Financial Planning ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A startup company has a small security team and a limited budget. The company needs to implement a security program but cannot afford a full-time CISO or a large security operations center. Which funding model would be most appropriate for this startup?

   • AApply for a government grant to fund the entire security program.
   • BOutsource security operations to a managed security service provider (MSSP) funded from the operational budget.
   • CUse a decentralized model where each department funds its own security tools.
   • DHire a full-time CISO and build an in-house SOC with capital budget.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's security budget is heavily dependent on a single major customer contract that is up for renewal. If the contract is not renewed, the security budget will be cut by 40%. What is the most effective way to mitigate this financial risk?

   • AImmediately stop all non-essential security spending to save money.
   • BDiversify revenue sources to reduce dependence on the single customer.
   • CIncrease the security budget now to build a reserve.
   • DDevelop a contingency plan that identifies which security initiatives can be deferred or scaled down if the budget is cut.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A CISO needs to report to the board on the efficiency of the security program. The program includes a 24/7 security operations center (SOC), a vulnerability management team, and an identity management team. Which set of metrics would best demonstrate the efficiency and effectiveness of security spending?

   • ANumber of security policies written and number of training sessions conducted.
   • BNumber of security tools deployed and total number of security alerts generated.
   • CCost per incident handled, mean time to respond (MTTR), and percentage of vulnerabilities remediated within SLA.
   • DTotal security budget as a percentage of IT budget and number of security staff.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a typical cost category in a security program budget?

   • AEmployee vacation and holiday pay
   • BMarketing and advertising expenses
   • COffice furniture and decorations
   • DPersonnel salaries and training
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is considering investing in a new security information and event management (SIEM) platform. The SIEM will cost $150,000 per year, including maintenance and staffing. The company estimates that the SIEM will reduce the time to detect and respond to security incidents, potentially avoiding a $1 million breach. However, the exact probability of a breach is uncertain. Which approach best handles the uncertainty in the cost-benefit analysis?

   • AReject the investment because the uncertainty makes the analysis unreliable.
   • BAssume the breach will definitely occur and approve the investment based on the full $1 million avoided.
   • CUse a range of breach probabilities to calculate expected annual loss reduction and present a sensitivity analysis.
   • DUse the highest possible breach probability to justify the investment.
   Reveal Solution Discussion Select an answer first