Alignment with Business Goals and Risk Tolerance CCISO Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A bank's strategic objective is to increase digital adoption among customers. The CISO is asked to align the security strategy with this goal. Which security initiative would best support the digital adoption objective?

   • ARestricting the use of third-party integrations to reduce attack surface.
   • BRequiring customers to use a physical token for all online transactions.
   • CImplementing a biometric authentication system that simplifies login while maintaining strong security.
   • DIncreasing the frequency of security audits for the mobile banking app.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A logistics company's strategic goal is to reduce delivery times by 20% over the next year. The CISO is developing the annual security plan. Which security initiative best supports this business goal?

   • AIncreasing the frequency of security awareness training for all employees.
   • BDeploying a secure API gateway for the shipment tracking system to enable real-time data sharing with partners.
   • CConducting a full security audit of all warehouses and offices.
   • DImplementing a new endpoint detection and response (EDR) solution across all corporate devices.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A healthcare organization is planning to expand into telemedicine services, which will require storing and transmitting protected health information (PHI) over the internet. The organization's strategic objective is to increase patient access by 30% within two years. The CISO must assess the business risks in the context of this strategic objective. Which approach best aligns the security assessment with the business goal?

   • ADefer the risk assessment until after the service is launched to avoid delaying the strategic timeline.
   • BFocus the assessment only on technical vulnerabilities in the telemedicine platform, since PHI protection is a compliance requirement.
   • CConduct a threat model focused on PHI breaches and recommend eliminating the telemedicine service if the risk is high.
   • DPerform a risk assessment that evaluates the likelihood and impact of PHI exposure against the benefit of increased patient access, then propose controls that enable the service.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A regional bank is launching a new mobile payments product that must reach the market within six months to remain competitive. The board has stated that the organization can accept moderate operational risk to achieve this goal, but cannot tolerate any regulatory compliance failures. The CISO must align the security strategy with this directive. Which approach best reflects the board's risk tolerance?

   • ADeploy the product with only mandatory regulatory controls and defer all other security measures until after launch.
   • BAsk the board to revise its risk tolerance to allow for a longer timeline so that all security controls can be implemented before launch.
   • CAdopt a risk-based approach that implements essential compliance controls immediately and accepts residual operational risks within the board's stated tolerance.
   • DImplement a full set of security controls for the product, accepting a three-month delay to ensure maximum protection.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of assessing business risks in the context of strategic objectives?

   • ATo identify risks that could impede the achievement of strategic goals
   • BTo eliminate all risks that might affect any business process
   • CTo satisfy regulatory requirements for risk assessments
   • DTo prioritize security controls based on their cost
   Reveal Solution Discussion Select an answer first