Defining an Information Security Governance Program ACCISO Practice Questions (Page 12)

Questions 56–59

1. 56application · medium

   A university is establishing a security governance committee. Which stakeholder group should be included to ensure that security decisions align with academic research needs?

   • AExternal security consultant
   • BChief Financial Officer (CFO)
   • CDean of Research or representative from the research community
   • DChief Information Officer (CIO)
   Reveal Solution Discussion Select an answer first
2. 57expert · hard

   A software company must decide between two security projects: implementing a data loss prevention (DLP) solution or enhancing the security of its CI/CD pipeline. The DLP solution is expensive and would protect customer data, while the CI/CD enhancement is cheaper and would prevent code tampering. The company has a strong revenue stream from its software products. Which decision best demonstrates value delivery?

   • AChoose the CI/CD enhancement because it protects the company's core product and is more cost-effective
   • BChoose the DLP solution because it protects customer data
   • CImplement both projects regardless of budget
   • DChoose the project that is easiest to implement
   Reveal Solution Discussion Select an answer first
4. 58application · medium

   A manufacturing company's security team is deploying a new firewall and updating intrusion detection rules. The board has approved the security budget and risk appetite. Which activity is an example of information security management, not governance?

   • ADefining the security metrics for board reporting.
   • BConfiguring the firewall to block traffic from high-risk countries.
   • CReviewing the risk appetite statement with the board annually.
   • DApproving the annual security investment plan.
   Reveal Solution Discussion Select an answer first
5. 59application · medium

   A retail chain is planning to expand its e-commerce platform to support a new line of products. The CISO wants to ensure that security governance supports this business strategy. What is the most effective approach?

   • AOutsource all security to a managed service provider
   • BWait until the platform is developed and then perform a security review
   • CIncrease the security budget without any specific plan
   • DInvolve security leaders in the strategic planning process to identify security requirements early
   Reveal Solution Discussion Select an answer first