Defining an Information Security Governance Program CCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A CISO must report to the board on the effectiveness of the security governance program. Which reporting approach is most likely to be understood and valued by the board?

   • AProvide a detailed list of every security incident and the time taken to resolve each one.
   • BReport the number of security policies updated this quarter.
   • CPresent a dashboard showing key risk indicators and progress against strategic security objectives.
   • DShare the raw output of the latest vulnerability scan for the board's review.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A logistics company's business strategy emphasizes rapid expansion into new markets. The CISO wants to align the security program with this strategy. Which initiative best supports the business goal?

   • AIncrease the frequency of internal phishing simulations to quarterly.
   • BFreeze all security changes until the current compliance audit is complete.
   • CImplement a security review process that can assess new market entries within two weeks.
   • DPurchase a new SIEM platform to improve log analysis.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A startup has a small security team and wants to build a governance program without over-engineering. They have a business continuity plan and an incident response plan. Which additional component is most essential to complete a basic governance framework?

   • AA security operations center to monitor alerts 24/7.
   • BA vulnerability scanner to automate patch management.
   • CA data loss prevention system to monitor employee email.
   • DA security policy that states management's intent and assigns accountability.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A CISO must report to the board on the effectiveness of the security governance program. The board wants to see whether the program is achieving its strategic objectives, such as reducing risk to an acceptable level and improving compliance. Which metric set is most appropriate for this report?

   • ATotal number of security policies and the number of pages in each policy.
   • BNumber of security staff certifications and the annual training budget.
   • CNumber of security alerts generated per day and the average time to close each alert.
   • DKey risk indicators (KRIs) such as percentage of critical systems with known unpatched vulnerabilities, and key performance indicators (KPIs) such as percentage of security projects completed on time.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A CISO is developing a security governance dashboard for the board. The board has asked for a single metric that best reflects the overall health of the governance program. Which metric is most appropriate?

   • ANumber of security incidents that occurred in the last quarter.
   • BAverage time to patch critical vulnerabilities.
   • CPercentage of critical business processes that have an up-to-date risk assessment and approved risk treatment plan.
   • DTotal number of security policies that have been published.
   Reveal Solution Discussion Select an answer first