The Role of the CISO ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following best describes the relationship between security strategy and business objectives?

   • ASecurity strategy is only relevant to the IT department and does not affect business operations.
   • BSecurity strategy should enable business objectives by managing risks without hindering innovation.
   • CSecurity strategy should be developed independently of business objectives to avoid bias.
   • DSecurity strategy should prioritize security over all business goals, even if it stops operations.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A manufacturing company's CISO has identified a critical vulnerability in a legacy production system. Patching would require a 12-hour shutdown, costing an estimated $2 million in lost production. The exploit is not publicly known and requires physical access to the facility. The CEO asks the CISO for a recommendation. Which action best reflects the CISO's risk management role?

   • ARecommend accepting the risk and implementing compensating physical-access controls
   • BOrder the immediate patch despite the production loss because the vulnerability is critical
   • CDefer the decision to the plant manager because it is a production issue
   • DEscalate the decision to the board without providing a recommendation
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A mid-sized e-commerce company is deciding whether to accept the risk of not implementing multi-factor authentication (MFA) for a legacy customer-support application. The CISO has presented the risk analysis to the executive team, showing that the application contains only non-sensitive data and that the cost of retrofitting MFA is high relative to the potential impact. The executives are inclined to accept the risk. What is the CISO's most appropriate action in this situation?

   • ARefuse to accept the risk and mandate that MFA be implemented regardless of cost.
   • BImmediately escalate the decision to the board of directors for a final ruling.
   • CImplement MFA anyway using funds from another security project without informing the executives.
   • DDocument the risk acceptance decision, including the business rationale, and ensure it is formally approved by the appropriate executive owner.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a potential implication of a CISO reporting to the CIO?

   • AThe CISO has no responsibility for compliance or risk management.
   • BThe CISO automatically has a seat on the board of directors.
   • CThe CISO is not required to communicate with the CEO.
   • DSecurity may be viewed as a subset of IT, potentially limiting its strategic influence.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   How should a CISO prioritize resource allocation within the security budget?

   • ABased on the cost of the solution alone, regardless of effectiveness
   • BBased on the personal preferences of the security team
   • CBased on the areas of highest risk to the organization
   • DBased on the order in which requests are received
   Reveal Solution Discussion Select an answer first