ISC Leadership And Organizational Management Practice Test 5 — 15 Questions

Question 1

When designing a security program, which TWO of the following factors should be considered to ensure the program can successfully scale with organizational growth?

Accepted Answer

Designing security controls that are modular and can be easily integrated.. Scalability depends on automating processes where possible and ensuring the security architecture is modular and flexible to adapt to new business units or technologies.

Answer

Limiting the organization to only one type of operating system.

Answer

Requiring all security configurations to be manually audited daily.

Answer

Maintaining all security data in a single, local spreadsheet.

Question 2

A global financial services firm has experienced three major security incidents in the past year, each traced to a different business unit ignoring security policies during rapid project delivery. The CISO wants to embed security accountability into the performance management system rather than relying on after-the-fact audits. Which approach is MOST effective for achieving this goal?

Accepted Answer

Integrate specific security objectives and metrics into each business unit manager's performance scorecard and compensation structure.. The most effective way to embed security accountability is to make it part of how managers are evaluated and rewarded. Integrating security objectives into performance scorecards and compensation aligns business unit incentives with security outcomes, directly addressing why units ignored policies. Attestations, monitoring tools, and audits are supporting controls, but they do not change the performance management system that drives behavior.

Answer

Deploy an automated policy compliance monitoring tool that flags deviations and sends weekly reports to the security operations center.

Answer

Require all business unit managers to sign an annual security attestation form acknowledging they have read the security policy.

Answer

Increase the frequency of internal security audits from annually to quarterly and publish findings to the audit committee.

Question 3

An ISSMP is leading the development of a new security governance framework for a multinational manufacturing company. The framework must ensure that security decisions are made at the right level and that the program remains aligned with business strategy over time. Which TWO of the following are essential components of this governance framework? (Choose two.)

Accepted Answer

A documented process for periodically reviewing and updating security policies to reflect changes in the threat landscape and business operations.. Essential governance components include a cross-functional steering committee to set direction and a process for keeping policies current. The steering committee ensures decisions are made at the right level with business input, while policy review maintains alignment over time. Operational elements like SOCs, technical standards, and training are important but are executed within the governance framework, not part of its core structure.

Answer

A centralized security operations center (SOC) that monitors all network traffic and responds to incidents 24/7.

Answer

A mandatory annual security awareness training program for all employees.

Answer

A comprehensive set of technical security standards specifying approved encryption algorithms and firewall configurations.

Question 4

A newly appointed CISO at a mid-sized healthcare organization discovers that security responsibilities are informally assigned across departments, with no clear ownership. The organization must comply with HIPAA and wants to establish clear accountability for security. Which action should the CISO take FIRST to establish a foundation for security governance?

Accepted Answer

Define and document security roles and responsibilities, including a RACI matrix, and obtain executive approval.. Establishing clear roles and responsibilities through a RACI matrix and executive approval creates the accountability foundation necessary for security governance. Without defined ownership, other efforts such as risk assessments, awareness, and tools lack direction and sustainment. This first step ensures that subsequent activities have clear owners and decision-making authority, directly addressing the informal assignment problem.

Answer

Perform a comprehensive risk assessment to identify all vulnerabilities and threats to protected health information.

Answer

Deploy a governance, risk, and compliance (GRC) tool to automate policy management and risk tracking.

Answer

Conduct a security awareness campaign to educate all staff on their security responsibilities.

Question 5

You are the ISSMP for a multinational retailer that operates in the European Union and the United States. The Chief Human Resources Officer asks you to approve a new employee monitoring tool that captures screenshots, keystrokes, and application usage on all corporate endpoints. Legal counsel in the EU has not yet been consulted. As the ISSMP, which action best demonstrates alignment of security leadership with legal and privacy obligations before the tool is deployed?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) with legal counsel and the works council before approving the monitoring tool.. Employee monitoring is high-risk processing under GDPR, so a DPIA must be completed before deployment. Involving legal counsel and the works council ensures the security program respects privacy, employment law, and consultation requirements. The ISSMP's role is to integrate legal and privacy governance into security decisions rather than treat monitoring as a purely technical control.

Answer

Require the vendor to sign a data processing agreement and then proceed with full deployment.

Answer

Deploy the tool only on endpoints used by US-based employees to avoid EU regulatory exposure.

Answer

Approve the tool because endpoint monitoring is a standard security control covered by the acceptable use policy.

Question 6

You are the ISSMP at a financial services firm that has just acquired a smaller competitor. The acquisition brings 400 new employees, a different identity provider, and an unintegrated security operations center. Executive leadership wants a single security governance model within twelve months. Which action should you prioritize first to establish effective governance across the combined organization?

Accepted Answer

Define a unified security governance charter that assigns decision rights, accountability, and reporting lines for the merged security function.. Post-merger security integration succeeds when governance is defined first. A charter specifying decision rights, accountability, and reporting lines gives the combined security function a clear operating model. Only then can policy harmonization, identity consolidation, and SOC integration proceed coherently. Starting with technical merges without governance invites conflict and gaps in accountability.

Answer

Extend the acquiring company's security policies to the acquired entity without modification.

Answer

Immediately migrate all acquired employees to the acquiring company's identity provider.

Answer

Consolidate both security operations centers into one physical location within the first quarter.

Question 7

A global manufacturing company has a federated governance model in which each regional business unit owns its own security budget and risk register. The corporate CISO is accountable to the board for enterprise-wide risk but has no direct authority over regional security spending. The board has asked the CISO to produce one consolidated risk view that can be audited. Which action should the ISSMP take FIRST to establish an effective enterprise-wide security governance structure?

Accepted Answer

Charter a security governance council with named regional and corporate representatives, and agree on decision rights, a common risk taxonomy, and a consolidated reporting cadence.. In a federated organization, the CISO often has accountability without line authority, so governance must be constructed through negotiation rather than command. A chartered council with explicit decision rights, a shared risk taxonomy, and a defined reporting cadence converts fragmented regional risk data into a single auditable enterprise view. Centralizing budgets, issuing unilateral policy, or outsourcing assessment each fail to create the durable, repeatable governance mechanism the board requires, and each risks alienating the regional owners whose participation is essential.

Answer

Consolidate all regional security budgets under the corporate CISO and reassign regional security staff to a centralized reporting line.

Answer

Publish a corporate security policy that mandates a single enterprise risk register owned and updated solely by the corporate security office.

Answer

Engage an external audit firm to assess each region's security posture and deliver the findings directly to the board on the CISO's behalf.

Question 8

You are the ISSMP at a healthcare provider preparing for a HIPAA security rule assessment. The CIO asks you to identify which activities are the responsibility of the security management process standard under administrative safeguards. (Choose two.)

Accepted Answer

Implementing security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.. The HIPAA security management process standard under administrative safeguards requires a risk analysis and risk management, along with a sanction policy and periodic evaluation. The risk analysis identifies exposures to ePHI, and risk management applies proportionate safeguards. Encryption, unique user identification, and emergency access procedures fall under other safeguard standards and specifications.

Answer

Implementing a mechanism to encrypt ePHI whenever deemed appropriate.

Answer

Assigning a unique name or number for identifying and tracking user identity.

Answer

Implementing procedures to authorize emergency access to ePHI during an emergency.

Question 9

A healthcare insurer is preparing for a regulatory examination and must demonstrate to examiners that its security program is driven by documented leadership commitment rather than by the security team alone. The CISO reports to the CIO, and security topics rarely reach the board. Which action should the ISSMP recommend to best satisfy the examiners' expectation of visible executive ownership?

Accepted Answer

Establish a board-level risk committee that receives security risk reporting, approves risk appetite, and documents its oversight decisions in formal minutes.. Regulators and examiners distinguish between a well-run security function and a governed one. The decisive evidence is leadership setting risk appetite, receiving risk information, and being accountable for decisions, all documented. A board-level risk committee with formal reporting, risk-appetite approval, and minuted decisions provides that evidence directly. Operational improvements, awareness training, and framework mappings are useful, but each remains an artifact of the security team and does not show that executives own and direct the program.

Answer

Increase the frequency of vulnerability scans and include the results in the monthly security operations report sent to the CIO.

Answer

Require all executives to complete the same annual security awareness training that is assigned to general staff.

Answer

Adopt an industry-recognized security framework and map existing controls to it so the program can be presented as mature and comprehensive.

Question 10

You are the ISSMP at a mid-sized manufacturing company. The CEO asks you to explain how the security program supports the organization's strategic goal of expanding into new international markets. Which response best demonstrates strategic alignment of the security program with business objectives?

Accepted Answer

Security will map regulatory, contractual, and customer assurance requirements in each target market and build a roadmap that enables compliant market entry.. Strategic alignment means security actively supports business goals. Mapping regulatory, contractual, and customer assurance requirements for target markets lets security remove barriers and inform expansion planning. This positions the ISSMP as a business enabler, giving leadership a roadmap that ties controls and investments to market entry success rather than treating security as an isolated cost.

Answer

Security will defer all planning until the business finalizes its expansion locations and timelines.

Answer

Security will request additional budget to purchase more tools before any expansion decision is made.

Answer

Security will implement the same controls used in the domestic market to keep costs predictable during expansion.

Question 11

You are the ISSMP at a global logistics company. The board has adopted a risk appetite statement that tolerates moderate operational risk but demands very low tolerance for safety and regulatory compliance failures. A business unit proposes bypassing a mandatory security control to accelerate a new routing platform launch. Which action best reflects the ISSMP's responsibility in enforcing the board's risk appetite?

Accepted Answer

Evaluate the control's purpose against the risk appetite, document residual risk, and require a time-bound remediation plan with executive acceptance if the bypass proceeds.. The ISSMP enforces risk appetite by evaluating whether a proposed exception breaches the board's tolerances, documenting the residual risk, and requiring accountable executive acceptance with a remediation timeline. This balances business speed with governance. Outright approval or denial, or deferring to audit, fails to apply the board's stated risk criteria to the decision.

Answer

Approve the bypass because the risk appetite allows moderate operational risk and the launch is time-sensitive.

Answer

Deny the bypass outright and instruct the business unit to delay the launch until full compliance is achieved.

Answer

Refer the decision to the internal audit function and take no further action until audit issues a finding.

Question 12

You are the ISSMP for a mid-sized financial services firm. The CIO asks you to build a repeatable process for evaluating and onboarding new vendors that handle regulated data. You must ensure the process produces defensible evidence of due diligence and aligns with the firm's risk appetite. Which approach best satisfies this requirement?

Accepted Answer

Establish a formal third-party risk management program with tiered due diligence, standardized security questionnaires, contractual security requirements, and periodic reassessments based on risk tier.. A structured, tiered third-party risk management program is the most defensible approach because it standardizes due diligence, scales oversight to risk, embeds contractual security obligations, and includes ongoing reassessment. This produces auditable evidence and ensures vendor risk decisions reflect the organization's risk appetite rather than ad hoc judgments.

Answer

Require every vendor to complete the same exhaustive security questionnaire annually, regardless of the data they handle or the services they provide.

Answer

Delegate vendor security review entirely to the procurement department and accept their recommendation without security team involvement.

Answer

Rely on the vendor's public marketing materials and self-attestations as the sole source of security assurance before onboarding.

Question 13

Your organization is restructuring its security team after a merger. Two legacy security operations centers use different escalation paths, and executives complain that incident decisions are inconsistent. As the ISSMP, you must design a governance structure that clarifies authority, accountability, and decision rights across the combined security function. Which action best accomplishes this?

Accepted Answer

Publish a security governance charter and RACI matrix that define decision rights, escalation thresholds, and accountable roles for the unified security organization.. A governance charter with a RACI matrix establishes documented decision rights, accountability, and escalation thresholds. This directly resolves inconsistent escalation across merged security operations and gives executives a single, transparent model for how security decisions are made, reviewed, and escalated.

Answer

Transfer all security decision-making authority to the IT operations director, since that role already manages the largest technical team.

Answer

Adopt the escalation process from the larger legacy organization without modification and require the smaller team to comply immediately.

Answer

Allow each legacy security operations center to keep its existing escalation path and resolve conflicts case by case through informal manager discussions.

Question 14

As the ISSMP, you are advising the executive team on how to embed security requirements into the organization's enterprise architecture practice. Business units frequently deploy new cloud services without security review, creating unmanaged risk. Which action best integrates security into enterprise architecture governance?

Accepted Answer

Mandate that security architecture review be a required gate in the enterprise architecture approval workflow for new solutions, with defined security criteria and exception handling.. Making security architecture review a defined gate in the enterprise architecture approval workflow integrates security into existing governance rather than adding a parallel process. Clear criteria and exception handling keep the gate practical, auditable, and aligned with business delivery, which addresses unmanaged cloud deployments at the point of decision.

Answer

Require business units to submit a security questionnaire after each cloud service is deployed and remediate any findings within thirty days.

Answer

Ask the enterprise architecture team to consult the security team informally whenever they believe a new solution may have security implications.

Answer

Issue a policy stating that cloud services are prohibited unless the security team approves them, without defining approval criteria or an exception process.

Question 15

You are the ISSMP leading development of a security strategy that must support a three-year business transformation involving cloud migration and new digital products. Executive leadership expects the strategy to be both risk-based and measurable. Which two actions are most appropriate to include in the strategy? (Choose two.)

Accepted Answer

Establish a governance and reporting cadence that ties security performance metrics to the same executive dashboard used for transformation delivery.. A risk-based, measurable strategy aligns security objectives and indicators with business transformation milestones and executive risk appetite, and reports them through the same governance cadence as delivery. This keeps security integrated, visible, and adjustable as threats and business priorities evolve, rather than treating it as a separate or deferred workstream.

Answer

Adopt a fixed three-year security budget and roadmap that cannot be adjusted regardless of changes in the threat landscape or business priorities.

Answer

Defer all security architecture changes until the cloud migration and digital product launches are complete, to avoid slowing delivery.

Answer

Measure strategy success primarily by the number of security tools deployed and the volume of policies published during the transformation.