The Role of the CISO ACCISO Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   During a ransomware incident, the CISO is notified that critical systems are encrypted. The incident response team is activated. What is the CISO's primary role during the response?

   • APersonally isolate affected systems and begin forensic analysis of the malware.
   • BDelegate all incident response decisions to the security manager and remain uninvolved.
   • CWait for the incident to be fully contained before informing the CEO.
   • DLead the strategic response, coordinate with executives and external parties, and make key decisions about containment and communication.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is subject to a new data protection regulation that requires breach notification within 72 hours. The CISO must ensure the organization can meet this requirement. Which action is most directly within the CISO's compliance role?

   • ARelying on the legal team to handle all breach notifications
   • BInforming the board that the regulation is too burdensome
   • CWaiting for the regulator to provide implementation guidance
   • DDeveloping and testing an incident notification procedure that includes the 72-hour timeline
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A CISO must present the organization's top security risks to the board of directors. The board members are not technical and are primarily concerned with business impact. Which presentation approach is most effective?

   • AProviding a summary of recent security incidents without analysis
   • BDescribing risks in terms of potential financial loss, regulatory penalties, and impact on business operations
   • CPresenting a detailed list of vulnerabilities with CVSS scores
   • DShowing the network architecture diagram and explaining each security control
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company has experienced multiple phishing incidents despite technical controls. The CISO wants to reduce the human risk. Which initiative best aligns with the CISO's role in fostering a security-aware culture?

   • ATerminate employees who fall for phishing simulations to deter others.
   • BSend a one-time email to all employees warning them about phishing.
   • CImplement a continuous security awareness program that includes simulated phishing, role-based training, and metrics to measure improvement.
   • DPurchase an advanced email filtering solution and rely solely on technology to block phishing emails.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A CISO is preparing the annual security budget. The company is facing a tight budget year, and the CFO has asked the CISO to justify every security expense. The CISO has identified several initiatives: a new SIEM platform, additional endpoint protection, a security awareness program, and a penetration test. Which approach best demonstrates cost justification?

   • ACut the security awareness program because it is the least technical
   • BPrioritize initiatives based on the risk reduction they provide and present the cost per risk-reduction unit
   • CRequest the same budget as the previous year with a small increase for inflation
   • DFund all initiatives equally to avoid conflict among team leads
   Reveal Solution Discussion Select an answer first