The Role of the CISO ACCISO Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   Which statement best describes the strategic position of a Chief Information Security Officer (CISO) within an organization?

   • AThe CISO is primarily responsible for the day-to-day configuration of security tools and firewalls.
   • BThe CISO is a technical role that reports to the security manager and implements security policies.
   • CThe CISO is a temporary role created only during a security incident to coordinate response efforts.
   • DThe CISO is an executive-level role focused on aligning security initiatives with business objectives and managing security risks.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   After a major security incident, the CISO is leading the post-incident review. The incident revealed that the incident response plan was outdated and that several teams did not know their roles. The CISO must decide how to improve the program. Which action best addresses the root cause?

   • AUpdating the incident response plan and conducting regular tabletop exercises with all relevant teams
   • BPurchasing a new security incident management tool
   • CReplacing the incident response team with external consultants
   • DDocumenting the incident and closing the review
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A multinational organization is implementing a new security governance framework. The CISO has established a security steering committee with representatives from IT, legal, HR, and business units. The committee is tasked with reviewing and approving security policies. However, the security manager believes that the committee slows down decision-making and wants to bypass it for urgent policies. What is the CISO's most appropriate response?

   • ASupport the committee process, but establish an expedited review path for urgent policies to balance governance with agility.
   • BAllow the security manager to bypass the committee for all policies to speed up decision-making.
   • CRequire the security manager to follow the committee process strictly, even if it delays urgent policies.
   • DDissolve the committee and have the CISO approve all policies directly.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Which competency is most essential for a CISO to effectively communicate security risks to the board of directors?

   • ADeep expertise in a single security technology, such as firewalls
   • BCertification in a specific vendor's security product
   • CExpert-level programming skills in multiple languages
   • DAbility to translate technical risks into business impact and financial terms
   Reveal Solution Discussion Select an answer first
6. 55foundation · easy

   How does the role of a security manager differ from that of a CISO?

   • AThe security manager implements and oversees security operations, while the CISO sets the strategic direction and overall program.
   • BThe security manager and CISO have identical responsibilities and are interchangeable titles.
   • CThe security manager focuses on strategic alignment with business goals, while the CISO handles daily operations.
   • DThe security manager is a board-level role, while the CISO is a mid-level position.
   Reveal Solution Discussion Select an answer first