Financial Planning ACCISO Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company is considering a new data-loss prevention (DLP) system. The system costs $150,000 per year. The company estimates that without DLP, it could face a data breach with a 10% probability per year, resulting in a $2,000,000 loss. The DLP system is expected to reduce the probability of a breach to 2%. What is the expected annual benefit of the DLP system?

   • A$40,000
   • B$200,000
   • C$1,840,000
   • D$160,000
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A CISO must justify a proposed security budget increase to the finance department. The finance team has previously rejected requests that lacked clear financial justification. The CISO has data on past security incidents, including costs and frequency. Which approach would be most persuasive to the finance team?

   • AProvide a detailed technical explanation of the new security tools and their features.
   • BPresent a cost-benefit analysis showing the expected reduction in incident costs against the budget increase, using historical incident data as a baseline.
   • CEmphasize the reputational damage that a security breach could cause.
   • DState that the budget increase is necessary to maintain compliance with industry standards.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A CISO must present the annual security budget request to the board of directors. The board is composed of financial and business executives who are not security experts. The CISO wants to communicate the value of a proposed security investment in a way that resonates with the board. Which approach is most effective?

   • APresent a detailed technical breakdown of the security controls and their configurations
   • BCompare the proposed budget to industry benchmarks without explaining the specific business context
   • CFrame the investment in terms of risk reduction, potential financial losses avoided, and alignment with business goals
   • DFocus on the number of security incidents detected and blocked in the past year
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which funding model centralizes security budget decisions at the organizational level?

   • AProject-based funding model
   • BHybrid funding model
   • CCentralized funding model
   • DDecentralized funding model
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A manufacturing company is evaluating a security investment to replace its outdated antivirus with an EDR solution. The EDR costs $250,000 per year, including licensing and staffing. The company estimates that the EDR will reduce the annualized loss expectancy (ALE) from ransomware incidents by $400,000. However, the CISO also notes that the EDR will improve threat visibility and reduce incident response time, which are harder to quantify. Which approach best incorporates both quantitative and qualitative factors into the decision?

   • AReject the investment because the qualitative benefits cannot be measured in dollars.
   • BApprove the investment solely because the reduced ALE exceeds the cost, ignoring qualitative benefits.
   • CCalculate the ROI as (reduced ALE - cost) / cost, and also document qualitative benefits such as improved visibility and faster response in the business case.
   • DCompare the EDR cost to the total revenue of the company to determine affordability.
   Reveal Solution Discussion Select an answer first