Financial Planning and Budgeting CCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A global financial services firm is planning its security budget for the next three years. The CISO anticipates new data privacy regulations in several countries, an increase in ransomware attacks, and a planned 20% growth in the company's cloud infrastructure. Which forecasting approach best supports the budget planning?

   • AUse a single best-guess estimate based on the most likely regulatory outcome
   • BExtrapolate this year's budget by the projected inflation rate
   • CBase the forecast solely on the historical average of security spending increases
   • DDevelop multiple scenarios based on different regulatory, threat, and growth assumptions
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A CISO is creating the annual security budget and needs to include a reserve for unexpected security incidents and emergency response. The organization's leadership wants to ensure that the budget is flexible enough to handle unforeseen events. Which budget type should the CISO include?

   • AA zero-based budget that requires justification for every expense
   • BA contingency budget specifically for unplanned security incidents
   • CAn incremental budget based on last year's spending
   • DA capital budget for long-term investments
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A CISO at a multinational corporation is forecasting security funding for the next three years. The company plans to acquire a smaller firm in a region with strict data sovereignty laws. The CISO must also account for a predicted increase in ransomware attacks and the need to upgrade legacy systems. The CFO wants a forecast that is defensible and flexible. Which approach is most appropriate?

   • AUse a single forecast based on the most likely acquisition scenario
   • BUse a top-down budget cap and allocate within it
   • CDevelop a range of scenarios that vary the acquisition outcome, threat level, and upgrade timing
   • DBase the forecast on the historical average of security spending increases
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A manufacturing company's CISO is developing the security budget for the upcoming fiscal year. The company's strategic goals include expanding into new international markets and implementing Industry 4.0 technologies. The CISO has gathered input from various department heads and has identified several security initiatives. What should the CISO do to ensure the budget is aligned with organizational goals?

   • APrioritize initiatives that directly support the company's strategic goals, such as securing the new international operations and IIoT devices.
   • BBase the budget solely on the previous year's spending plus an inflation adjustment.
   • CAllocate the budget equally across all departments to ensure fairness.
   • DFocus only on compliance requirements to avoid regulatory penalties.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A regional bank's CISO must justify a new endpoint detection and response (EDR) platform to the CFO. The CFO asks, 'Why should we spend $2 million on this when we already have antivirus?' The CISO has data showing that the current antivirus blocks 60% of malware, while the proposed EDR would block 95% and reduce the average incident response time from 14 days to 2 days. The bank's average cost of a successful malware incident is $1.5 million, and they experience about 10 such incidents per year. Which approach best strengthens the budget justification?

   • AExplain that antivirus is obsolete and that the bank is exposed to advanced threats that only EDR can detect.
   • BPresent a cost-benefit analysis showing the reduction in expected annual losses from malware incidents compared to the EDR investment.
   • CProvide a list of all the features and technical specifications of the EDR platform.
   • DEmphasize that EDR is the industry standard and that competitors are already using it.
   Reveal Solution Discussion Select an answer first