Financial Planning and Budgeting CCISO Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A multinational corporation has a centralized security team that provides services to all business units. The business units are charged for these services based on a cost allocation model. Recently, some business units have complained that the charges are too high and have threatened to opt out of certain security services to save costs. The CISO is concerned that this could increase overall risk. What is the best approach to address this issue?

   • AEliminate the chargeback model and fund all security centrally without charging business units.
   • BIncrease the charges for security services to cover the costs of those who opt out.
   • CAllow business units to opt out of any security service they feel is too expensive.
   • DImplement a hybrid model where core security services are centrally funded and optional services are offered on a chargeback basis.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A CISO is monitoring the security budget and discovers that the penetration testing line item is underspent by 50% because the planned tests were postponed, while the incident response retainer is overspent by 30% due to a major ransomware incident. The CISO must present a revised forecast to the CFO. Which action is most appropriate?

   • AIgnore the variances because the total budget is still within the annual limit
   • BRequest an increase in the incident response budget and a decrease in the penetration testing budget
   • CReallocate the unused penetration testing funds to cover the incident response overspend
   • DPresent a revised forecast that reflects the postponed tests and the incident response overspend, and propose a plan to reschedule the tests
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of budget monitoring and control in information security management?

   • ATo forecast future budgets based on historical spending
   • BTo create a detailed report for external auditors only
   • CTo track actual expenditures against the budget and take corrective action when variances occur
   • DTo ensure that the security team never exceeds the budget under any circumstances
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A CISO must choose between two security projects: Project A reduces the likelihood of a $5 million breach by 40% and costs $1 million. Project B reduces the likelihood of a $2 million breach by 80% and costs $500,000. Which project offers the higher return on investment (ROI)?

   • AProject A, because it addresses a larger potential loss
   • BProject A, because its expected benefit is $2 million against a $1 million cost
   • CBoth projects have the same ROI because the benefit-to-cost ratio is equal
   • DProject B, because its expected benefit is $1.6 million against a $500,000 cost
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A large enterprise has a decentralized security budget where each business unit funds its own security initiatives. The CISO has noticed that some units are investing heavily in advanced security tools while others are underfunding basic controls. The CISO wants to improve overall security without centralizing all funding. What is the best approach?

   • AAllow business units to continue as they are, but provide guidance on best practices.
   • BCreate a competitive ranking of business units based on their security spending and publish it internally.
   • CEstablish a minimum security baseline that all business units must fund, while allowing them to invest in additional controls as they see fit.
   • DRequire all business units to submit their security budgets for approval by the CISO.
   Reveal Solution Discussion Select an answer first