Implementing Control Assurance Frameworks CCISO Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A technology company has implemented the CIS Controls and wants to assess the effectiveness of its controls. The CISO must decide between using internal staff or hiring an external assessor. The company has a limited budget but needs an objective assessment. Which approach best balances cost and objectivity?

   • AUse a combination of internal staff and external assessors for all controls.
   • BHire an external assessor to ensure complete independence.
   • CUse internal staff who are familiar with the systems but have them assess areas outside their daily responsibilities.
   • DHave each system owner assess their own controls to save time.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An organization operates in a highly regulated industry and must demonstrate compliance to customers and auditors. Which framework selection criterion is most directly aligned with this need?

   • AThe framework's ability to provide auditable evidence of control implementation
   • BThe framework's compatibility with the CISO's preferred reporting format
   • CThe framework's use of the latest marketing terminology
   • DThe framework's focus on cutting-edge technologies only
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company has implemented a control assurance framework and wants to ensure that the controls adapt to changing business and threat environments. The CISO is designing a continuous improvement process. Which element is essential for this process?

   • AOnly make changes when a major incident occurs.
   • BRegularly review and update the risk assessment to reflect changes in the business and threat landscape.
   • CFreeze the control set to maintain stability and avoid introducing new risks.
   • DOutsource all monitoring to a third party without internal review.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of a control assurance framework in information security management?

   • ATo automatically enforce all security policies without human intervention
   • BTo guarantee that an organization will never experience a security breach
   • CTo replace the need for internal audits and independent assessments
   • DTo provide a structured set of controls and practices that help an organization manage and demonstrate the effectiveness of its security posture
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An organization is implementing the NIST Cybersecurity Framework and has limited staff. The CISO must decide how to allocate resources between implementing new controls and improving existing ones. What is the best strategy?

   • APrioritize high-impact controls that address the most significant risks and improve existing controls that are deficient.
   • BAllocate resources equally across all controls to ensure balanced coverage.
   • CFocus only on existing controls and do not implement any new controls.
   • DImplement all new controls first and defer improvements to existing controls.
   Reveal Solution Discussion Select an answer first