ISC Leadership And Organizational Management Practice Test 3 — 15 Questions

Question 1

Which of the following is a key component of a successful security awareness training program?

Accepted Answer

Regular, engaging, and relevant content. Regular, relevant, and engaging content is necessary to keep security top-of-mind for employees and to ensure long-term retention of good security practices.

Answer

Focusing only on threats to external users

Answer

Using outdated training videos to save costs

Answer

Mandating attendance once every five years

Question 2

Which TWO of the following are essential components of an effective security governance framework?

Accepted Answer

Clearly defined roles, responsibilities, and accountability. A comprehensive framework needs defined policies (what) and a structure of accountability (who) to ensure execution.

Answer

The latest artificial intelligence tools

Answer

A dedicated office space for the security team

Answer

A large annual security budget

Question 3

When managing a global security team, what is the primary challenge in maintaining a uniform security posture?

Accepted Answer

Cultural differences and local regulations. Cultural differences and local regulatory requirements make it difficult to enforce a single, global standard, requiring a balance between global directives and local adaptation.

Answer

Lack of global email systems

Answer

Time zone differences

Answer

Language barriers

Question 4

An ISSMP is evaluating a Cloud Access Security Broker (CASB) implementation. Which management goal is most effectively addressed by this tool?

Accepted Answer

Enforcing security policies for cloud application usage. A CASB provides visibility and control over cloud usage, enabling the enforcement of corporate security policies on data stored or accessed in cloud applications.

Answer

Automating the patching of local workstations

Answer

Managing user access to local databases

Answer

Securing the physical data center

Question 5

Which THREE of the following are common indicators that a security program is failing to align with business objectives?

Accepted Answer

Increase in unauthorized technology use (Shadow IT). Lack of executive support, high levels of friction, and shadow IT are all strong indicators of a disconnect between security strategy and business goals.

Answer

Security budget is lower than the IT budget

Answer

The security team is located in the basement

Question 6

Which THREE of the following should be included in an annual strategic security plan?

Accepted Answer

Current state assessment of security maturity. A strategic plan must look at current maturity, future initiatives (projects), and the resources required to achieve those goals.

Answer

A detailed list of every firewall rule

Answer

A list of all employee salaries

Question 7

Which THREE of the following are important considerations for an ISSMP when outsourcing security functions?

Accepted Answer

Retaining the ultimate accountability for security. Outsourcing requires careful legal review, performance monitoring (SLAs), and ensuring that the provider is properly integrated into the organization's overall risk management.

Answer

Requiring the vendor to use only your internal tools

Answer

Choosing the vendor with the lowest price

Question 8

Which THREE of the following are critical for successfully managing cross-functional security initiatives?

Accepted Answer

Demonstrating clear alignment with business benefits. Success in cross-functional work requires stakeholder involvement, clear communication of the business value, and shared ownership of the outcomes.

Answer

Focusing solely on the technical specifications

Answer

Excluding IT management from the planning phase

Question 9

Which TWO of the following are core components of a business-aligned security strategy?

Accepted Answer

Prioritization of security investments based on business impact. Alignment requires understanding the business's current state and risk profile, and ensuring that security projects are prioritized to support the most important business functions.

Answer

A requirement for all employees to have PhDs

Answer

A complete list of every software vulnerability in the firm

Answer

A mandate that all security tools must be from one vendor

Question 10

Which TWO of the following are metrics that provide insight into the effectiveness of security leadership?

Accepted Answer

Trend in risk reduction over time. Leadership effectiveness is best measured by the organization's ability to minimize risk over time and the efficiency with which resources are converted into security posture improvements.

Answer

Number of firewall blocks per second

Answer

The color of the security team's uniforms

Answer

The number of security certifications held by the CISO

Question 11

Which THREE of the following are key indicators of a mature security governance program?

Accepted Answer

The board receives regular, meaningful updates on security posture. Mature programs are characterized by metrics-driven processes, integration with enterprise functions, and active, informed oversight by the board.

Answer

The security team works in total isolation from the rest of the company

Answer

The CISO reports to the Help Desk manager

Question 12

Which TWO of the following are effective communication strategies for a CISO interacting with senior executives?

Accepted Answer

Focusing on the business impact of security risks. Executives need concise, business-focused information that allows them to make informed decisions about risk and resource allocation.

Answer

Providing hour-long technical deep dives on every vulnerability

Answer

Using complex, obscure security acronyms

Answer

Writing 50-page reports for every meeting

Question 13

Which THREE of the following are challenges in transitioning to a secure DevSecOps model?

Accepted Answer

Lack of security training for developers. Transitioning requires overcoming cultural resistance, automating complex security gates, and ensuring developers have the right training to take ownership of security.

Answer

Using only manual security review processes

Answer

Replacing all developers with security professionals

Question 14

During a cross-functional security planning session, the IT operations team argues that security controls are negatively impacting system performance. As an ISSMP, what is the most appropriate management approach to resolve this conflict?

Accepted Answer

Perform a joint business impact analysis to determine the optimal balance of security and performance. Effective security management involves balancing security needs with business operational requirements through a collaborative risk-based approach, ensuring security is integrated rather than imposed.

Answer

Enforce the security controls regardless of performance impacts

Answer

Escalate the issue to the CIO for a final decision without further analysis

Answer

Reduce security controls until performance targets are met

Question 15

An organization is moving from a reactive security posture to a proactive threat-informed defense. As the ISSMP, you are implementing the MITRE ATT&CK framework. Which executive-level metric best demonstrates the maturity of the security program to the Board of Directors regarding this transition?

Accepted Answer

Percentage of MITRE ATT&CK techniques covered by existing controls. Mapping security coverage to MITRE ATT&CK techniques provides a quantifiable measure of defensive maturity that boards can understand, representing the shift from reactive compliance to proactive threat management.

Answer

Time to remediate critical security incidents

Answer

Number of phishing emails blocked by the email gateway

Answer

Total number of vulnerabilities patched per month