ISC2 ISSMP QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,ISC2 ISSMP Practice Exam (100 Questions)
Domain 1: Security Leadership and Management (Questions 1-25)
1. A newly appointed CISO is tasked with aligning the information security strategy with the organization's
business goals. Which of the following should be the CISO's FIRST step?
A. Conduct a comprehensive risk assessment.
B. Update the security policy framework.
C. Meet with key business stakeholders.
D. Implement a new security awareness program.
Answer: C
Rationale: Before any security strategy can be effectively aligned with business goals, the CISO must
understand what those goals are. Meeting with key business stakeholders (e.g., CEO, CFO, business unit
leaders) is the essential first step to understand the business mission, objectives, and risk appetite. All other
activities (risk assessment, policy updates, awareness) will be based on this understanding.
,2. An organization is decentralizing its operations into autonomous business units. How should the CISO adapt
the information security governance model?
A. Maintain a centralized governance model to ensure consistency.
B. Implement a federated governance model.
C. Delegate all security decisions to the business units.
D. Outsource all security functions to a managed security service provider (MSSP).
Answer: B
Rationale: A federated governance model is a hybrid approach that balances central oversight with
decentralized execution. It allows the central security function to set overarching policy, standards, and risk
appetite, while business units have the flexibility to implement controls that meet their specific operational needs.
This aligns well with a decentralized business structure.
3. Which of the following is the MOST important factor for the success of a security governance program?
A. The size of the security budget.
B. The technical expertise of the security team.
C. Executive management support and sponsorship.
D. The sophistication of the security tools deployed.
, Answer: C
Rationale: Without visible and active support from executive management, a security governance program lacks
the authority, funding, and cultural emphasis needed to be effective. Executive sponsorship ensures that security
is treated as a business enabler and that resources are allocated appropriately.
4. A CISO is developing a business case for a new security initiative. Which of the following is the MOST
effective way to communicate the value of the investment to the board of directors?
A. Present the technical specifications of the proposed solution.
B. Quantify the risk reduction in financial terms (e.g., ALE).
C. Compare the features of different vendor products.
D. Show a list of recent security incidents in the industry.
Answer: B
Rationale: Boards of directors are focused on business risk and financial performance. Translating security risks
into financial terms, such as Annualized Loss Expectancy (ALE), allows them to understand the potential
financial impact and the return on investment (ROI) of the proposed security controls in a language they
understand.
5. What is the primary purpose of a security steering committee?
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,ISC2 ISSMP Practice Exam (100 Questions)
Domain 1: Security Leadership and Management (Questions 1-25)
1. A newly appointed CISO is tasked with aligning the information security strategy with the organization's
business goals. Which of the following should be the CISO's FIRST step?
A. Conduct a comprehensive risk assessment.
B. Update the security policy framework.
C. Meet with key business stakeholders.
D. Implement a new security awareness program.
Answer: C
Rationale: Before any security strategy can be effectively aligned with business goals, the CISO must
understand what those goals are. Meeting with key business stakeholders (e.g., CEO, CFO, business unit
leaders) is the essential first step to understand the business mission, objectives, and risk appetite. All other
activities (risk assessment, policy updates, awareness) will be based on this understanding.
,2. An organization is decentralizing its operations into autonomous business units. How should the CISO adapt
the information security governance model?
A. Maintain a centralized governance model to ensure consistency.
B. Implement a federated governance model.
C. Delegate all security decisions to the business units.
D. Outsource all security functions to a managed security service provider (MSSP).
Answer: B
Rationale: A federated governance model is a hybrid approach that balances central oversight with
decentralized execution. It allows the central security function to set overarching policy, standards, and risk
appetite, while business units have the flexibility to implement controls that meet their specific operational needs.
This aligns well with a decentralized business structure.
3. Which of the following is the MOST important factor for the success of a security governance program?
A. The size of the security budget.
B. The technical expertise of the security team.
C. Executive management support and sponsorship.
D. The sophistication of the security tools deployed.
, Answer: C
Rationale: Without visible and active support from executive management, a security governance program lacks
the authority, funding, and cultural emphasis needed to be effective. Executive sponsorship ensures that security
is treated as a business enabler and that resources are allocated appropriately.
4. A CISO is developing a business case for a new security initiative. Which of the following is the MOST
effective way to communicate the value of the investment to the board of directors?
A. Present the technical specifications of the proposed solution.
B. Quantify the risk reduction in financial terms (e.g., ALE).
C. Compare the features of different vendor products.
D. Show a list of recent security incidents in the industry.
Answer: B
Rationale: Boards of directors are focused on business risk and financial performance. Translating security risks
into financial terms, such as Annualized Loss Expectancy (ALE), allows them to understand the potential
financial impact and the return on investment (ROI) of the proposed security controls in a language they
understand.
5. What is the primary purpose of a security steering committee?
