Security Strategic Planning ACCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A large enterprise is developing a security strategy. The CISO has a limited budget and must choose between investing in a long-term security architecture transformation or addressing immediate compliance gaps. The board wants to see progress on compliance, but the CISO believes the architecture transformation is critical for future risk reduction. What is the best approach?

   • AFocus exclusively on the architecture transformation and address compliance later.
   • BFocus exclusively on compliance gaps to satisfy the board and delay the architecture transformation.
   • CDevelop a strategic plan that includes both immediate compliance remediation and a phased architecture transformation, with clear milestones and funding allocated to both.
   • DAsk the board to choose one priority without providing a recommendation.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is developing its security strategy. The risk assessment shows that the highest-risk assets are customer databases and intellectual property. The company's strategic goal is to launch a new product line within 12 months. How should the CISO use the risk assessment to inform the strategy?

   • AFocus all security efforts on the new product line, since it is the strategic priority.
   • BDefer all security initiatives until after the product launch to avoid delays.
   • CAllocate resources equally across all security initiatives, regardless of risk.
   • DPrioritize security initiatives that protect the customer databases and intellectual property, while ensuring the new product launch is not delayed by security issues.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A CISO is presenting the new security strategy to the board of directors. The board is primarily concerned with financial performance and regulatory compliance. Which presentation approach is most effective?

   • AFocus on the technical details of the security controls and tools to be deployed.
   • BFrame the strategy in terms of business risk, financial impact, and regulatory compliance, using metrics and scenarios.
   • CPresent a list of all security projects and their timelines, without discussing business impact.
   • DEmphasize the latest security technologies and how they are superior to competitors' tools.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which planning level is characterized by a short-term focus, typically daily or weekly, and involves specific tasks and procedures?

   • AStrategic planning
   • BExecutive planning
   • CTactical planning
   • DOperational planning
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company has a security budget of $1 million. The risk assessment shows that a data breach could cost $10 million, while a system outage could cost $2 million. The CISO must choose between two initiatives: one reduces breach risk by 80%, the other reduces outage risk by 80%. Both cost $500,000. Which initiative should be prioritized?

   • ANeither initiative, and instead save the budget for future uncertainties.
   • BThe breach reduction initiative, because it addresses the higher potential loss.
   • CBoth initiatives, splitting the budget evenly.
   • DThe outage reduction initiative, because system outages affect daily operations.
   Reveal Solution Discussion Select an answer first