Alignment with Business Goals and Risk Tolerance CCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A startup is launching a new mobile app and wants to release it quickly to gain market share. The founders have a high risk tolerance for security incidents but are concerned about reputational damage. The CISO must balance security and business needs. Which approach is most appropriate?

   • AImplement only the most critical security controls, such as encryption and authentication, and accept the risk of other vulnerabilities.
   • BLaunch the app with no security controls to maximize speed.
   • CAsk the founders to lower their risk tolerance to allow for more security testing.
   • DDelay the launch until all security controls are fully implemented and tested.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does strategic risk assessment inform security planning?

   • ABy replacing the need for technical vulnerability scans
   • BBy identifying which risks are most likely to affect business objectives
   • CBy determining the exact budget for security projects
   • DBy providing a list of all possible threats to the organization
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which statement correctly differentiates risk appetite from risk tolerance?

   • ARisk appetite is the amount of risk an organization is willing to take, while risk tolerance is the acceptable deviation from that level.
   • BRisk appetite is set by the security team, while risk tolerance is set by the board.
   • CRisk appetite is a quantitative measure, while risk tolerance is qualitative.
   • DRisk appetite refers to residual risk, while risk tolerance refers to inherent risk.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial services firm has a governance structure where the board sets risk tolerance, the executive committee approves security policies, and the CISO implements security programs. A new security initiative requires significant investment but is not mandated by regulation. The CISO wants to ensure the initiative aligns with the board's risk tolerance. What is the most appropriate governance step?

   • APresent a business case to the executive committee that links the initiative to the board's risk tolerance and strategic objectives.
   • BAsk the board to increase the risk tolerance to justify the initiative.
   • CDefer the initiative indefinitely because it is not mandated by regulation.
   • DImplement the initiative immediately because it improves security, regardless of the board's risk tolerance.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A software company is developing a new cloud-based product and wants to release updates weekly to stay competitive. The CISO has identified that the current change management process, which requires multiple approvals and security testing, would slow releases to monthly. The company's risk tolerance allows for occasional service disruptions but not for data loss. Which approach best balances security and business agility?

   • ARelease updates weekly but only after the product has been in production for six months to build confidence.
   • BImplement a streamlined change process that uses automated security testing and allows expedited approvals for low-risk changes.
   • CEliminate the change management process entirely to enable weekly releases, relying on automated rollback capabilities.
   • DMaintain the current change management process to ensure all updates are fully tested, accepting the slower release cadence.
   Reveal Solution Discussion Select an answer first