Financial Planning ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In cost-benefit analysis for a security investment, which of the following is considered a quantitative factor?

   • AAlignment with regulatory compliance requirements
   • BReduction in the estimated financial loss from a data breach
   • CEnhanced employee morale due to better security
   • DImprovement in customer trust and brand reputation
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A startup company is preparing its first annual security budget. The company's primary goal is rapid growth and product development. The CISO must create a financial plan that supports this goal without hindering innovation. Which approach best aligns the security financial plan with the startup's goals?

   • AInvest in scalable security solutions that can grow with the company and prioritize risks that could impact product development
   • BMinimize security spending to the absolute minimum required by law
   • CAdopt a decentralized funding model where each product team manages its own security budget
   • DAllocate a large portion of the budget to comprehensive compliance frameworks
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security program is funded through a combination of operational budget and a one-time capital grant that expires in 12 months. The CISO plans to use the grant to purchase a new SIEM platform and hire two analysts for a 24-month period. What is the primary financial risk in this plan?

   • AThe SIEM platform may become obsolete before the grant period ends.
   • BThe capital grant cannot be used for operational expenses like salaries.
   • CThe grant may not cover the full cost of the analysts after the grant period ends, creating a funding gap.
   • DThe operational budget may be reduced next year due to cost-cutting measures.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A CISO is developing the security budget for a mid-sized company. The company has identified a need to improve its vulnerability management program. The CISO must estimate the budget for this initiative. Which cost category should the CISO include in the budget?

   • AOnly the cost of remediating identified vulnerabilities
   • BSoftware licenses, staff training, and additional personnel for the vulnerability management team
   • COnly the cost of the vulnerability scanning software
   • DOnly the cost of hiring external penetration testers
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When prioritizing security projects, which factor should be given the most weight?

   • AThe popularity of the technology among industry peers
   • BThe level of risk reduction the project provides relative to its cost
   • CThe personal preference of the security team lead
   • DThe ease of implementation regardless of impact
   Reveal Solution Discussion Select an answer first