Alignment with Business Goals and Risk Tolerance CCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A hospital's board has defined a risk tolerance that prioritizes patient safety over all other factors, including cost. The CISO needs to communicate this to the IT team so that security decisions align. Which communication method is most likely to ensure the IT team understands and applies this tolerance?

   • AAdding the tolerance to the IT team's performance review criteria.
   • BSending a memo to the IT manager with instructions to enforce the tolerance.
   • CHolding a training session with real-world scenarios that illustrate how to prioritize patient safety in security decisions.
   • DIncluding the risk tolerance statement in the IT team's quarterly newsletter.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is a key element of effectively communicating risk tolerance?

   • ACommunicating only after a major security incident
   • BUsing technical jargon to ensure precision
   • CLimiting communication to the executive team only
   • DProviding clear, business-relevant language that stakeholders can understand
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A bank's governance structure includes a risk committee that reviews and approves any security control that could impact business operations. The CISO wants to implement a new authentication system that will require users to change passwords more frequently, which may increase help desk calls. What should the CISO do?

   • AImplement the control and inform the risk committee after the fact.
   • BCancel the project because the risk committee will likely reject it due to the help desk impact.
   • CImplement the new authentication system immediately because it improves security.
   • DPresent the proposed control to the risk committee, including the potential impact on help desk calls and the security benefit.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A government contractor has a low risk appetite for any security incidents because of the sensitive nature of its work. However, the board has set a risk tolerance that allows for a small number of minor incidents per year, as long as no classified data is exposed. The CISO is planning the security budget. Which approach best reflects the board's risk tolerance?

   • AAsk the board to clarify whether the risk appetite or the risk tolerance should guide the budget.
   • BReduce the security budget because the board has accepted some incidents, so fewer controls are needed.
   • CAllocate resources to prevent classified data exposure while accepting the possibility of minor incidents.
   • DInvest heavily in controls to prevent all incidents, regardless of cost, to match the low risk appetite.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A regional bank is launching a new mobile banking app that must reach the market within six months to remain competitive. The board has stated that the bank will accept a moderate level of security risk to achieve this timeline, but the CISO is concerned about the app's authentication design. Which action best aligns the security strategy with the board's stated risk tolerance?

   • AImplement a phased rollout with basic authentication first, then add multi-factor authentication after launch.
   • BDelay the launch until all security controls, including multi-factor authentication, are fully implemented.
   • CEscalate the authentication concern to the board and request a formal risk acceptance for the missing control.
   • DImplement multi-factor authentication but reduce other security features to compensate for the added development time.
   Reveal Solution Discussion Select an answer first