Security Strategic Planning ACCISO Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company's security strategic plan is updated annually. This year, the CISO notices that the risk landscape has changed significantly due to new remote work policies. The current plan does not address remote work risks. What is the most appropriate action?

   • AIgnore the remote work risks because the plan is already approved.
   • BCreate a separate tactical plan for remote work without updating the strategic plan.
   • CWait until the next annual review to update the plan.
   • DInitiate an unscheduled review of the strategic plan to incorporate remote work risks and adjust priorities.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A technology company has a three-year security strategic plan. At the annual review, the CISO notices that the threat landscape has changed significantly, with a rise in supply-chain attacks. The current plan focuses heavily on insider threats and perimeter defense. The company's risk appetite is moderate, and the board expects the security strategy to remain relevant. What should the CISO do?

   • AImmediately implement new supply-chain security tools without revising the strategic plan, to respond quickly to the threat.
   • BWait until the next annual review to address supply-chain risks, since the plan is reviewed yearly.
   • CKeep the current plan unchanged because it was approved by the board and is only halfway through its cycle.
   • DConduct a new risk assessment focused on supply-chain risks, then update the strategic plan to include supply-chain security initiatives and adjust KPIs accordingly.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary way a security strategy supports the organization's mission?

   • ABy ensuring security initiatives enable business objectives rather than hinder them
   • BBy minimizing the security budget to save costs
   • CBy focusing exclusively on regulatory compliance
   • DBy prioritizing security over all other business functions
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A CISO has drafted a security strategy that includes a major shift to zero-trust architecture. The strategy will require significant changes across the organization. To ensure successful implementation, what is the most important stakeholder group to engage early?

   • AIT operations staff, because they will implement the technical changes.
   • BExecutive leadership and board members, because their support is essential for funding and organizational change.
   • CExternal auditors, because they will assess compliance.
   • DCustomers, because they will be affected by the changes.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A multinational manufacturing company wants to establish a security governance framework that supports its strategic planning process. The company operates in multiple jurisdictions with varying data protection regulations and has a complex supplier ecosystem. The CISO needs a framework that provides comprehensive control objectives, aligns IT governance with business goals, and can be used to assess and improve the overall governance process. Which framework is most appropriate?

   • ATOGAF, because it provides an architecture framework for enterprise IT design.
   • BNIST Cybersecurity Framework, because it is widely used for improving critical infrastructure cybersecurity.
   • CCOBIT, because it offers a comprehensive framework for enterprise IT governance and management, linking IT objectives to business goals.
   • DISO/IEC 27001, because it provides a certifiable management system for information security.
   Reveal Solution Discussion Select an answer first