Security Strategic Planning ACCISO Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A company has implemented a new security strategy focused on reducing the time to detect and respond to incidents. The CISO wants to measure the effectiveness of this strategy. Which KPI is most directly aligned with the strategy's goal?

   • ANumber of security tools deployed in the environment.
   • BPercentage of IT budget spent on security.
   • CNumber of security awareness training sessions completed per quarter.
   • DMean time to detect (MTTD) and mean time to respond (MTTR) for security incidents.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which planning level typically has a time horizon of one to five years and focuses on the overall direction of the security program?

   • AIncident response planning
   • BTactical planning
   • CStrategic planning
   • DOperational planning
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A government agency is developing a security strategy. The risk assessment identifies that the agency's risk appetite is low for data breaches but moderate for service availability. The agency's mission is to provide public services. The CISO must decide how to prioritize security initiatives. Which approach best reflects the integration of risk management into strategic planning?

   • APrioritize initiatives that ensure high availability, even if they increase data breach risk, because the mission depends on service delivery.
   • BPrioritize initiatives that prevent data breaches, even if they reduce service availability, because data breaches are the highest concern.
   • CAvoid any initiative that could reduce availability, since the agency's mission is public service.
   • DBalance initiatives to protect sensitive data while maintaining acceptable availability, accepting some availability risk to achieve both.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Why is periodic review of the security strategic plan important?

   • ATo justify the security budget every year
   • BTo ensure the strategy remains aligned with changing business objectives and threats
   • CTo replace the strategy with a new one each year
   • DTo satisfy auditors without making changes
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A large e-commerce company wants to adopt a security governance framework that helps it communicate cybersecurity risk to executive leadership in business terms. The company also needs to align its security program with industry best practices and regulatory expectations. Which framework would best serve this purpose?

   • AISO/IEC 27001, because it provides a certifiable standard for information security management.
   • BNIST Cybersecurity Framework, because it provides a common language for cybersecurity risk management and aligns with business drivers.
   • CCOBIT, because it focuses on IT governance and control objectives.
   • DPCI DSS, because the company processes credit card payments.
   Reveal Solution Discussion Select an answer first