Defining an Information Security Governance Program CCISO Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A CISO at a financial firm is asked to present a business case for a new security initiative. The board is skeptical because past initiatives did not clearly tie to business outcomes. What should the CISO do to gain board approval?

   • ACompare the initiative to what competitors are doing in the same industry.
   • BEmphasize the technical sophistication of the new solution and its advanced features.
   • CFrame the initiative in terms of reduced risk to critical business processes and potential revenue loss avoided.
   • DPromise that the initiative will eliminate all security risks.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is implementing a new governance program. The CISO must decide how to structure policies and standards to ensure they are enforceable and aligned with business operations. The company has a diverse set of business units with different risk profiles. Which approach is most effective?

   • ACreate policies only for high-risk business units and leave others without formal policies.
   • BCreate enterprise-level policies that set minimum requirements, and allow business units to develop more restrictive standards where needed.
   • CDevelop a single set of detailed standards that all business units must follow exactly.
   • DLet each business unit create its own policies without central coordination.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is establishing its security governance structure. The CISO has been asked to define the roles of the board, executive management, and the CISO. Which statement correctly distinguishes these roles?

   • AThe CISO sets the risk appetite; the board implements it; executive management manages the security program.
   • BThe board sets risk appetite and oversees strategy; executive management implements the strategy; the CISO manages the day-to-day security program.
   • CExecutive management sets risk appetite; the board implements the strategy; the CISO manages the program.
   • DThe board manages the security program; the CISO oversees the strategy; executive management sets risk appetite.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which outcome indicates that an information security governance program is effective?

   • AThe security budget is the largest in the industry
   • BAll security controls are automated
   • CSecurity risks are managed to an acceptable level while enabling business objectives
   • DThe organization has no security breaches
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the purpose of security metrics in a governance program?

   • ATo guarantee that no security incidents will occur
   • BTo replace the need for security audits
   • CTo satisfy all regulatory requirements automatically
   • DTo provide quantitative data for measuring the effectiveness of security controls and processes
   Reveal Solution Discussion Select an answer first