Information Security Management Program CCISO Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of compliance management within an information security program?

   • ATo ensure the organization meets applicable legal, regulatory, and contractual requirements
   • BTo reduce the number of security policies
   • CTo eliminate the need for internal audits
   • DTo increase the organization's market share
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A CISO at a manufacturing company is integrating risk management into the security program. The company has a legacy OT (operational technology) environment that controls the production line. A recent risk assessment identified a critical vulnerability in the OT environment that could allow an attacker to stop production. The vendor has released a patch, but applying it requires a production shutdown that would cost an estimated $2 million in lost revenue. The company's risk appetite statement says it will accept risks that cost less than $1 million to mitigate. What is the MOST appropriate decision for the CISO to recommend?

   • ARecommend that the company accept the risk and take no action, since the vulnerability is in the OT environment and is unlikely to be exploited.
   • BApply the patch immediately, regardless of the cost, because the vulnerability is critical.
   • CImplement compensating controls (e.g., network segmentation, enhanced monitoring) to reduce the likelihood of exploitation, and defer the patch to the next scheduled maintenance window.
   • DDo not apply the patch and accept the risk, since the cost of mitigation exceeds the risk appetite threshold.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A CISO is reviewing the security metrics for the past year. The metrics show that the number of security incidents has decreased by 20%, but the average cost per incident has increased by 35%. The CISO needs to present this data to the board. Which interpretation of this data is MOST accurate?

   • AThe security program is becoming less effective because the cost per incident is rising.
   • BThe security program is becoming more effective because fewer incidents are occurring.
   • CThe total cost of incidents may be higher or lower than last year, and the CISO needs to calculate the total cost of risk (frequency × cost) to understand the true trend.
   • DThe increase in cost per incident is likely due to better detection and reporting of incidents, so the program is actually more effective.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturing company has a security policy that requires all employees to use multi-factor authentication (MFA) for remote access. During a quarterly metrics review, the CISO discovers that the MFA adoption rate is 62% among the sales team, who frequently work from customer sites. The sales director argues that MFA adds friction and slows down client presentations. The CISO needs to improve compliance without damaging the sales team's productivity. Which approach best balances security requirements with business needs?

   • ARevise the policy to exempt the sales team from MFA when they are at customer sites, since the business impact is significant.
   • BEscalate the non-compliance to the CEO and request a mandate that all sales employees must use MFA or face disciplinary action.
   • CIncrease the frequency of security awareness training for the sales team, emphasizing the importance of MFA, and set a 30-day deadline for compliance.
   • DEngage the sales team to understand their workflow, then pilot a more user-friendly MFA method (e.g., biometric or push-based) that meets the same security objective.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A global logistics company has a high rate of phishing incidents. The CISO wants to launch a new security awareness program. The company has a diverse workforce: office-based staff, warehouse workers who do not use email, and long-haul truck drivers who use a mobile app for deliveries. The CISO has a limited budget and must show measurable improvement within six months. What is the MOST effective initial approach?

   • ASegment the workforce by role and communication channel, then deliver tailored awareness content (e.g., email-based modules for office staff, posters and briefings for warehouse staff, and mobile-app-based modules for drivers).
   • BFocus all resources on technical controls like email filtering and endpoint protection, since awareness training has been shown to have limited long-term impact.
   • CConduct a phishing simulation campaign targeting all employees who have email, and provide targeted micro-training to those who fall for the simulation.
   • DDeploy a mandatory computer-based training module for all employees and track completion rates.
   Reveal Solution Discussion Select an answer first