Financial Planning ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A CISO wants to track the financial performance of the security program over time. The organization's revenue is $50 million, and the security budget is $2 million. The CISO wants to report a metric that shows the security budget relative to the organization's size. Which metric should the CISO use?

   • AReturn on security investment (ROSI)
   • BCost per incident
   • CTotal cost of ownership (TCO)
   • DSecurity budget as a percentage of revenue
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which strategy can help mitigate financial risk in a security program?

   • ARelying solely on a single vendor for all security products
   • BEliminating all security training to reduce costs
   • CDeferring all security upgrades indefinitely
   • DMaintaining a contingency reserve for unexpected security expenses
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is an example of a financial metric used to measure the efficiency of security spending?

   • ANumber of security policies updated
   • BTime to patch a critical vulnerability
   • CPercentage of employees who completed security training
   • DCost per security incident resolved
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which statement best describes the role of financial planning in an information security program?

   • AIt translates security needs into budget requests and investment justifications that support business objectives
   • BIt is primarily an accounting function with no strategic impact
   • CIt ensures that security spending is hidden from competitors to maintain a competitive advantage
   • DIt focuses solely on reducing the cost of security tools and services
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is evaluating two security investments: (A) a multi-factor authentication (MFA) system that costs $50,000 per year and is expected to reduce account takeover incidents by 80%, and (B) a data loss prevention (DLP) system that costs $80,000 per year and is expected to reduce data exfiltration incidents by 60%. The company's annual loss from account takeover is estimated at $200,000, and from data exfiltration at $300,000. Which investment provides a better return on investment (ROI)?

   • ABoth have the same ROI because they both reduce losses by more than their cost.
   • BNeither investment is worthwhile because the costs exceed the potential savings.
   • CInvestment B, because it reduces a larger absolute loss ($180,000 vs $160,000).
   • DInvestment A, because it has a higher ROI (220%) compared to Investment B (125%).
   Reveal Solution Discussion Select an answer first