Financial Planning ACCISO Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare organization's security team has implemented a new security awareness training program. The CISO wants to report the program's effectiveness to the board using a financial metric. The training cost $50,000, and the organization estimates that it avoided $200,000 in potential breach costs due to reduced phishing incidents. Which metric should the CISO use to communicate the program's value?

   • ATotal cost of ownership (TCO)
   • BMean time to detect (MTTD)
   • CAnnualized loss expectancy (ALE)
   • DReturn on investment (ROI)
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A utility company has a limited security budget and must choose among three projects: upgrading SCADA system security (critical for safety), implementing a new identity management system (improves efficiency), and launching a security awareness program (reduces phishing risk). The company faces a regulatory deadline for the SCADA upgrade, but the identity management system has strong executive support. The CISO must prioritize. Which project should receive the highest priority?

   • AThe identity management system, because it has executive support
   • BAll three projects equally, because they all address important risks
   • CThe security awareness program, because it reduces phishing risk across the organization
   • DThe SCADA system security upgrade, because it addresses a regulatory deadline and critical safety risk
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a key financial risk associated with security programs?

   • AThe risk that security policies will be too strict
   • BUnexpected costs from a major security incident
   • CThe risk that security staff will not use their vacation days
   • DThe risk of having too much security funding
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In the context of information security, what is the primary purpose of financial planning?

   • ATo allocate the security budget equally across all departments to ensure fairness
   • BTo ensure security initiatives are aligned with and support the organization's strategic objectives
   • CTo minimize the security budget to the lowest possible amount each fiscal year
   • DTo guarantee that all security risks are eliminated regardless of cost
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When developing a security budget, what is the primary purpose of estimating expenses?

   • ATo compare the security budget with competitors' spending
   • BTo guarantee that the budget will be approved without any changes
   • CTo forecast the financial resources required to implement and operate the security program
   • DTo calculate the exact return on investment for every security control
   Reveal Solution Discussion Select an answer first