Alignment with Business Goals and Risk Tolerance CCISO Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm has defined its risk tolerance in terms of maximum acceptable financial loss per incident. The CISO needs to communicate this tolerance to project managers across the organization so they can make informed decisions. Which communication approach is most effective?

   • AIncorporate the risk tolerance into the project management software as a mandatory field that must be acknowledged before project approval.
   • BHold a workshop with project managers to explain the risk tolerance, provide examples of acceptable and unacceptable risks, and discuss how to apply it in project planning.
   • CSend a detailed email to all project managers outlining the risk tolerance and asking them to contact the security team with questions.
   • DPublish the risk tolerance statement on the internal security portal and require all project managers to acknowledge it annually.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In strategic planning, what role does risk appetite play?

   • AIt replaces the need for detailed risk assessments.
   • BIt provides a high-level guide for the amount of risk the organization is willing to accept.
   • CIt defines the specific maximum acceptable risk for each individual project.
   • DIt determines the exact security controls to be implemented.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A manufacturing company's board has defined a risk tolerance that allows for occasional production downtime but prohibits any safety-related incidents. The CISO needs to communicate this tolerance to the plant operations team so that security decisions align. Which communication approach is most effective?

   • AConduct interactive workshops with plant managers and shift leads to discuss how the risk tolerance applies to daily security decisions.
   • BPost the risk tolerance statement on the company intranet and require all employees to acknowledge it.
   • CInclude the risk tolerance in the annual employee handbook without further discussion.
   • DSend a detailed email to all plant managers explaining the risk tolerance statement and asking them to share it with their teams.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large enterprise has a governance structure where the board sets risk appetite, the executive committee defines risk tolerance, and the CISO implements security controls. The executive committee has set a risk tolerance that allows for a moderate level of security incidents, but the CISO believes this is too high and wants to implement stricter controls. The CISO's proposed controls would slow down business operations. What should the CISO do?

   • APresent a risk assessment to the executive committee showing the potential impact of the higher tolerance and recommend a review.
   • BAppeal directly to the board to change the risk tolerance without consulting the executive committee.
   • CImplement the stricter controls anyway because the CISO has the authority to do so.
   • DAccept the executive committee's tolerance and implement controls that meet that level, even if the CISO disagrees.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the role of a governance committee in relation to risk tolerance?

   • ATo approve security strategies and ensure they align with the organization's risk tolerance
   • BTo set risk tolerance without input from business leaders
   • CTo monitor daily security operations
   • DTo implement all security controls directly
   Reveal Solution Discussion Select an answer first