Defining an Information Security Governance Program CCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A CISO is explaining to a new board member the difference between information security governance and information security management. Which analogy best illustrates the difference?

   • AGovernance is buying the car; management is selling the car.
   • BGovernance is fixing the engine; management is choosing the color of the car.
   • CGovernance is the driver; management is the passenger.
   • DGovernance is deciding the destination and route; management is driving the car and handling road conditions.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is adopting ISO 27001 and needs to establish the components of its information security governance program. Which combination of components is essential for a governance program?

   • AEncryption, multi-factor authentication, and access control lists.
   • BFirewalls, antivirus software, and intrusion prevention systems.
   • CPenetration testing, vulnerability scanning, and red team exercises.
   • DPolicies, procedures, and an oversight committee that reviews security performance.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A large enterprise is restructuring its security governance. The CISO reports to the CIO, and the board has expressed concern that security is not receiving sufficient executive attention. The CISO wants to elevate the security function's influence. Which action is most likely to improve governance effectiveness?

   • AOutsource the CISO role to a consulting firm to gain an external perspective.
   • BHave the CISO report to the chief financial officer (CFO) to emphasize the financial impact of security.
   • CEstablish a board-level risk committee with the CISO as a standing member or presenter, and define a direct reporting line for security risk to the board.
   • DKeep the current reporting line but increase the frequency of security status reports to the CIO.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the key difference between information security governance and information security management?

   • AGovernance focuses on external threats; management focuses on internal threats
   • BGovernance is a one-time project; management is an ongoing process
   • CGovernance is only for executives; management is only for IT staff
   • DGovernance is about setting direction and oversight; management is about implementing and operating controls
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is considering adopting a governance framework. The CISO notes that the company has a mature risk management process but lacks a clear link between security controls and business objectives. The board wants a framework that will strengthen governance without disrupting existing risk processes. Which framework should the CISO recommend?

   • ACIS Controls, because they are simple to implement and prioritize technical actions.
   • BISO 27001, because it is a certifiable management standard that will replace the current risk process.
   • CNIST Cybersecurity Framework, because it focuses on operational resilience and incident response.
   • DCOBIT, because it provides a governance framework that aligns IT and security with business goals while complementing existing risk processes.
   Reveal Solution Discussion Select an answer first