Financial Planning ACCISO Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When communicating a security financial plan to executives, what is the most effective approach?

   • APresent the plan in terms of business risks and strategic value
   • BProvide only the total budget figure without any justification
   • CFocus exclusively on the technical specifications of security tools
   • DUse as much security jargon as possible to demonstrate expertise
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is it important to consider qualitative factors in a cost-benefit analysis of a security investment?

   • ABecause they capture benefits that are difficult to quantify but may be strategically important
   • BBecause they eliminate the need for quantitative analysis
   • CBecause they can be easily converted into exact dollar amounts
   • DBecause they are required by accounting standards for all capital expenditures
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A CISO wants to measure the effectiveness of the security awareness training program. Which KPI would best indicate that the training is reducing human-related security incidents?

   • ATotal number of security awareness training sessions held.
   • BNumber of employees who completed the training.
   • CPercentage decrease in phishing simulation click rates over the past year.
   • DBudget spent on the training program.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a security budget of $500,000 for the year. The CISO has identified three projects: (1) a new firewall for $200,000, (2) a data encryption solution for $150,000, and (3) a security awareness program for $100,000. The company's top risks are data breaches (high impact, medium likelihood) and insider threats (medium impact, high likelihood). The firewall addresses external attacks, encryption protects data at rest, and the awareness program reduces insider threat risk. Which combination of projects should the CISO prioritize?

   • AFund the firewall and the awareness program, and defer the encryption solution.
   • BFund all three projects by requesting an additional $50,000 from the board.
   • CFund the encryption solution and the awareness program, and defer the firewall.
   • DFund the firewall and the encryption solution, and defer the awareness program.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A multinational corporation has a centralized security budget, but its regional offices have their own local budgets for compliance with regional regulations. The corporation wants to implement a global security awareness training platform that must be customized for each region's language and regulatory requirements. Which funding model best balances central control with regional flexibility?

   • AFully centralized funding for the entire platform, including localization.
   • BFully decentralized funding where each region purchases its own training platform.
   • CUse a grant from a global security foundation to fund the entire platform.
   • DCentral funding for the platform license and regional funding for localization and compliance-specific content.
   Reveal Solution Discussion Select an answer first