Defining an Information Security Governance Program ACCISO Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of information security governance?

   • ATo eliminate all information security risks from the organization
   • BTo transfer all security risks to external insurance providers
   • CTo provide a framework that aligns security activities with business objectives and stakeholder needs
   • DTo ensure that security investments are minimized regardless of risk exposure
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company's security governance program has been in place for two years. The board asks for evidence that the program is achieving its intended outcomes. Which combination of evidence would best demonstrate the five governance outcomes?

   • AA balanced scorecard showing strategic alignment, risk management, resource management, performance metrics, and value delivery.
   • BA penetration test report showing no critical vulnerabilities.
   • CA risk register, a budget report, and a list of security incidents.
   • DAn audit report confirming compliance with ISO 27001.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A bank's security governance committee wants to measure the effectiveness of its vulnerability management program. Which metric would best indicate performance?

   • ANumber of security tools deployed.
   • BTotal cost of the vulnerability management program.
   • CAverage time to remediate critical vulnerabilities (MTTR).
   • DNumber of vulnerabilities discovered per month.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which statement correctly distinguishes information security governance from information security management?

   • AGovernance focuses on strategic direction and oversight, while management focuses on operational execution and implementation
   • BGovernance is performed by the security team, while management is performed by the board of directors
   • CGovernance is a one-time project, while management is an ongoing process
   • DGovernance is about implementing specific security controls, while management is about setting overall direction
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A financial services firm's security governance committee wants to assess the effectiveness of its security awareness training program. Which metric would be most appropriate for this purpose?

   • ANumber of phishing simulation clicks before and after training.
   • BPercentage of employees who completed the training module.
   • CNumber of security policies updated this quarter.
   • DTotal hours of training delivered per employee.
   Reveal Solution Discussion Select an answer first