Defining an Information Security Governance Program ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does information security governance optimize security investments to deliver business value?

   • ABy outsourcing all security functions to third parties
   • BBy maximizing security spending regardless of business impact
   • CBy minimizing security spending to the lowest possible amount
   • DBy ensuring that security spending is aligned with business priorities and provides measurable benefits
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A new CISO at a logistics company is reviewing the existing security governance documentation. The CISO finds a security policy, an incident response plan, and a risk assessment methodology. What additional document is most critical to ensure the governance program is effectively implemented?

   • AA set of security standards and procedures that support the policy
   • BA marketing brochure for the company's services
   • CA copy of the company's annual report
   • DA list of employee salaries
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A financial services firm has a limited security budget. The CISO must decide between investing in a new SIEM platform or enhancing endpoint detection and response (EDR) for remote workers. The CISO presents both options to the board, including the risk reduction each would provide. What governance principle is the CISO applying?

   • ASelecting the cheapest option regardless of risk impact
   • BChoosing the option that requires the least staff training
   • CDeferring all security investments until the next fiscal year
   • DEnsuring efficient and effective use of security resources by prioritizing investments based on risk
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which stakeholder group is typically responsible for providing strategic oversight of an information security governance program?

   • ABoard of directors
   • BEnd users
   • CExternal penetration testers
   • DHelp desk technicians
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An insurance firm's security governance committee is evaluating whether its security program is delivering value. Which measure would most directly demonstrate value delivery?

   • AReduction in the number of security incidents per quarter.
   • BCost per compromised record compared with the industry average.
   • CPercentage of security projects completed on time and within budget.
   • DReturn on security investment (ROSI) calculated from avoided losses and business enablement.
   Reveal Solution Discussion Select an answer first