The Role of the CISO ACCISO Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A CISO currently reports to the CIO. The CISO has identified a critical security risk that requires a significant IT investment, but the CIO has deprioritized it in favor of a new IT project. The CISO believes the risk is not being adequately addressed. What is the most appropriate action for the CISO?

   • AResigning from the position immediately
   • BAccepting the CIO's decision because the CIO is the CISO's manager
   • CImplementing the security investment without approval using the security budget
   • DEscalating the risk to the CEO or board audit committee with a business impact analysis
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the CISO's primary role during the execution phase of an incident response?

   • ATo delete all logs to prevent evidence tampering
   • BTo personally contain the threat by disconnecting affected servers
   • CTo provide strategic direction, coordinate resources, and communicate with stakeholders
   • DTo wait until the incident is over before taking any action
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   The CISO must present the organization's top security risks to the board of directors. The board is composed of members with varying technical backgrounds. Which communication approach is most effective?

   • ATranslate technical risks into business impact terms, such as financial loss, regulatory penalties, and reputational damage, with clear mitigation options.
   • BPresent the risks in a single slide with no supporting detail to keep the presentation short.
   • CProvide a detailed technical report of all vulnerabilities and exploits, including CVSS scores and exploit code.
   • DFocus only on the risks that have already materialized, omitting potential risks to avoid alarming the board.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a highly diverse workforce, including remote workers, factory floor employees, and executives. The CISO wants to improve the overall security culture. The previous awareness program was a generic online training module that employees completed once a year. The CISO has a limited budget and must choose a new approach. Which approach is most likely to be effective in fostering a security-aware culture across the diverse workforce?

   • AFocus only on executives because they have access to the most sensitive information.
   • BDevelop role-based training that addresses the specific risks each group faces, combined with regular phishing simulations and feedback.
   • CRequire all employees to complete an advanced technical security certification to ensure a high level of knowledge.
   • DSend a monthly newsletter with security tips and hope that employees read it.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a security incident, the security manager is coordinating the technical response, the security architect is analyzing the network design for vulnerabilities, and the security engineer is implementing patches. The CISO is on a call with the CEO. Which activity is the CISO most likely performing?

   • AProviding strategic direction, communicating the incident's business impact, and approving major decisions such as system shutdowns.
   • BWriting firewall rules to block malicious traffic.
   • CRunning vulnerability scans to identify affected systems.
   • DConducting forensic analysis of the compromised systems.
   Reveal Solution Discussion Select an answer first