Security Strategic Planning ACCISO Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A CISO is developing a security strategy that requires significant investment and changes to business processes. The board is skeptical about the return on investment. The CISO needs to obtain buy-in. Which communication approach is most likely to succeed?

   • APresent the strategy using technical details to demonstrate expertise.
   • BEmphasize the compliance requirements and legal obligations.
   • CPresent a business case that links security investments to specific business risks and potential financial losses avoided.
   • DAsk the board to trust the CISO's judgment without detailed justification.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   How does risk assessment feed into the development of a security strategy?

   • AIt guarantees that all risks will be mitigated
   • BIt identifies which security controls to implement first based on risk levels
   • CIt eliminates the need for ongoing risk monitoring
   • DIt provides a basis for prioritizing security initiatives and allocating resources
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which framework is commonly used to align IT governance with business goals and is often applied to security governance?

   • ACOBIT
   • BISO 27001
   • CITIL
   • DNIST SP 800-53
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A retail company is creating its first security strategic plan. The CEO wants the plan to reflect the company's mission of 'delivering seamless customer experiences.' The CISO is drafting the vision and mission statements for the security strategy. Which vision statement best aligns with the business mission?

   • ATo eliminate all security incidents across the organization within the next three years.
   • BTo build a world-class security operations center with the latest technology.
   • CTo enable secure and seamless customer experiences by protecting customer data and ensuring the availability of digital services.
   • DTo ensure compliance with all applicable regulations and standards.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A retail company is about to launch a new security strategy that will require significant changes to how employees handle customer data. The CISO wants to ensure smooth adoption across the organization. Which approach is most likely to obtain buy-in from employees and stakeholders?

   • APublish the strategy on the internal intranet and require employees to acknowledge reading it.
   • BSend a single email from the CEO outlining the strategy and the consequences of non-compliance.
   • CConduct a series of interactive workshops for each department, explaining how the strategy protects both customers and the company, and addressing concerns.
   • DWait until after implementation to communicate the changes, to avoid confusion and speculation.
   Reveal Solution Discussion Select an answer first