Alignment with Business Goals and Risk Tolerance CCISO Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A multinational corporation has different risk tolerances for different regions: the European region has a low tolerance for data privacy risks, while the Asia-Pacific region has a higher tolerance. The CISO needs to communicate these tolerances to regional security teams. What is the most effective approach?

   • ACommunicate the regional risk tolerances to each regional security team, with examples of how to apply them in local decision-making.
   • BIssue a single global risk tolerance statement that applies to all regions.
   • CSet a single, low risk tolerance for all regions to simplify communication.
   • DLet each regional team determine its own risk tolerance based on local conditions.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A startup's leadership team has a high risk appetite for innovation but has not formally defined risk tolerance levels. The CISO is asked to develop a security strategy. What should the CISO do first?

   • AAssume the high risk appetite means minimal security controls are acceptable.
   • BWork with leadership to define specific risk tolerance levels for key business objectives, such as data exposure and system availability.
   • CImplement a set of baseline security controls based on industry best practices.
   • DConduct a security audit to identify current vulnerabilities before making any decisions.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What does 'risk tolerance' represent in an organizational context?

   • AThe total amount of risk that has been eliminated through security controls
   • BThe minimum level of security investment required by regulators
   • CThe maximum amount of risk an organization is willing to accept in pursuit of its objectives
   • DThe likelihood that a specific threat will exploit a vulnerability
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the best way to integrate security initiatives with business strategy?

   • AInvolve security leaders in strategic business planning from the outset
   • BKeep security plans confidential to avoid business disruption
   • CImplement security controls after business processes are fully designed
   • DFocus security initiatives solely on regulatory compliance
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Who is primarily responsible for determining the organization's risk tolerance?

   • AThe Chief Information Security Officer (CISO) alone
   • BThe IT security team
   • CExternal auditors
   • DThe board of directors and executive leadership
   Reveal Solution Discussion Select an answer first