Professional Standards and Ethics Flashcards

A client asks a security consultant to write a vulnerability report that understates risks to avoid budget increases. The consultant should:

Answer: Report findings accurately and objectively

Truthfulness and integrity require that professional findings be reported accurately regardless of client preference.

Which of the following is the best example of a security professional's duty of loyalty to an employer?

Answer: Protecting the employer's proprietary information even after leaving the job

Loyalty includes protecting confidential and proprietary employer information during and after employment.

A security manager discovers a subordinate is a close friend of an employee under investigation. The best course is to:

Answer: Reassign the investigation to someone without the relationship

Reassignment removes the conflict of interest and protects the integrity of the investigation.

In the context of professional ethics, 'due diligence' most closely means:

Answer: Exercising the care a reasonable professional would in the same circumstances

Due diligence is the reasonable care and investigation expected of a prudent professional.

A security officer witnesses a supervisor stealing inventory. The supervisor tells him to stay quiet. The ethical response is to:

Answer: Report the theft through the organization's reporting channel or hotline

Integrity requires reporting misconduct through proper channels, such as a hotline, regardless of the wrongdoer's rank.

Which statement best describes the relationship between legal compliance and ethics for a CPP?

Answer: Laws set the minimum standard; ethics often require more

Law is the floor of acceptable conduct, while ethical standards frequently demand behavior beyond legal minimums.

A former employer's client approaches a consultant about work related to a confidential project she handled. What is the primary ethical concern?

Answer: Using confidential information gained from the prior engagement

Professionals must not exploit confidential information from previous employers or clients.