Financial Planning and Budgeting CCISO Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   In a cost-benefit analysis for a security investment, what does the 'benefit' typically represent?

   • AThe time required to implement the solution
   • BThe number of security alerts generated by the solution
   • CThe total cost of the security solution, including maintenance
   • DThe monetary value of avoided losses and reduced risk
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A multinational corporation is deciding how to fund its security program. Business units have different risk profiles and regulatory requirements. The CISO wants to ensure that enterprise-wide security standards are enforced while allowing business units to fund additional local security controls. Which funding model best supports this approach?

   • AA chargeback model where business units pay for all security services based on usage
   • BCentralized funding where the corporate security team controls all security spending
   • CHybrid funding where core security services are centrally funded and business units fund additional local controls
   • DDecentralized funding where each business unit manages its own security budget
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company is planning to implement a new data encryption solution. The CISO needs to estimate the cost. The solution requires purchasing encryption software licenses for 1,000 servers at $200 per server, and hiring a consultant for 200 hours at $150 per hour. Additionally, the internal team will spend 100 hours on implementation at an average cost of $100 per hour. What is the total cost of the project?

   • A$230,000
   • B$250,000
   • C$240,000
   • D$200,000
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   When presenting a security budget request, what is the primary purpose of linking each proposed expenditure to a specific risk or business requirement?

   • ATo satisfy regulatory requirements for budget documentation
   • BTo demonstrate that the spending directly addresses identified risks and supports business objectives
   • CTo make the budget appear larger and more comprehensive
   • DTo ensure that all security projects are funded equally
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A mid-sized company's security budget for the fiscal year is $5 million. At the end of Q2, the CISO reviews the financial report and sees that the security team has already spent $3.2 million, primarily due to an unplanned ransomware incident response and emergency hardware replacements. The original budget anticipated spending $2.5 million by this point. The CISO must present a plan to the CFO to get the budget back on track. What should the CISO do first?

   • ARequest an additional $700,000 from the CFO to cover the overspend.
   • BAnalyze the variance by category, identify the root causes of overspending, and determine which costs were unavoidable versus discretionary.
   • CImmediately halt all non-essential security projects and freeze hiring to prevent further overspending.
   • DBlame the ransomware incident and tell the CFO that the overspend is not the security team's fault.
   Reveal Solution Discussion Select an answer first