Security Strategic Planning ACCISO Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A CISO is developing a security strategy for a global logistics company. The strategy includes a 5-year vision, a 2-year roadmap, and a list of quarterly action items. Which component of the plan is considered tactical?

   • AThe 5-year vision statement.
   • BThe 2-year roadmap with specific initiatives and milestones.
   • CThe annual budget allocation for security tools.
   • DThe quarterly action items assigned to specific teams.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When prioritizing security initiatives, which factor should be given the most weight?

   • AThe strategic importance and risk level of the assets involved
   • BThe ease of implementation
   • CThe cost of the initiative
   • DThe popularity of the technology
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the role of risk management in the context of security strategic planning?

   • AIt provides a structured approach to identifying, assessing, and responding to risks that could affect the organization
   • BIt focuses only on technical vulnerabilities, ignoring business risks
   • CIt ensures that all risks are transferred to insurance
   • DIt is a one-time activity performed at the start of the strategy
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is considering adopting a security governance framework. The CISO wants a framework that provides a comprehensive set of controls and is certifiable. The company also needs to align with the NIST Cybersecurity Framework for its US federal clients. Which approach is most effective?

   • AAdopt only the NIST CSF because it is required by federal clients.
   • BAdopt ISO/IEC 27001 as the primary framework and map its controls to the NIST CSF to satisfy both requirements.
   • CUse a custom framework that combines elements of both without formal adoption.
   • DAdopt COBIT and use it for both governance and certification.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's security strategic plan includes annual goals. At the end of the year, the CISO reviews the KPIs and finds that the goal to reduce phishing incidents by 50% was not met; incidents only dropped by 20%. What should the CISO do?

   • AAbandon the goal and focus on other areas.
   • BKeep the same goal for the next year without changes to see if it improves.
   • CAnalyze the reasons for the shortfall, adjust the strategy or tactics, and update the plan for the next year.
   • DLower the goal to 20% to make it achievable.
   Reveal Solution Discussion Select an answer first