ISC Leadership And Organizational Management Practice Test 2 — 15 Questions

Question 1

An organization is adopting a Zero Trust Architecture (ZTA). Which management principle is critical for the long-term success of this transition?

Accepted Answer

Continuous monitoring and verification. Continuous monitoring and verification are the fundamental principles of ZTA; without them, the architecture cannot adapt to changing threat landscapes.

Answer

Centralized static access lists

Answer

Automated patch management only

Answer

Strict perimeter-based defense

Question 2

A CISO is presenting a security program roadmap. Which approach is best for managing expectations regarding security maturity?

Accepted Answer

Defining security maturity as a set of phased milestones. Providing a phased implementation plan with measurable milestones allows the CISO to demonstrate progress while acknowledging that maturity is a journey.

Answer

Linking maturity to the total security budget

Answer

Promising 100% security coverage by the end of the year

Answer

Focusing only on the latest security technologies

Question 3

An ISSMP needs to ensure compliance with global data privacy regulations in a multinational environment. Which governance strategy provides the most consistent approach?

Accepted Answer

Adopting the strictest regulatory standard as the global baseline. Implementing a global privacy framework that defaults to the strictest common denominator ensures compliance across all jurisdictions, simplifying operational management.

Answer

Excluding high-risk regions from business operations

Answer

Maintaining separate policies for every country

Answer

Relying on legal counsel to interpret local laws for every access request

Question 4

Which leadership style is most effective for building a strong security team during a period of rapid organizational growth?

Accepted Answer

Transformational leadership. Transformational leadership inspires and motivates team members to exceed expectations by fostering a shared vision, encouraging innovation, and providing individualized consideration. During rapid growth, this style is most effective for building a strong security team because it aligns diverse talents toward common goals and adapts to change.

Answer

Transaction-based leadership

Answer

Laissez-faire leadership

Answer

Autocratic leadership

Question 5

A CISO is managing a security budget with high pressure for cost optimization. Which strategy provides the best balance between security and cost efficiency?

Accepted Answer

Implementing risk-based resource allocation. Risk-based resource allocation allows the security team to prioritize investments on the highest-impact threats, ensuring maximum ROI on security spending.

Answer

Delaying all security projects by 12 months

Answer

Reducing headcount in security operations

Answer

Switching to only open-source security tools

Question 6

An ISSMP is conducting a security awareness program. What is the primary metric for measuring the success of this program?

Accepted Answer

Change in behavior evidenced by incident reduction or simulation data. A reduction in actual security incidents or improved response to simulated phishing tests are direct indicators of improved security behavior, which is the program's goal.

Answer

The cost per employee for training

Answer

Number of training slides created

Answer

Percentage of employees who attended sessions

Question 7

To ensure security requirements are integrated into the System Development Life Cycle (SDLC), what is the most effective approach for the security team?

Accepted Answer

Embedding security champions within development teams. Embed security champions within development teams to act as liaisons, ensuring security is considered throughout the development process rather than treated as a final check.

Answer

Requiring developers to attend annual security seminars

Answer

Automating the code deployment process

Answer

Mandating a security review before production release

Question 8

When managing a security incident, what is the primary role of the CISO in a large enterprise?

Accepted Answer

Ensuring communication and strategic coordination. The CISO should focus on strategic decision-making, stakeholder communication, and resource management, leaving the tactical investigation to the incident response team.

Answer

Updating firewall rules manually

Answer

Performing forensic analysis on the compromised server

Answer

Drafting the initial incident response report

Question 9

A CISO needs to justify an increase in the security budget. Which argument is most persuasive to the Chief Financial Officer (CFO)?

Accepted Answer

Quantifying financial exposure from potential security events. Quantifying the cost of potential data breaches in terms of lost revenue and regulatory fines demonstrates the financial risk the CFO is helping to manage.

Answer

Comparing the budget to industry peers

Answer

Focusing on the technical features of a new tool

Answer

Listing the latest security threats in the industry

Question 10

An organization wants to improve its security posture against supply chain attacks. Which action is most effective for an ISSMP?

Accepted Answer

Implementing a third-party risk management program. Implementing a third-party risk management (TPRM) program that assesses vendors' security practices is the best way to address risks introduced by the supply chain.

Answer

Outsourcing all IT functions to a single large provider

Answer

Replacing all proprietary software with open-source

Answer

Increasing internal network segmentation

Question 11

Which of the following is the most important factor in the success of a security governance program?

Accepted Answer

Executive leadership support and commitment. Executive leadership support is the foundation upon which the security program is built; without it, policies lack authority and resources remain scarce.

Answer

The complexity of the security technology

Answer

The number of security staff members

Answer

The frequency of internal audits

Question 12

What is the primary purpose of an Incident Response (IR) plan?

Accepted Answer

To provide a structured approach to incident handling. An IR plan provides a structured, predefined approach to handling security incidents to minimize impact and ensure business continuity.

Answer

To identify all vulnerabilities in the network

Answer

To punish employees who cause incidents

Answer

To replace the need for security policies

Question 13

When aligning security with organizational goals, how should an ISSMP address a conflict between security controls and user productivity?

Accepted Answer

Conduct a risk-benefit analysis for alternative controls. Conduct a risk-benefit analysis to determine if the security control is truly necessary and if alternative, less intrusive controls exist that provide the same level of protection.

Answer

Remove the security control to favor productivity

Answer

Delegate the decision to the IT support manager

Answer

Enforce the security control regardless of impact

Question 14

When reporting to the board of directors, which presentation method is most effective for communicating security performance?

Accepted Answer

Dashboards correlating security metrics to business objectives. Using dashboards with KPIs that correlate security activity to business objectives (e.g., risk reduction, compliance status) provides the context necessary for informed board decision-making.

Answer

A list of all blocked malicious IP addresses

Answer

Detailed technical logs and packet captures

Answer

A full copy of the latest penetration test report

Question 15

An ISSMP is implementing a Disaster Recovery (DR) plan. Which objective is most important to define with business leaders?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable downtime for a business service, which drives the design of the recovery infrastructure.

Answer

The total cost of the recovery site

Answer

The physical address of the secondary site

Answer

The names of the IT staff members