Alignment with Business Goals and Risk Tolerance CCISO Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A technology company has a governance structure where the board sets risk appetite, the executive committee sets risk tolerance, and the CISO implements security controls. A new product line requires accepting a higher level of data risk than the current tolerance allows. What is the proper governance process to address this?

   • AThe executive committee should review the proposed product line and decide whether to revise the risk tolerance.
   • BThe board should be bypassed because this is an operational decision, and the CISO can approve the risk increase.
   • CThe product line should be cancelled because it exceeds the current risk tolerance.
   • DThe CISO should adjust the security controls to reduce the risk to the current tolerance level.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   When balancing security controls with business agility, what should be the primary consideration?

   • AThe cost of security controls
   • BThe latest industry trends
   • CThe organization's risk tolerance and business objectives
   • DThe preferences of the security team
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A logistics company's strategic objective is to expand into new international markets within the next year. The CISO is developing the annual security strategy. Which security initiative best aligns with this business goal?

   • AUpgrading the firewall infrastructure in the existing headquarters data center.
   • BImplementing a comprehensive data loss prevention (DLP) system across all current operations.
   • CIncreasing the security awareness training budget for all employees.
   • DConducting a risk assessment of the data protection requirements in the target markets and designing security controls to meet those requirements.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A university is planning to launch an online learning platform to increase enrollment. The CISO must assess the business risks that could affect this strategic objective. Which risk is most relevant to the success of the online platform?

   • AA misconfigured firewall on the campus network that slows internet access.
   • BA malware infection on a single administrative workstation.
   • CA distributed denial-of-service (DDoS) attack that makes the platform unavailable during peak enrollment periods.
   • DA phishing attack targeting faculty email accounts.
   Reveal Solution Discussion Select an answer first