Defining an Information Security Governance Program ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A government agency's security team has implemented a new security awareness training program. To measure its effectiveness, the CISO wants to track the percentage of employees who complete the training and the reduction in phishing simulation failures. What governance activity does this represent?

   • AEstablishing performance metrics to assess the security program's effectiveness
   • BAllocating budget for the training program
   • CConducting a risk assessment of the training program
   • DDeveloping a new security policy
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which step is part of implementing an information security governance program?

   • ADisabling all security controls
   • BDeleting all security logs
   • CIgnoring compliance requirements
   • DDeveloping and approving security policies
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which statement best defines information security governance?

   • AThe compliance requirements imposed by external regulators and industry standards
   • BThe process by which an organization directs and controls its security efforts to align with business objectives and manage risk
   • CThe day-to-day operational activities performed by the security team to monitor and respond to incidents
   • DThe set of technical controls and tools used to protect information assets
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A technology startup is considering two security investments: a comprehensive security awareness program and a new vulnerability scanner. The CISO calculates that the awareness program could reduce phishing incidents by 40%, while the scanner would identify critical vulnerabilities faster. The startup has limited budget and must choose one. What should the CISO do to demonstrate value delivery?

   • ASelect the investment that is easiest to implement
   • BSplit the budget equally between both investments
   • CDefer the decision until the next quarter
   • DChoose the investment that provides the greatest risk reduction per dollar spent
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A retail company's executive team is deciding whether to enter a new international market. The CISO presents a risk assessment showing that data protection regulations in that market could increase compliance costs. The executive team decides to proceed but allocates additional budget for compliance. How did governance integrate risk management into this decision?

   • ABy transferring all risk to a third-party insurance provider
   • BBy ensuring risk information was presented to decision-makers and factored into the strategic choice
   • CBy mandating that all risks be eliminated before proceeding
   • DBy requiring the CISO to approve all business expansion decisions
   Reveal Solution Discussion Select an answer first