Security Strategic Planning ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a security strategic plan with KPIs that are reviewed annually. Mid-year, a major security incident occurs, revealing that the KPIs did not capture a critical weakness. The CISO needs to improve the plan. What is the most appropriate action?

   • ARemove the KPIs entirely, since they failed to prevent the incident.
   • BWait until the annual review to update the KPIs, since the plan is reviewed yearly.
   • CKeep the KPIs unchanged but increase the frequency of reporting to the board.
   • DConduct a post-incident review, update the KPIs to include the new weakness, and communicate the changes to stakeholders.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational company operates in regions with different data protection laws. The CISO is developing a global security strategy. The risk assessment shows that the highest risk is non-compliance with local data residency laws. The CISO must decide how to integrate this into the strategy. Which approach is most appropriate?

   • AFocus only on the region with the strictest laws and apply those controls globally.
   • BDevelop a global strategy with regional implementation plans that address local data residency requirements, prioritizing compliance as a key risk.
   • CLet each regional office develop its own security strategy independently.
   • DImplement a single global data policy that ignores regional differences to ensure consistency.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A non-profit organization relies heavily on donor data and has a mission to serve vulnerable populations. The organization's risk appetite is very low for any data breach, but it has limited funding. The board wants to expand services, which will require collecting more sensitive data. The CISO must develop a security strategy. Which approach best balances the organization's mission, risk appetite, and resource constraints?

   • AProceed with the expansion and accept the increased risk, since the mission is paramount.
   • BDevelop a strategy that includes data minimization, strong encryption, and staff training, and phase the expansion to manage risk within budget.
   • COutsource all security to a managed security service provider to reduce costs and risk.
   • DRecommend against expanding services because the security risk is too high.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's security strategy includes a goal to 'improve incident response capabilities.' The CISO needs to define measurable objectives. Which objective is most measurable and aligned with the goal?

   • AReduce the average time to detect and contain a security incident by 20% within the next year.
   • BEnhance the incident response team's skills through regular training.
   • CIncrease the number of incident response drills conducted each year.
   • DImplement a new SIEM tool to improve visibility.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A startup is creating its first security strategic plan. The founders want the plan to be concise and actionable. They ask the CISO to define the mission of the security strategy. Which statement best defines a security mission?

   • ATo protect the organization's information assets and enable business growth by managing security risks effectively.
   • BTo achieve ISO 27001 certification within two years.
   • CTo reduce the security budget by 10% annually.
   • DTo implement a specific set of security tools and technologies.
   Reveal Solution Discussion Select an answer first