Security Strategic Planning ACCISO Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which governance framework is widely used for establishing, implementing, and improving an information security management system (ISMS)?

   • ATOGAF
   • BISO 27001
   • CNIST Cybersecurity Framework
   • DCOBIT
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the purpose of resource allocation in security strategic planning?

   • ATo minimize the security budget
   • BTo distribute resources equally among all security initiatives
   • CTo ensure that resources are directed to the highest-priority security initiatives
   • DTo fund all security initiatives equally regardless of risk
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A manufacturing company's CISO is leading the creation of a three-year security roadmap. The plan includes a vision statement, high-level goals, and a sequence of major initiatives. During a steering committee meeting, a plant manager asks for a detailed implementation schedule for next month's firewall upgrade. How should the CISO respond?

   • AAsk the plant manager to create the schedule independently without referencing the strategic plan.
   • BAdd the firewall upgrade schedule to the strategic roadmap to ensure all stakeholders see the immediate actions.
   • CExplain that the three-year roadmap is strategic and that the firewall upgrade schedule belongs in the tactical or operational plan developed by the security operations team.
   • DRevise the roadmap to focus only on the firewall upgrade and other near-term projects to satisfy the plant manager.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A healthcare organization is updating its security strategy and must comply with HIPAA while also improving its overall security posture. The CISO wants a governance framework that provides a comprehensive set of controls and is certifiable. Which framework should be the primary basis for the security strategy?

   • ACOBIT, because it focuses on IT governance and control objectives for enterprise IT.
   • BNIST Cybersecurity Framework, because it is voluntary and provides a risk-based approach.
   • CISO/IEC 27001, because it offers a certifiable management system with a broad control set that can be mapped to HIPAA requirements.
   • DA custom framework built entirely from HIPAA requirements.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is a key component of continuous improvement in security strategic planning?

   • AFocusing only on past incidents
   • BKeeping the strategy static to avoid confusion
   • CEliminating all security controls that are not perfect
   • DUsing feedback and metrics to identify areas for enhancement
   Reveal Solution Discussion Select an answer first