Alignment with Business Goals and Risk Tolerance CCISO Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A media company is transitioning from physical media to a streaming service. The CISO wants to integrate security into this business transformation. Which security initiative would best support the company's strategic goal of rapid subscriber growth?

   • ADelaying the streaming launch until all possible security controls are in place.
   • BDeploying a secure content delivery network (CDN) with built-in DDoS protection to ensure fast and reliable streaming.
   • CFocusing on securing the corporate email system to prevent phishing attacks on employees.
   • DImplementing a digital rights management (DRM) system that protects content but may add latency for legitimate users.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A retail company is launching an e-commerce platform and wants to minimize customer friction during checkout. The CISO proposes implementing multi-factor authentication (MFA) for all customer accounts, but the business team worries this will reduce conversion rates. Which approach best integrates security with the business strategy?

   • ARequire MFA for all customers at every login, accepting a potential drop in conversion.
   • BImplement MFA only for high-risk transactions, such as large purchases or changes to account details.
   • CImplement MFA for all customers but only after the platform has been live for six months.
   • DDrop the MFA proposal to avoid any negative impact on conversion rates.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A retail chain's board has a risk appetite statement that says the company is willing to accept significant risk to achieve market leadership. However, the CISO has established a risk tolerance that limits the acceptable downtime of the point-of-sale (POS) system to 1 hour per month. A proposed new loyalty program requires a 4-hour maintenance window for the POS system each month. What is the most appropriate response?

   • AImplement the loyalty program without the maintenance window, assuming it can be done without downtime.
   • BApprove the maintenance window because the board's risk appetite is high.
   • CEscalate the conflict to leadership to decide whether to adjust the risk tolerance or modify the loyalty program.
   • DReject the maintenance window because it exceeds the established risk tolerance.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How do governance structures ensure that security decisions align with risk tolerance?

   • ABy eliminating the need for risk assessments
   • BBy establishing oversight processes that review and approve significant security decisions
   • CBy focusing only on regulatory compliance
   • DBy delegating all security decisions to the IT department
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is it important to communicate risk tolerance levels to stakeholders?

   • ATo satisfy external auditors' requirements for documentation
   • BTo allow security teams to override business decisions
   • CTo ensure that all stakeholders make decisions consistent with the organization's risk posture
   • DTo discourage stakeholders from taking any risks
   Reveal Solution Discussion Select an answer first