Alignment with Business Goals and Risk Tolerance CCISO Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A software company's strategic goal is to release new features every two weeks to stay ahead of competitors. The security team wants to introduce a mandatory security review for every feature, which could add three days to the release cycle. The company's risk tolerance allows for some delay to ensure security, but the business goal is rapid innovation. What is the best approach?

   • AIntegrate automated security testing into the CI/CD pipeline to reduce the manual review time and keep the release cycle close to two weeks.
   • BAsk the board to decide whether to prioritize security or speed, without proposing a solution.
   • CImplement the mandatory review for all features, accepting the delay as necessary for security.
   • DSkip the security review for features that are not customer-facing to save time.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A university is planning to launch an online learning platform to increase enrollment by 15% over the next two years. The platform will store student records and course materials. The CISO is asked to assess the business risks of this initiative. Which risk should be prioritized in the context of the strategic objective?

   • AThe risk of the platform not integrating with existing student information systems.
   • BThe risk of a data breach that could damage the university's reputation and reduce enrollment.
   • CThe risk of the platform exceeding its budget.
   • DThe risk of the platform being unavailable during peak enrollment periods.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A manufacturing company's strategic goal is to reduce operational downtime by 20% through increased automation of its production lines. The CISO proposes a security initiative that would require network segmentation and strict access controls on the industrial control systems (ICS). The operations director objects, saying the controls will slow down production. What should the CISO do to integrate security with the business strategy?

   • AWork with operations to design controls that minimize impact on production speed while still reducing risk, and present the trade-off to leadership.
   • BAsk the board to approve the controls without consulting operations, citing the risk to ICS.
   • CImplement the controls immediately and require operations to adapt, since security is non-negotiable.
   • DWithdraw the proposal to avoid conflict with the operations director.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A government agency has a low risk tolerance for data breaches due to the sensitive nature of its data. The CISO needs to communicate this to all employees, including those in non-technical roles. Which method is most likely to ensure that employees understand and act in accordance with the risk tolerance?

   • AIncluding the risk tolerance statement in the employee handbook and requiring a signature upon hire.
   • BPosting the risk tolerance on the intranet and sending a company-wide email.
   • CConducting regular, role-based training sessions that explain the risk tolerance with real-world examples and decision-making scenarios.
   • DMaking the risk tolerance a mandatory field in the annual performance review.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is a common trade-off when implementing strong security controls?

   • AIncreased risk tolerance automatically
   • BReduced business agility due to increased friction in processes
   • CGuaranteed compliance with all regulations
   • DElimination of all security risks
   Reveal Solution Discussion Select an answer first