Security Strategic Planning ACCISO Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A CISO has implemented a security strategy with several KPIs. After a year, some KPIs show improvement, but the overall security posture has not improved as expected. The CISO suspects the KPIs are not aligned with the strategy's goals. What is the most likely issue?

   • AThe KPIs are too many and need to be reduced.
   • BThe KPIs are too difficult to measure accurately.
   • CThe KPIs are not reviewed frequently enough.
   • DThe KPIs measure activities rather than outcomes, so they do not reflect the actual effectiveness of the strategy.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is a key performance indicator (KPI) in the context of a security strategy?

   • AA financial report of the security budget
   • BA list of security incidents that occurred
   • CA description of the security team's responsibilities
   • DA metric used to measure the effectiveness of security controls and processes
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company has implemented a security strategy with the goal of 'reducing the impact of security incidents.' The CISO wants to track progress. Which KPI is most appropriate for this goal?

   • APercentage of employees who completed security awareness training.
   • BAverage time to detect (MTTD) and average time to respond (MTTR) to incidents.
   • CNumber of security tools deployed across the organization.
   • DTotal budget allocated to security operations.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Why is it important to define metrics for a security strategy?

   • ATo increase the complexity of the security program
   • BTo satisfy regulatory requirements only
   • CTo replace the need for risk assessments
   • DTo demonstrate the value and effectiveness of security investments
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A mid-sized e-commerce company has a limited security budget. The risk assessment shows that a DDoS attack could cause significant revenue loss, while a minor data leak from a low-value marketing database has low impact. The CISO must allocate the budget for the next year. Which allocation strategy best reflects strategic prioritization?

   • ASplit the budget evenly between DDoS protection and marketing database controls to be fair.
   • BSpend the entire budget on the marketing database because it is easier to secure.
   • CDelay any investment until a new CISO is hired to provide fresh perspective.
   • DInvest most of the budget in DDoS protection and implement basic controls for the marketing database, accepting the low residual risk.
   Reveal Solution Discussion Select an answer first