Financial Planning and Budgeting CCISO Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A government agency's CISO is planning the security budget for the next fiscal year. The agency expects a 15% increase in its network infrastructure and new compliance requirements from a recent executive order. The CISO must project the additional funding needed. Which approach is most appropriate?

   • ACalculate the cost of securing the additional infrastructure and meeting the new compliance requirements
   • BApply a flat 10% increase to the current security budget
   • CRequest a budget equal to the average of the last three years' budgets
   • DUse the previous year's budget without adjustment
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of a corrective action that a security manager might take when actual expenditures exceed the budget?

   • APostponing a non-critical security project until the next budget cycle
   • BIgnoring the variance and hoping it will resolve itself
   • CIncreasing the budget without executive approval
   • DImmediately canceling all security training programs
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the context of information security management, what is the primary purpose of a budget?

   • ATo guarantee that security incidents will not cause financial loss
   • BTo record historical expenditures for audit and compliance purposes
   • CTo replace the need for risk assessments by setting fixed spending limits
   • DTo allocate financial resources to planned security activities and initiatives
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A CISO is evaluating two security investments: a new vulnerability management platform and an enhanced phishing simulation program. The vulnerability platform costs $200,000 and is expected to reduce the likelihood of a $2 million breach by 30%. The phishing program costs $50,000 and is expected to reduce the likelihood of a $500,000 breach by 60%. Which investment has the higher benefit-to-cost ratio?

   • ABoth have the same benefit-to-cost ratio
   • BThe vulnerability platform, because its benefit-to-cost ratio is 3.0
   • CThe phishing program, because its benefit-to-cost ratio is 6.0
   • DThe vulnerability platform, because it addresses a larger potential loss
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A retail company is planning to deploy a new identity and access management (IAM) system. The CISO needs to estimate the cost of the project, but the requirements are not fully defined and there is significant uncertainty. Which cost estimation technique is most appropriate to account for this uncertainty?

   • AThree-point estimation using optimistic, pessimistic, and most likely cost figures
   • BBottom-up estimation after fully defining all requirements
   • CParametric estimation based on the number of employees
   • DAnalogous estimation using the cost of a similar IAM project from another company
   Reveal Solution Discussion Select an answer first