Information Security Management Program ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A global organization is redesigning its security awareness program. The program must address diverse cultural attitudes toward security, varying levels of technical literacy, and different regulatory requirements in each region. The CISO has limited budget and must demonstrate measurable improvement. Which strategy is most effective?

   • AFocus on high-risk regions only, as they are more likely to experience security incidents.
   • BDevelop a core awareness curriculum with localized content and delivery methods, and use phishing simulations with regional benchmarks to measure improvement.
   • CLet each region design its own training program to ensure cultural relevance.
   • DDeliver a single global training video translated into multiple languages to ensure consistency.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A multinational corporation is updating its information security policy framework. The CISO wants to ensure that high-level directives are translated into actionable requirements for different regions and departments. The company has varying regulatory obligations and operational practices across its global offices. Which document hierarchy should the CISO establish to best support consistent yet adaptable implementation?

   • ASeparate independent policies for each region, each with its own standards and procedures, to address local regulations.
   • BA set of guidelines only, leaving each department to develop its own policies and standards as needed.
   • CA single global information security policy, supported by regional standards and local procedures and guidelines.
   • DA detailed global procedure manual that all regions must follow exactly, with no local variations.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A multinational corporation is merging with another company. The CISO must integrate two different Information Security Management Programs. One company has a centralized, compliance-driven program; the other has a decentralized, risk-based program. The merged entity wants to maintain operational efficiency while ensuring consistent security governance. Which approach best balances these competing needs?

   • ACreate a new program from scratch that is entirely risk-based, discarding the compliance program.
   • BEstablish a unified governance framework with a core set of mandatory policies, while allowing business units to adopt additional risk-based controls as needed.
   • CAllow each legacy program to continue operating independently to avoid disruption.
   • DAdopt the centralized compliance-driven program for the entire merged entity to ensure uniform compliance.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large enterprise's ISMP includes a metrics program. The CISO must report to the board on the program's effectiveness, but the board is concerned about the cost of security. The CISO wants to demonstrate value while managing costs. Which metric set would best achieve this?

   • APercentage of critical systems protected and cost per protected system
   • BNumber of security policies and training sessions completed
   • CNumber of security incidents and average cost per incident
   • DTotal security spending and number of security staff
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A retail chain's ISMP is being revised. The company has aggressive growth plans, including entering new international markets. The CISO must ensure the ISMP supports this expansion while maintaining consistent security governance. Which approach is most appropriate?

   • ACreate a global policy framework with regional standards that address local legal and cultural requirements
   • BDevelop a single global security policy and require all regions to follow it without exception
   • CAllow each region to develop its own security policies independently
   • DPostpone security policy development until the company has entered all new markets
   Reveal Solution Discussion Select an answer first