Defining an Information Security Governance Program CCISO Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm must demonstrate to regulators that its security investments are aligned with business objectives and that control decisions are traceable to enterprise goals. The firm already uses ISO 27001 for its management system. Which framework should the CISO add to best satisfy the regulatory expectation?

   • ACOBIT, because it links IT and security goals to enterprise goals and provides a governance framework for control objectives.
   • BCIS Controls, because it prioritizes a small set of high-impact security actions.
   • CISO 27002, because it offers implementation guidance for the ISO 27001 controls.
   • DNIST SP 800-53, because it provides a comprehensive catalog of security controls for federal systems.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's strategic goal is to become the most trusted online retailer in its market. The CISO must align the security governance program with this goal. Which initiative best supports this alignment?

   • AFocus security efforts only on preventing denial-of-service attacks to ensure website availability.
   • BImplement a customer data protection program that exceeds regulatory requirements and is marketed as a competitive differentiator.
   • CReduce the security budget to lower product prices and attract more customers.
   • DOutsource all security operations to a third party to reduce internal overhead.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A hospital system's board wants to see whether the security program is actually reducing patient-data breach risk. The CISO has been reporting the number of phishing simulations completed and the percentage of employees who passed. Which additional metric would best demonstrate a governance outcome?

   • ATime to detect and contain a simulated ransomware event compared to the previous quarter.
   • BTotal budget spent on security tools versus the approved budget.
   • CNumber of security awareness training sessions delivered each month.
   • DPercentage of servers with the latest operating system patches applied.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which framework is specifically designed for IT governance and provides a comprehensive set of controls mapped to business objectives?

   • ATOGAF
   • BCOBIT
   • CISO/IEC 27001
   • DNIST Cybersecurity Framework
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the role of oversight mechanisms in an information security governance program?

   • ATo automate all security controls
   • BTo ensure that security activities are monitored and reviewed for effectiveness
   • CTo provide a backup for security systems
   • DTo replace the need for security policies
   Reveal Solution Discussion Select an answer first