Financial Planning and Budgeting CCISO Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In a centralized funding model for information security, where does the security budget reside?

   • AEach business unit manages its own security budget independently
   • BThe budget is funded entirely by external grants
   • CThe budget is shared equally among all business units
   • DA single central security department or function
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   During the information security budget development process, what is the purpose of aligning the budget with the organization's strategic plan?

   • ATo ensure that security investments support business objectives and are more likely to receive approval
   • BTo eliminate the need for a separate risk assessment process
   • CTo guarantee that the security budget will be identical to the previous year's budget
   • DTo ensure that all security spending is allocated to hardware purchases
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A manufacturing company is evaluating a new endpoint detection and response (EDR) solution. The CISO needs to estimate the total cost of ownership (TCO) for a three-year period. The vendor's quote includes per-device licensing, but the CISO must also account for internal staff time to deploy and manage the solution. Which cost estimation technique is most appropriate for this scenario?

   • ABottom-up estimation that itemizes all labor, technology, and operational expenses for the project
   • BParametric estimation using a cost per endpoint multiplied by the number of endpoints
   • CThree-point estimation that averages optimistic, pessimistic, and most likely costs
   • DAnalogous estimation based on a similar EDR deployment at a peer company
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A healthcare organization is preparing its security budget for the next three years. The compliance team has informed the CISO that new data privacy regulations will take effect in 18 months, requiring enhanced encryption and access controls. Additionally, the organization plans to expand its telehealth services, which will increase the attack surface. The CISO needs to project future security funding needs. What should the CISO do?

   • ADevelop a multi-year financial forecast that includes the cost of regulatory compliance, business growth, and anticipated threat landscape changes.
   • BWait until the regulations are finalized and the telehealth service is launched before estimating costs.
   • CRequest a one-time budget increase for the current year to cover the new regulations and telehealth expansion.
   • DUse last year's budget as a baseline and add a 5% inflation factor for the next three years.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A CISO is reviewing the monthly budget report and finds that the security awareness training program is underspent by 40% while the incident response retainer is overspent by 25%. The CISO must decide how to handle these variances. Which action is most appropriate?

   • AIgnore the variances because the total budget is still on track
   • BImmediately cancel the incident response retainer to prevent further overspend
   • CInvestigate the reasons for both variances and adjust future spending plans accordingly
   • DTransfer the unused training funds to cover the incident response overspend
   Reveal Solution Discussion Select an answer first