Security Strategic Planning ACCISO Practice Questions (Page 12)

Questions 56–60

1. 56application · medium

   A financial services firm has implemented a new security strategy focused on reducing data breach risk. The CISO needs to report progress to the board quarterly. Which metric would best demonstrate the effectiveness of the security strategy in reducing breach risk?

   • ANumber of security awareness training sessions completed per quarter.
   • BTotal number of security incidents reported by employees.
   • CBudget spent on security tools compared to the previous year.
   • DPercentage of critical vulnerabilities remediated within the defined SLA.
   Reveal Solution Discussion Select an answer first
2. 57expert · hard

   A healthcare organization is developing its annual security strategy. The risk assessment identifies two critical risks: (1) ransomware affecting patient records, and (2) a legacy patient portal with known vulnerabilities that could expose sensitive data. The organization's strategic goal is to improve patient experience through a new mobile app. The budget is limited. The CISO must allocate resources across three proposed initiatives: A) enhance endpoint detection and response (EDR) and backup systems, B) remediate the legacy portal vulnerabilities, and C) build security into the new mobile app development. Which allocation best balances strategic alignment and risk reduction?

   • AAllocate most of the budget to initiative B, because the legacy portal is an immediate known vulnerability.
   • BAllocate most of the budget to initiative C, because the mobile app is the organization's strategic priority.
   • CAllocate a balanced budget across all three initiatives, weighting A and B slightly higher due to immediate risk, while ensuring C receives enough to embed security from the start.
   • DAllocate most of the budget to initiative A, with minimal funding for B and C, because ransomware is the highest-impact risk.
   Reveal Solution Discussion Select an answer first
4. 58application · medium

   A government agency's mission includes protecting citizen data while providing online services. The agency is adopting a risk management framework and wants its security strategy to align with the mission. Which approach best ensures alignment?

   • ALet each department define its own security goals independently.
   • BAdopt a commercial framework like ISO 27001 without modification.
   • CUse the NIST Risk Management Framework to identify, assess, and prioritize risks to citizen data and online services, then develop security goals that protect both.
   • DFocus the strategy solely on protecting citizen data, even if it means reducing online services.
   Reveal Solution Discussion Select an answer first
5. 59foundation · easy

   What is the first step in developing a security strategy?

   • ADevelop a budget
   • BDefine the vision and mission
   • CSelect security technologies
   • DConduct a risk assessment
   Reveal Solution Discussion Select an answer first
6. 60application · medium

   A company's security strategic plan was created two years ago. Since then, the company has acquired a new subsidiary and adopted a cloud-first strategy. The CISO is reviewing the plan. What is the most appropriate action?

   • AConduct a formal review of the strategic plan, update it to reflect the new business context, and communicate changes to stakeholders.
   • BReplace the plan entirely with a new one based only on the subsidiary's security needs.
   • CKeep the plan unchanged to maintain consistency and avoid confusion.
   • DWait until the next annual audit to update the plan.
   Reveal Solution Discussion Select an answer first