Information Security Management Program ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A retail company's CISO needs to report the effectiveness of the Information Security Management Program to the board. The board wants to see both operational performance and progress toward strategic goals. Which set of metrics would best serve this reporting need?

   • AKPIs such as percentage of systems patched within SLA, and KRIs such as number of high-risk vulnerabilities open.
   • BOnly financial metrics, such as cost per incident and total security budget spent.
   • CAnecdotal reports from the security team about recent incidents and how they were handled.
   • DOnly compliance metrics, such as percentage of employees who completed mandatory training.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary goal of a security awareness and training program?

   • ATo provide employees with advanced cybersecurity certifications
   • BTo ensure compliance with all industry regulations
   • CTo change employee behavior and reduce human-related security risks
   • DTo replace technical security controls
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An e-commerce company's ISMP includes a continuous improvement process. A recent audit found that the company's access review process is not consistently followed, leading to excessive user permissions. The CISO wants to address this finding. Which action best supports continuous improvement?

   • AUpdate the access review procedure and add a KPI to track the completion rate of reviews
   • BIgnore the audit finding because access reviews are not critical
   • CTerminate the employees responsible for not following the process
   • DIncrease the frequency of audits without changing the process
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a trigger for reviewing and improving an ISMP?

   • AA security incident that reveals a control gap
   • BAn increase in employee satisfaction survey scores
   • CA change in the organization's branding
   • DA decrease in the cost of cloud services
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A startup is establishing its first Information Security Management Program. The CEO wants to ensure the program supports business growth and does not become a bureaucratic burden. Which initial approach best aligns with this goal?

   • AAdopt a one-size-fits-all security framework without tailoring it to the startup's operations
   • BDevelop a comprehensive set of policies covering every possible scenario before launching any product
   • CCreate a risk-based ISMP with core policies, standards, and procedures that can scale with the business
   • DFocus only on technical security controls and ignore policy development
   Reveal Solution Discussion Select an answer first