I85PREP
⌘ K
ITIL 4 InfoSec study materials
ITIL 4 InfoSec study resources

ITIL 4 InfoSec practice questions

One question at a time. Build your ITIL 4 InfoSec understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information security management in the ITIL 4 context

In ITIL 4, which component of the service value system provides the shared set of guiding beliefs that shape how information security decisions are made across the organization?

  1. The continual improvement model
  2. The guiding principles Correct answer.
  3. The service value chain
  4. The four dimensions model

Explanation

The guiding principles are universal recommendations that shape behaviour and decision-making, including security trade-offs. The service value chain describes activity flows, the four dimensions describe perspectives, and the continual improvement model is a structured improvement lifecycle.

Question 2Information security management in the ITIL 4 context

Which ITIL 4 guiding principle most directly supports an information security manager deciding to start with a small pilot of a new access-review process before rolling it out enterprise-wide?

  1. Keep it simple and practical
  2. Collaborate and promote visibility
  3. Focus on value
  4. Progress iteratively with feedback Correct answer.

Explanation

Progress iteratively with feedback encourages organizing work into small, manageable iterations and using feedback to refine before scaling. A pilot is the classic expression of this principle. The other principles address value focus, collaboration, and simplicity rather than incremental rollout.

Question 3Information security management in the ITIL 4 context

Which of the four dimensions of service management is primarily concerned with the knowledge, skills, and security awareness of the staff running and consuming a service?

  1. Information and technology
  2. Value streams and processes
  3. Partners and suppliers
  4. Organizations and people Correct answer.

Explanation

Organizations and people covers roles, responsibilities, culture, and the competence and awareness of individuals. Awareness training and security roles therefore sit in this dimension. The other dimensions address technology, external parties, and workflow respectively.

Question 4Information security management in the ITIL 4 context

A security team records every identified vulnerability in a single register with an owner, status, and remediation date. Under ITIL 4, which practice does this activity most directly belong to?

  1. Service request management
  2. Incident management
  3. Service desk
  4. Problem management Correct answer.

Explanation

Problem management identifies and manages the causes of potential incidents, including known errors and underlying vulnerabilities. A register of root causes with owners and remediation dates is a problem-management artifact. Incident management restores service, the service desk is the entry point, and service request management handles standard requests.

Question 5Information security management in the ITIL 4 context

Which statement best describes the relationship between the ITIL 4 information security management practice and the incident management practice?

  1. Information security management replaces incident management for any event involving data
  2. Incident management owns all security policy because it handles breaches
  3. Information security management defines policy and controls, while incident management coordinates the response that may be triggered when a security control is breached Correct answer.
  4. The two practices are mutually exclusive and never share records

Explanation

Information security management sets the policies, controls, and risk posture, while incident management provides the coordinated response process. A security event that becomes an incident is handled through incident management with security input. The practices overlap and share records rather than excluding one another.

Question 6Information security management in the ITIL 4 context

What is the primary purpose of the ITIL 4 information security management practice?

  1. To protect the information used by the organization by ensuring confidentiality, integrity, and availability are maintained at agreed levels Correct answer.
  2. To audit third-party suppliers against contractual security clauses
  3. To purchase cyber insurance that transfers residual risk to a third party
  4. To design network segmentation and firewall rules for the data centre

Explanation

The practice exists to ensure the confidentiality, integrity, and availability of information at levels agreed with stakeholders. Insurance transfer, technical design, and supplier auditing are supporting activities or other practices, not the purpose of the practice itself.

Question 7Information security management in the ITIL 4 context

An organization wants a single authoritative statement, approved by leadership, of its security objectives and the rules that must be followed. Which artifact should it produce?

  1. A change schedule
  2. An information security policy Correct answer.
  3. A configuration management database
  4. A service level agreement

Explanation

An information security policy is the top-level, management-approved statement of security objectives and mandatory rules. SLAs define service targets, the change schedule lists planned changes, and a CMDB holds configuration records. None of these carries the authority of policy.

Question 8Information security management in the ITIL 4 context

Under ITIL 4, which practice is most appropriate for assessing and treating the risk that a newly identified supplier weakness could expose customer data?

  1. Supplier management Correct answer.
  2. Release management
  3. Service catalogue management
  4. Capacity and performance management

Explanation

Supplier management governs relationships with third parties, including assessing and managing the risks they introduce. Release management, capacity management, and service catalogue management address deployment, performance, and service description respectively.

Question 9Information security management in the ITIL 4 context

What does the ITIL 4 concept of a 'service value stream' contribute to information security management?

  1. It shows the sequence of activities and controls that turn security demand into realized protection and value Correct answer.
  2. It removes the need for cross-team collaboration on security
  3. It guarantees that no security incident can occur within a defined service
  4. It replaces the need for a security policy with automated tooling

Explanation

A value stream maps the activities, inputs, and controls that convert demand into value, revealing where security steps and handoffs belong. It does not eliminate incidents, replace policy, or reduce collaboration; it makes those elements visible and improvable.

Question 10Information security management in the ITIL 4 context

A security analyst notices an unusual login pattern but no confirmed harm. In ITIL 4 terms, what is the most accurate description of this situation before it is assessed?

  1. A service request that must be fulfilled by the service desk
  2. An event that may be evaluated and, if it affects service, become an incident Correct answer.
  3. A change request that must be authorized by the change authority
  4. A problem that automatically requires a known error record

Explanation

An event is any detectable occurrence; it is evaluated and only becomes an incident if it affects or may affect service. It is not automatically a problem, change, or service request until assessment determines that. Classification follows evaluation, not observation.

Question 11Information security management in the ITIL 4 context

Which ITIL 4 practice is most directly responsible for ensuring that access rights are granted, modified, and revoked according to agreed authorization rules?

  1. Access management Correct answer.
  2. Relationship management
  3. Deployment management
  4. Service continuity management

Explanation

Access management is the practice of granting authorized users the right to use a service while restricting access to unauthorized users. Continuity management, deployment management, and relationship management address resilience, release, and stakeholder relations respectively.

Question 12Information security management in the ITIL 4 context

What is the primary role of a 'security champion' embedded within a product team in an ITIL 4-aligned organization?

  1. To conduct external penetration tests on production systems
  2. To approve every change the team makes before release
  3. To take over all security operations from the central security function
  4. To embed security awareness and early risk consideration into the team's daily work and value stream Correct answer.

Explanation

Security champions are team members who carry security knowledge into daily work, shifting consideration of risk earlier in the value stream. They do not replace the central security function, act as a mandatory change approver, or typically perform external testing.

Question 13Information security management in the ITIL 4 context

Which statement correctly describes how the ITIL 4 'change enablement' practice should treat a low-risk security patch applied on a routine schedule?

  1. It requires a new problem record before it can be deployed
  2. It should bypass the change practice entirely because it is security-related
  3. It may be handled through a standard change model pre-authorized for that type of change Correct answer.
  4. It must always be escalated to the full change advisory board for individual approval

Explanation

Change enablement uses change models, and standard changes are pre-authorized low-risk changes with a defined procedure. Routine patching fits this model, avoiding repeated full-board approval while retaining control. Security relevance does not exempt a change from the practice.

Question 14Information security management in the ITIL 4 context

In the ITIL 4 four dimensions model, why must information security be considered in the 'partners and suppliers' dimension?

  1. Because partner contracts never need security clauses
  2. Because that dimension is the only one where security controls apply
  3. Because suppliers are legally prohibited from holding any security responsibility
  4. Because third parties can introduce, inherit, or mitigate risk that affects the organization's services Correct answer.

Explanation

Partners and suppliers can create or transfer risk through shared data, systems, and dependencies, so security obligations must be defined and monitored. Security applies across all four dimensions, contracts do require security clauses, and suppliers often hold responsibility under agreements.

Question 15Information security management in the ITIL 4 context

Which of the following best characterizes a 'known error' in the context of security vulnerability management?

  1. Any vulnerability that has been scanned but not yet triaged
  2. A problem that has been analysed and has a documented root cause and workaround Correct answer.
  3. A security incident that has been closed without resolution
  4. A change that failed to deploy and was backed out

Explanation

A known error is a problem with a documented root cause and, usually, a workaround. In vulnerability terms this maps to an analysed weakness with a known cause and interim mitigation. Untriaged scans, unresolved incidents, and backed-out changes do not meet that definition.

Question 16Information security management in the ITIL 4 context

What is the main purpose of the ITIL 4 'service continuity management' practice in relation to security?

  1. To define the catalogue of services offered to customers
  2. To provide the single point of contact for users reporting issues
  3. To prevent all disruptive events from ever occurring
  4. To ensure services can continue at agreed levels after a disruptive event such as a ransomware attack Correct answer.

Explanation

Service continuity management plans and tests the organization's ability to keep services running at agreed levels during disruption, including cyber attacks. It does not prevent every disruption, provide the service desk function, or define the service catalogue.

Question 17Information security management in the ITIL 4 context

An organization wants to measure whether its security controls are working as intended. Which approach best reflects ITIL 4 continual improvement thinking?

  1. Define critical success factors and key performance indicators for the controls, then review and adjust them iteratively Correct answer.
  2. Measure only the number of incidents closed per month
  3. Rely solely on external audit reports issued once a year
  4. Collect every available metric regardless of relevance to security objectives

Explanation

Continual improvement links measurement to objectives through critical success factors and KPIs, then iterates based on results. Undirected metric collection, single-dimension counts, and annual audits alone do not provide a feedback loop tied to security goals.

Question 18Information security management in the ITIL 4 context

Which statement best explains why 'confidentiality, integrity, and availability' are treated as a balanced triad in the information security management practice?

  1. Because integrity only matters for financial data
  2. Because improving one attribute can trade off against another, so agreed levels must be set with stakeholders Correct answer.
  3. Because availability is always the most important attribute for every service
  4. Because confidentiality can be guaranteed without restricting access

Explanation

The three attributes interact, and strengthening one can affect another, so the practice sets agreed levels with stakeholders rather than maximizing any single attribute. No attribute is universally most important, integrity matters for all data, and confidentiality requires access restriction.

Question 19Information security management in the ITIL 4 context

A user reports that they cannot access a system because their account was locked after several failed logins. Under ITIL 4, how should this be handled?

  1. As a major incident requiring the incident manager to convene a crisis team
  2. As a service request, potentially with security verification before access is restored Correct answer.
  3. As an unauthorized change to be rejected by change enablement
  4. As a problem record because it reveals a systemic root cause

Explanation

A routine account unlock is a standard, pre-defined user request and is handled through service request management, with identity verification as a security control. It is not a major incident, a problem, or a change in the normal case.

Question 20Information security management in the ITIL 4 context

Which ITIL 4 practice provides the structured mechanism by which security incidents are logged, prioritized, escalated, and resolved?

  1. Incident management Correct answer.
  2. IT asset management
  3. Service level management
  4. Workforce and talent management

Explanation

Incident management manages incidents throughout their lifecycle, including logging, prioritization, escalation, and resolution. The other practices address service targets, asset records, and staffing respectively.

Question 21Information security management in the ITIL 4 context

What does 'shift left' mean when applied to security within an ITIL 4 value stream?

  1. Deferring security testing until after go-live
  2. Moving security activities earlier in the value stream so risks are identified before deployment Correct answer.
  3. Moving security staff to a later support tier
  4. Transferring all security work to external auditors

Explanation

Shift left means performing security activities such as threat modelling and testing earlier, when changes are cheaper and easier. It is the opposite of deferring testing, moving staff later, or outsourcing all security work.

Question 22Information security management in the ITIL 4 context

An organization defines a target that security incidents of the highest severity must be contained within one hour. In ITIL 4 terms, what is this target?

  1. A guiding principle that staff may follow at their discretion
  2. A change model used to authorize emergency changes
  3. A known error record describing a recurring fault
  4. A service level objective that should be documented and monitored through service level management Correct answer.

Explanation

A measurable target for incident containment is a service level objective, agreed and monitored through service level management. It is not a guiding principle, change model, or known error; those are different concepts with different purposes.

Question 23Information security management in the ITIL 4 context

Which combination best reflects the ITIL 4 principle 'collaborate and promote visibility' in a security context?

  1. Publishing raw vulnerability data to all customers without context
  2. Restricting security data to a small group to reduce the chance of leaks
  3. Sharing risk information and incident trends openly across teams so decisions are informed by a common view Correct answer.
  4. Holding security decisions at the executive level only

Explanation

The principle encourages cross-team collaboration and transparency so that decisions draw on shared information. Over-restriction, uncontextualized public disclosure, and exclusive executive decision-making all undermine visibility and collaboration.

Question 24Information security management in the ITIL 4 context

A security team wants to reduce the time between detecting a threat and containing it. Which ITIL 4 value chain activity should it focus improvement on first?

  1. The 'deliver and support' activity, because incidents are handled there Correct answer.
  2. The 'engage' activity, because users must be surveyed
  3. The 'plan' activity, because strategy is always the bottleneck
  4. The 'obtain/build' activity, because detection tooling must be acquired

Explanation

Detection and containment of live incidents occur during deliver and support, where incident management operates. Improving that activity directly shortens response time. Obtain/build, engage, and plan matter but do not host the detection-to-containment flow.

Question 25Information security management in the ITIL 4 context

An organization outsources a payment service and wants assurance that the provider's security controls match its own risk appetite. Which ITIL 4 approach is most appropriate?

  1. Transfer all security accountability to the provider and stop monitoring
  2. Define security requirements and assurance obligations in the agreement and monitor them through supplier management Correct answer.
  3. Rely on the provider's public marketing statements as evidence of control
  4. Assume the provider applies the same controls because it is a well-known brand

Explanation

Supplier management requires agreed requirements and ongoing assurance, often built into contracts and reviews. Brand reputation, marketing claims, and full transfer of accountability do not provide evidence that controls meet the organization's risk appetite.

Question 26Information security management in the ITIL 4 context

In ITIL 4, which practice ensures that information security risks are understood and managed consistently across the service value chain?

  1. Service desk
  2. Problem management
  3. Information security management Correct answer.
  4. Relationship management

Explanation

Information security management is the practice that provides a structured approach to managing security risks, ensuring confidentiality, integrity, and availability of information. It aligns security objectives with business goals and is applied throughout the service value chain.

Question 27Information security management in the ITIL 4 context

Which ITIL 4 dimension emphasizes the need for security policies to be supported by appropriate tools and technologies?

  1. Value streams and processes
  2. Partners and suppliers
  3. Organizations and people
  4. Information and technology Correct answer.

Explanation

The information and technology dimension covers the data, knowledge, and technologies required to deliver services, including security controls and tools. Security policies must be enabled by suitable technology to be effective.

Question 28Information security management in the ITIL 4 context

What is the primary purpose of the ITIL 4 'service continuity management' practice in relation to security?

  1. To identify and classify information assets
  2. To maintain the availability of services during and after a disruptive event Correct answer.
  3. To ensure that security incidents are resolved within agreed timeframes
  4. To manage user access rights

Explanation

Service continuity management focuses on ensuring that services can continue at an acceptable level following a disruption, which includes security-related disruptions. It is about resilience and recovery, not about incident resolution or access control.

Question 29Information security management in the ITIL 4 context

Which ITIL 4 principle suggests that security controls should be designed to be simple and easy to understand?

  1. Keep it simple and practical Correct answer.
  2. Optimize and automate
  3. Start where you are
  4. Focus on value

Explanation

The 'keep it simple and practical' principle advises minimizing complexity in processes and controls. Simple security controls are more likely to be followed and less likely to introduce errors.

Question 30Information security management in the ITIL 4 context

A security team identifies a new vulnerability in a widely used software library. They need to assess its potential impact on services and decide on a response. Which ITIL 4 practice is most relevant for this assessment?

  1. Problem management
  2. Information security management Correct answer.
  3. Incident management
  4. Change enablement

Explanation

Information security management includes the assessment and treatment of security risks, such as vulnerabilities. It provides the framework for evaluating impact and deciding on appropriate controls.

Question 31Information security management in the ITIL 4 context

An organization wants to ensure that security requirements are considered when designing a new service. Which ITIL 4 value chain activity should incorporate these requirements?

  1. Engage
  2. Plan
  3. Improve
  4. Design and transition Correct answer.

Explanation

The design and transition activity is where services are designed and transitioned into live use, so security requirements must be integrated there. This ensures that security is built into the service from the start.

Question 32Information security management in the ITIL 4 context

What is the role of the 'security champion' in an ITIL 4-aligned organization?

  1. To approve all changes that affect security
  2. To conduct security audits independently
  3. To act as a liaison between the security team and other teams, promoting security awareness Correct answer.
  4. To manage the security budget

Explanation

Security champions are embedded in teams to promote security practices and serve as a bridge to the central security function. They help raise awareness and ensure security is considered in daily work.

Question 33Information security management in the ITIL 4 context

Which statement best describes how the ITIL 4 'change enablement' practice should handle a security patch that is classified as low risk?

  1. It should be automatically approved without any assessment.
  2. It should be rejected because security patches always require full assessment.
  3. It should follow the standard change procedure with pre-authorized approval. Correct answer.
  4. It should be escalated to the change advisory board for full review.

Explanation

Low-risk security patches can be handled as standard changes, which are pre-authorized and follow a defined procedure. This enables efficient handling while maintaining control.

Question 34Information security management in the ITIL 4 context

In the context of ITIL 4, what is the primary purpose of an information security policy?

  1. To list all security incidents that have occurred
  2. To document the security roles of each employee
  3. To define the organization's approach to information security and set clear expectations Correct answer.
  4. To provide detailed technical configuration settings for security tools

Explanation

An information security policy is a high-level document that outlines the organization's security objectives, principles, and responsibilities. It sets the direction and expectations for security across the organization.

Question 35Information security management in the ITIL 4 context

An organization is reviewing its ITIL 4 service value chain and wants to ensure that security is considered in the 'engage' activity. Which action best demonstrates this?

  1. Gathering security requirements from customers and users during service design Correct answer.
  2. Conducting a penetration test on a new application
  3. Performing a root cause analysis of a security incident
  4. Monitoring network traffic for anomalies

Explanation

The engage activity involves understanding stakeholder needs and requirements. Gathering security requirements from customers and users ensures that security is considered from the outset.

Question 36Information security management in the ITIL 4 context

Which ITIL 4 practice is most directly responsible for ensuring that access to services is granted based on defined policies and that access is revoked when no longer needed?

  1. Service request management
  2. Information security management
  3. Access management Correct answer.
  4. Incident management

Explanation

Access management is the practice that ensures users are granted appropriate access rights and that those rights are removed when no longer required. It works closely with information security management to enforce policies.

Question 37Information security management in the ITIL 4 context

An organization wants to measure the effectiveness of its security controls. Which approach best aligns with ITIL 4 continual improvement?

  1. Defining key performance indicators (KPIs) for security controls and reviewing them regularly Correct answer.
  2. Comparing security controls against those of other organizations
  3. Waiting for security incidents to occur and then reviewing controls
  4. Conducting an annual security audit and filing the report

Explanation

Continual improvement involves defining measurable objectives and regularly reviewing performance. KPIs for security controls provide ongoing insight into effectiveness and drive improvement.

Question 38Information security management in the ITIL 4 context

In ITIL 4, what is the most accurate description of a 'security incident'?

  1. A user's request for access to a system
  2. A vulnerability that has been identified but not yet exploited
  3. Any event that indicates a possible breach of security policies or controls Correct answer.
  4. A confirmed data breach that has been reported to regulators

Explanation

A security incident is any event that may indicate a breach of security, whether confirmed or suspected. It triggers the incident management process to assess and respond appropriately.

Question 39Information security management in the ITIL 4 context

A security analyst discovers that a server has been compromised and data may have been exfiltrated. According to ITIL 4, which practice should be engaged first to manage the situation?

  1. Incident management Correct answer.
  2. Problem management
  3. Change enablement
  4. Service continuity management

Explanation

Incident management is the practice for managing unplanned events that require immediate action to restore service. A compromised server is a security incident that must be contained and resolved.

Question 40Information security management in the ITIL 4 context

An organization outsources a payment service and wants assurance that the provider's security controls align with its own risk appetite. Which ITIL 4 practice is most relevant for establishing this assurance?

  1. Service level management
  2. Relationship management
  3. Information security management
  4. Supplier management Correct answer.

Explanation

Supplier management ensures that suppliers and their performance are managed appropriately, including their security controls. It involves setting expectations and monitoring compliance with security requirements.

Question 41Information security governance and strategy

In ITIL 4, which component of the service value system is described as the means by which an organization is directed and controlled, aligning information security objectives with overall business objectives?

  1. Governance Correct answer.
  2. The service value chain
  3. The guiding principles
  4. Continual improvement

Explanation

Governance is the component of the service value system through which organizations are directed and controlled; it sets direction, priorities and accountability, and is where information security objectives are aligned with business objectives. The service value chain and the guiding principles are operational and advisory elements rather than the directing mechanism.

Question 42Information security governance and strategy

A security manager needs to ensure that information security activities are consistently applied across all value streams. Which ITIL 4 concept provides reusable, end-to-end descriptions of how value is co-created and can embed security controls at each step?

  1. Guiding principles
  2. Value streams Correct answer.
  3. Service offerings
  4. Practices

Explanation

Value streams describe how an organization creates, delivers and improves products and services end to end; embedding security activities into each value stream ensures consistent application across the organization. Practices are sets of organizational resources, and service offerings describe what a provider gives to consumers.

Question 43Information security governance and strategy

Which statement best describes the purpose of the 'focus on value' guiding principle when applied to information security governance?

  1. Security controls should be maximized regardless of the cost to service delivery
  2. Security governance should be delegated entirely to the technology function
  3. Every security activity should be traceable to the value it creates for the organization and its stakeholders Correct answer.
  4. Security requirements should be documented only after incidents occur

Explanation

'Focus on value' directs attention to what stakeholders perceive as value, so security effort should be justified by the protection and enablement it delivers rather than by control volume. It explicitly discourages activity that is not connected to value creation.

Question 44Information security governance and strategy

An organization wants its information security management to be part of the wider service management system rather than a separate silo. Which ITIL 4 practice is the most appropriate anchor for this integration?

  1. Supplier management
  2. Information security management Correct answer.
  3. Relationship management
  4. Service desk

Explanation

The information security management practice is the practice through which the organization protects its information assets and integrates security into service management. It is the natural anchor for aligning security controls with the value system.

Question 45Information security governance and strategy

A board asks how information security risk appetite should relate to the organization's overall risk management framework. What is the most defensible governance position?

  1. Security risk appetite should be set independently by the security team to preserve objectivity
  2. Security risk appetite should be defined within and consistent with the enterprise risk appetite approved by the governing body Correct answer.
  3. Security risk appetite should be as low as technically achievable in every domain
  4. Security risk appetite should be reviewed only when a major breach has occurred

Explanation

Security risk appetite is a subset of enterprise risk appetite; the governing body approves the overall tolerance and security-specific thresholds must remain consistent with it. This keeps security decisions aligned with the organization's willingness to accept risk.

Question 46Information security governance and strategy

Which is the clearest example of a governance-level (rather than operational) information security activity?

  1. Resetting a user's password after a lockout
  2. Approving the information security policy and the delegated authority for its enforcement Correct answer.
  3. Reviewing daily antivirus scan reports
  4. Tuning a web application firewall rule set

Explanation

Governance activities set direction, policy and accountability; approving policy and delegating enforcement authority are typical of that level. The other options are operational execution tasks performed within agreed controls.

Question 47Information security governance and strategy

An organization is defining roles for information security. Which arrangement best reflects ITIL 4 accountability principles?

  1. Shared accountability across all staff so that no individual is singled out
  2. Accountability assigned to the external audit provider
  3. Accountability rotated monthly among team members to share the burden
  4. A single named accountable owner for the information security management practice, with defined responsibilities for others Correct answer.

Explanation

ITIL 4 emphasizes clear accountability; practices should have a named owner who is answerable for outcomes, supported by defined responsibilities for others. Diffuse or rotating accountability undermines decision-making and traceability.

Question 48Information security governance and strategy

What is the primary purpose of an information security policy within the governance component?

  1. To list the names of staff who have access to systems
  2. To record the chronology of security incidents
  3. To state management's direction and intent for information security and set mandatory expectations Correct answer.
  4. To document the technical configuration of each security device

Explanation

A policy expresses management direction and intent and establishes mandatory expectations that lower-level standards and procedures elaborate. Technical configuration, access lists and incident logs are operational records, not policy.

Question 49Information security governance and strategy

A security team proposes a control that is technically strong but would significantly slow a customer-facing service. Which guiding principle most directly helps the team evaluate this trade-off?

  1. Collaborate and promote visibility Correct answer.
  2. Keep it simple and practical
  3. Start where you are
  4. Progress iteratively with feedback

Explanation

'Collaborate and promote visibility' calls for involving stakeholders and understanding their perspectives and constraints, which is how a security-versus-usability trade-off should be evaluated. Collaboration ensures decisions consider the value the service delivers to customers.

Question 50Information security governance and strategy

Which statement correctly distinguishes a security standard from a security procedure?

  1. A standard describes step-by-step actions, while a procedure defines mandatory requirements
  2. A standard defines mandatory requirements, while a procedure describes the step-by-step way to meet them Correct answer.
  3. A standard is optional guidance, while a procedure is mandatory
  4. A standard applies only to suppliers, while a procedure applies only to employees

Explanation

Standards specify mandatory requirements that must be met, whereas procedures describe the detailed steps for carrying out activities that satisfy policy and standards. The two are complementary layers of the documentation hierarchy.