Financial Planning ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company has a limited security budget and must choose between two projects: (1) upgrading the firewall to a next-generation model, and (2) implementing a data backup and recovery solution. The company has experienced two ransomware attacks in the past year, and the firewall is outdated but has not been directly breached. Which project should be prioritized?

   • AThe backup and recovery solution, because it directly addresses the impact of ransomware attacks that have already occurred.
   • BBoth projects equally, because both are important for defense-in-depth.
   • CThe firewall upgrade, because it prevents attacks from happening in the first place.
   • DNeither project, and instead invest in cybersecurity insurance.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary goal of prioritizing security expenditures?

   • ATo allocate limited resources to the most critical security needs
   • BTo minimize the number of security projects to reduce complexity
   • CTo spend the entire security budget before the fiscal year ends
   • DTo fund every identified security project equally
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the purpose of using key performance indicators (KPIs) for security spending?

   • ATo track and evaluate the effectiveness and efficiency of security investments
   • BTo ensure that all security projects are completed on time
   • CTo replace the need for a detailed security budget
   • DTo justify increasing the security budget every year
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A large enterprise has a centralized IT security team that manages the corporate network, while business units have their own local security budgets for department-specific applications. The CISO wants to fund a new enterprise-wide identity management platform that will benefit all business units. Which funding model is most appropriate for this initiative?

   • AA hybrid model where the central team funds the platform and business units fund their own legacy system replacements.
   • BSeek external grant funding because identity management is a regulatory requirement.
   • CDecentralized funding where each business unit pays for its own integration costs.
   • DCentralized funding from the corporate security budget, because the platform serves the entire enterprise.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A CISO must present the annual security budget to the board. The board is composed of members with different priorities: the CFO wants cost efficiency, the COO wants minimal operational disruption, and the CEO wants to ensure regulatory compliance. The budget includes funding for a new SIEM, additional staff, and a compliance audit. Which presentation strategy would best address the diverse interests of the board?

   • AStructure the presentation around three themes: cost efficiency (ROI metrics), operational resilience (MTTR and uptime), and compliance (audit results and regulatory alignment).
   • BPresent the budget in technical detail, emphasizing the features of the new SIEM.
   • CPresent the budget as a single lump sum with a brief overview, letting the board ask questions.
   • DFocus only on the compliance aspects because regulatory requirements are non-negotiable.
   Reveal Solution Discussion Select an answer first