Financial Planning ACCISO Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A CISO is reviewing the security program's performance metrics. The program has a SOC, a vulnerability management team, and an identity management team. The CISO wants to present a balanced view of efficiency and effectiveness to the board. Which combination of metrics would provide the most balanced view?

   • ANumber of security alerts, number of incidents, and number of vulnerabilities discovered.
   • BPercentage of employees trained, number of policies updated, and number of audits passed.
   • CCost per incident, mean time to detect (MTTD), and percentage of critical vulnerabilities remediated within SLA.
   • DTotal security budget, number of security staff, and number of tools deployed.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A CISO needs to justify a new security tool to the CFO. The tool costs $100,000 and is expected to reduce the likelihood of a $1,000,000 breach from 15% to 5% annually. The CISO wants to present the business case in a way that is persuasive to the CFO. Which presentation is most effective?

   • AExplain the technical features of the tool and how they detect threats
   • BShow the expected annual loss reduction of $100,000 and compare it to the tool's cost
   • CState that the tool is industry best practice and widely adopted
   • DPresent the total cost of ownership over five years without discussing the benefit
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A CISO is managing a security program with a budget that is funded annually by the finance department. The program includes several multi-year projects. The finance department has indicated that next year's budget may be cut by 15% due to economic conditions. The CISO must develop a financial risk mitigation strategy. Which strategy is most effective?

   • ASpend the entire budget as quickly as possible to avoid losing unspent funds
   • BRequest a larger budget next year to compensate for the potential cut
   • CMove all security projects to a centralized funding model
   • DIdentify which projects can be deferred or scaled back without critical impact, and prepare a contingency plan
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A CISO is evaluating two security investments: a new multi-factor authentication (MFA) system and an upgraded data backup solution. The MFA system costs $80,000 and is expected to reduce the risk of account takeover, which has an estimated annual loss of $300,000 with a 20% likelihood. The backup solution costs $120,000 and is expected to reduce the risk of ransomware, which has an estimated annual loss of $500,000 with a 15% likelihood. The CISO can only fund one project. Which investment has the higher expected benefit?

   • ABoth have the same expected benefit
   • BNeither has a positive expected benefit
   • CThe backup solution, because it has a higher expected loss reduction
   • DThe MFA system, because it has a higher expected loss reduction
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A CISO wants to measure the efficiency of the security team's spending on incident response. The team handles an average of 50 incidents per month, with a total annual budget of $600,000 for the incident response function. Which financial KPI is most appropriate for this purpose?

   • ANumber of security incidents per month
   • BTotal security budget as a percentage of revenue
   • CMean time to respond (MTTR)
   • DCost per incident
   Reveal Solution Discussion Select an answer first