Defining an Information Security Governance Program CCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A mid-sized retail company has just hired its first CISO. The CISO discovers that the IT director approves security budgets, sets security policy, and personally reviews all security incidents. The board has never seen a security report. Which change best aligns with the distinction between governance and management?

   • AOutsource security management to a managed security service provider and have the IT director oversee the contract.
   • BHave the CISO report directly to the IT director and delegate all security decisions to the IT team to streamline operations.
   • CCreate a security committee of IT staff to review incidents and approve budgets, with the CISO as a voting member.
   • DMove budget approval and policy ratification to the board, while the CISO directs day-to-day security operations and incident response.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A CISO wants to measure the effectiveness of the security governance program. The board has asked for a single metric that reflects whether the program is reducing the organization's overall risk exposure over time. Which metric is most suitable?

   • AThe percentage of employees who completed security awareness training.
   • BThe total number of security incidents reported in the last year.
   • CThe number of security policies that have been approved by the board.
   • DA composite risk score based on the aggregation of key risk indicators across critical business processes.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which practice best demonstrates alignment of security governance with business strategy?

   • AImplementing all security controls recommended by vendors
   • BPrioritizing security projects solely based on technical impact
   • CConducting security risk assessments before launching new business initiatives
   • DKeeping security plans confidential from business units
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does information security governance align with business strategy?

   • ABy ensuring that security decisions consider business objectives and risk tolerance
   • BBy focusing only on compliance requirements
   • CBy making security the top priority regardless of cost
   • DBy isolating security from business operations to avoid interference
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare organization is building its information security governance program from scratch. The CISO wants to ensure that the program includes the essential components to provide direction, enforce accountability, and enable continuous improvement. Which set of components is most complete?

   • AA security awareness training calendar and phishing simulation results
   • BA list of security vendors and their service-level agreements
   • CPolicies, standards, procedures, risk management processes, and oversight mechanisms such as steering committees and audits
   • DFirewalls, intrusion detection systems, and endpoint protection tools
   Reveal Solution Discussion Select an answer first