Defining an Information Security Governance Program ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which action is an example of effective resource management in an information security governance program?

   • AAllocating the security budget based on the latest vendor marketing
   • BReducing the security budget to the minimum possible amount
   • CFunding security projects that directly mitigate the organization's top risks
   • DDistributing the budget equally across all departments regardless of risk
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is typically the first step in implementing an information security governance program?

   • AHiring external auditors
   • BObtaining executive sponsorship and support
   • CWriting detailed technical procedures
   • DPurchasing security software
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An educational institution is starting to implement an information security governance program. The CISO has obtained executive sponsorship and established a steering committee. What should the CISO do next to implement the program effectively?

   • AImmediately purchase new security software
   • BHire additional security staff
   • CConduct a security awareness training for all staff
   • DDevelop and approve the governance framework and policies
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare organization is establishing a security governance framework. Which document set is essential to define roles, responsibilities, and decision rights?

   • ASecurity policies, standards, and procedures.
   • BIncident response plan and business continuity plan.
   • CA security charter, an organizational chart, and a RACI matrix.
   • DRisk assessment report and vulnerability scan results.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is an example of a security performance metric?

   • AThe brand of computers used by executives
   • BMean time to detect (MTTD) security incidents
   • CThe number of employees in the marketing department
   • DThe color of the company logo
   Reveal Solution Discussion Select an answer first