. The professional notices that the data collection is not compliant with the organization's privacy policy. The project manager says that the policy is outdated and the collection is necessary for the project's success. What should the professional do?

   • AProceed with the data collection but document the policy violation
   • BProceed with the data collection and update the policy later
   • CProceed with the data collection because the project manager has authority
   • DRefuse to proceed with the data collection until the policy is updated
   Reveal Solution Discussion Select an answer first