Financial Planning and Budgeting CCISO Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A CISO is reviewing the monthly financial report for the security department. The report shows that the department is underspending in the 'training' category by 40% and overspending in the 'incident response' category by 25%. What should the CISO do?

   • ATransfer the unused training funds to the incident response category to cover the overspend.
   • BInvestigate the causes of both variances and determine if the underspending in training is due to delayed programs or if the overspending in incident response is due to an unusual event.
   • CReduce the incident response budget for the next month to force the team to be more efficient.
   • DIgnore the variances because they may balance out by the end of the year.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A global manufacturing company has business units in three regions, each with its own IT and security teams. The corporate CISO is responsible for overall security strategy, but each regional unit has historically managed its own security budget. A recent audit found that security controls are inconsistent across regions, and some units are underfunding critical areas. The CISO wants to improve consistency while respecting regional autonomy. Which funding model would best achieve this balance?

   • AHybrid model: corporate funds mandatory baseline controls centrally, while regions fund additional local initiatives.
   • BChargeback model: corporate provides security services and charges each region based on usage.
   • CCentralized model: all security funding is managed and allocated by the corporate CISO.
   • DDecentralized model: each region continues to fund its own security, but with mandatory reporting to corporate.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When projecting future security funding needs, why is it important to consider planned business growth?

   • ABusiness growth only affects marketing budgets, not security
   • BBusiness growth always reduces the need for security investment
   • CBusiness growth has no impact on security funding requirements
   • DBusiness growth can expand the attack surface and require additional security resources
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A regional bank is preparing its annual security budget. The CISO must align the budget with the bank's strategic goal of expanding digital banking services while maintaining regulatory compliance. The CFO has asked for a budget that clearly links each security initiative to a business objective. Which budgeting approach best satisfies this requirement?

   • AZero-based budgeting where every security activity must be justified from scratch each cycle
   • BTop-down budgeting where senior management sets a spending cap and the security team allocates within it
   • CActivity-based budgeting that assigns costs to specific security activities aligned with strategic goals
   • DIncremental budgeting based on last year's figures plus a fixed percentage for inflation
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A logistics company is considering implementing a new security awareness training program. The CISO needs to estimate the cost of the program. The training vendor charges $50 per employee per year. The company has 2,000 employees. Additionally, the security team estimates that employees will spend an average of 2 hours per year on training, and the average hourly cost of an employee is $30. What is the total annual cost of the training program?

   • A$160,000
   • B$100,000
   • C$220,000
   • D$120,000
   Reveal Solution Discussion Select an answer first