Defining an Information Security Governance Program ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which approach best demonstrates value delivery in information security governance?

   • ASpending the entire security budget on the most expensive solution
   • BFunding a security project because it is popular in the industry
   • CPurchasing a security tool that is never used
   • DImplementing a security control that reduces the likelihood of a costly data breach
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which stakeholder is primarily responsible for implementing the information security governance program?

   • ACustomers
   • BRegulators
   • CChief Information Security Officer (CISO)
   • DShareholders
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the purpose of establishing metrics and measures in an information security governance program?

   • ATo track employee performance for HR purposes
   • BTo assess the performance and effectiveness of the security program
   • CTo justify the security budget without any analysis
   • DTo replace the need for security audits
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which governance practice directly supports the integration of risk management into decision-making?

   • AAssigning all risk management to external auditors
   • BKeeping risk assessments confidential from executives
   • CEstablishing a risk appetite statement approved by the board
   • DPurchasing cyber insurance without reviewing risks
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A pharmaceutical company is considering a merger with a smaller biotech firm. The CISO must advise the board on security risks. The biotech firm has legacy systems with known vulnerabilities and a history of data breaches. The board wants to proceed quickly to gain market share. What should the CISO recommend to integrate risk management into this decision?

   • AProceed with the merger and address security issues after the deal is closed
   • BAdvise the board to abandon the merger due to security risks
   • CRequire the biotech firm to fix all vulnerabilities before the merger
   • DPerform a comprehensive security due diligence assessment and present findings with risk mitigation options
   Reveal Solution Discussion Select an answer first