Defining an Information Security Governance Program CCISO Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A CISO is designing the governance program for a multinational corporation. The program must ensure that security decisions are made consistently across all business units and that there is a clear escalation path for risk decisions. Which component is essential to achieve this?

   • AA governance committee with representation from business units, legal, and IT that meets regularly to review risk and approve policies.
   • BA comprehensive set of security awareness posters displayed in all offices.
   • CA policy that each business unit can create its own security rules as needed.
   • DA security operations center that monitors all network traffic 24/7.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary role of ISO/IEC 27001 in an information security governance program?

   • AIt defines a maturity model for IT governance processes
   • BIt provides a set of voluntary cybersecurity guidelines for critical infrastructure
   • CIt provides a framework for establishing, implementing, maintaining, and continually improving an information security management system (ISMS)
   • DIt specifies technical requirements for encryption algorithms
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary role of the board of directors in information security governance?

   • ATo implement daily security monitoring and incident response
   • BTo conduct penetration tests on the organization's network
   • CTo provide strategic oversight and ensure security risks are managed in line with business objectives
   • DTo configure firewalls and intrusion detection systems
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A government contractor must comply with FedRAMP requirements for a cloud service. The CISO wants to adopt a framework that will directly support the FedRAMP authorization process. Which framework is most appropriate?

   • ANIST SP 800-53, because FedRAMP is based on NIST control baselines.
   • BISO 27001, because it is an international standard for information security management.
   • CCOBIT, because it focuses on IT governance and enterprise alignment.
   • DCIS Controls, because they provide prioritized security actions.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A CISO is frustrated that the board only reviews security metrics annually and often questions the relevance of the data. The CISO wants to improve board engagement. Which change is most likely to increase the board's understanding and support?

   • AAsk the board to approve a new security tool purchase to show progress.
   • BSend the board a monthly report containing all security incidents and their technical details.
   • CAlign security metrics with business risk and present them quarterly in a concise dashboard.
   • DWait for the annual report and include more charts and graphs.
   Reveal Solution Discussion Select an answer first