Alignment with Business Goals and Risk Tolerance CCISO Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which outcome indicates successful integration of security initiatives with business strategy?

   • ASecurity projects are funded only after they are mandated by regulators
   • BSecurity policies are written in technical language for IT staff only
   • CSecurity incidents never occur
   • DSecurity initiatives directly support the organization's strategic objectives
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An e-commerce company wants to reduce page load time to improve customer conversion rates. The security team proposes adding a web application firewall (WAF) that may add 100 milliseconds of latency. The company's risk tolerance allows for some performance degradation to improve security, but the business goal is to increase conversions. What is the best decision?

   • AAsk the board to decide without any data on the WAF's impact.
   • BDo not deploy the WAF because any latency will hurt conversions.
   • CDeploy the WAF because security is always the top priority.
   • DDeploy the WAF and measure the impact on conversion rates, then adjust if the latency is unacceptable.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A multinational corporation's board has approved a risk appetite statement that says the company is willing to pursue aggressive growth opportunities, but the CISO has set a risk tolerance that limits any single project's data exposure to a low level. During a strategic planning session, a business unit proposes a new venture that would require storing customer data in a region with higher regulatory uncertainty. What is the most appropriate action for the CISO?

   • APresent the risk tolerance conflict to the board and let them decide whether to adjust the tolerance or the venture.
   • BAllow the venture to proceed but require additional security controls to bring the residual risk within the tolerance.
   • CUpdate the risk tolerance to match the board's aggressive risk appetite so the venture can proceed.
   • DReject the venture because it exceeds the established risk tolerance for data exposure.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A healthcare provider is planning to expand into telemedicine services, a strategic objective for the next fiscal year. The CISO must assess the business risks associated with this expansion to inform the security strategy. Which risk assessment approach is most aligned with the strategic objective?

   • AReview the security posture of all existing vendors and terminate any that do not meet current standards.
   • BEvaluate the potential impact of a data breach on patient trust and regulatory penalties in the context of the telemedicine launch.
   • CConduct a comprehensive vulnerability scan of the current network infrastructure and remediate all findings.
   • DImplement a new security awareness training program for all staff before the telemedicine launch.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of aligning security strategy with business goals?

   • ATo enable the organization to achieve its objectives while managing security risks effectively.
   • BTo ensure that security controls are as restrictive as possible to minimize risk.
   • CTo satisfy external auditors by demonstrating that security policies exist.
   • DTo guarantee that all security projects receive the same budget as other IT projects.
   Reveal Solution Discussion Select an answer first