Financial Planning ACCISO Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A retail company's CISO is developing the annual security plan. The company's strategic goal for the year is to expand into three new international markets. The CISO must ensure the security plan supports this goal. Which action best aligns the security financial plan with the organizational strategy?

   • AAllocate the security budget evenly across all current security operations
   • BReduce the security budget to the minimum required by existing regulations
   • CDelay all new security investments until the market expansion is complete
   • DPrioritize funding for security controls that enable secure entry into the new markets, such as compliance with local data-protection laws
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common source of funding for security initiatives?

   • AOperational budget
   • BHuman resources budget
   • CResearch and development budget
   • DMarketing budget
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security manager is developing the annual budget for a mid-sized company. The budget must include the cost of security software licenses, salaries for two security analysts, and the cost of an external penetration test. Which cost categorization is most appropriate for these items?

   • AAll three as capital expenses because they are security-related.
   • BSoftware licenses as capital expense, salaries as operational expense, and penetration test as operational expense.
   • CSoftware licenses as operational expense, salaries as operational expense, and penetration test as a project expense.
   • DAll three as operational expenses because they are all part of the security program.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A regional bank is building its annual security budget. The CISO must allocate funds across several initiatives: upgrading endpoint detection, implementing a data-loss-prevention program, and migrating legacy authentication to multi-factor authentication (MFA). The bank's risk register shows that the highest-likelihood, highest-impact risk is credential theft leading to account takeover. The budget is constrained, so not all initiatives can be fully funded. Which approach best aligns the budget with the organization's risk profile?

   • ASplit the budget equally among all three initiatives to ensure balanced coverage across the security program.
   • BAllocate the entire budget to endpoint detection because it addresses the broadest range of threats.
   • CFund MFA migration first, then allocate remaining funds to endpoint detection and DLP based on residual risk.
   • DFund the least expensive initiative fully and defer the others to the next fiscal year.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A CISO must present a proposal for a new security awareness training program to the CFO. The CFO is focused on cost reduction and has questioned the value of training. Which presentation approach is most likely to persuade the CFO?

   • AEmphasize that training is a best practice and that all competitors are doing it.
   • BPresent the training cost alongside the estimated reduction in phishing-related incident costs, using a simple ROI calculation.
   • CFocus on the qualitative benefits of improved security culture without mentioning costs.
   • DState that the training is mandatory due to regulatory requirements and must be funded.
   Reveal Solution Discussion Select an answer first