Security Strategic Planning ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   How does a security strategy best support an organization's risk appetite?

   • ABy ignoring business objectives to focus purely on security
   • BBy applying the same security controls to all assets regardless of risk
   • CBy aligning security investments with the level of risk the organization is willing to accept
   • DBy eliminating all risks to the organization
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A regional bank is developing its annual security plan. The board has set a strategic objective to expand digital lending services within 18 months. The CISO proposes a multi-year security roadmap that prioritizes API security and customer identity protection. However, the IT operations director argues that the immediate priority should be patching legacy core-banking systems, which have known vulnerabilities. Which approach best aligns the security strategy with the organization's strategic direction?

   • ADevelop a roadmap that sequences legacy patching as a foundational step while accelerating API security and identity initiatives to enable digital lending.
   • BPrioritize the legacy patching program because known vulnerabilities pose an immediate and demonstrable risk to the bank.
   • CDefer all security investments until the digital lending platform is fully designed, then conduct a single comprehensive risk assessment.
   • DFund both initiatives equally, treating all security risks as equally important regardless of business context.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which component of a security strategy describes the desired future state of security in the organization?

   • AMission
   • BGoal
   • CObjective
   • DVision
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has a security strategic plan that was developed two years ago. Since then, the company has acquired a smaller firm and entered a new market. The CISO wants to ensure the plan remains relevant. What is the most appropriate action?

   • AConduct a full review of the strategic plan, incorporating the acquisition and new market into the risk assessment and updating goals and KPIs.
   • BKeep the plan unchanged because it is only two years old and still has one year remaining.
   • COnly update the budget figures to reflect the acquisition costs.
   • DReplace the entire plan with a new one developed from scratch, ignoring the existing plan.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Why is it important to communicate the security strategy to stakeholders?

   • ATo ensure stakeholders understand and support the security initiatives
   • BTo comply with legal requirements only
   • CTo hide security weaknesses from stakeholders
   • DTo delegate all security responsibilities to stakeholders
   Reveal Solution Discussion Select an answer first