Information Security Management Program CCISO Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which of the following is a typical phase in the incident response lifecycle?

   • AProcurement
   • BMarketing
   • CAuditing
   • DPreparation
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A CISO is building the business case for a new security operations center (SOC). The organization currently has no dedicated security monitoring and relies on the IT helpdesk to handle security alerts. The CISO must justify the investment to the CFO. Which approach would be MOST effective in gaining CFO approval?

   • APresent a detailed technical proposal of the SIEM platform, including the number of events per second it can process.
   • BEmphasize that the SOC is a best practice and that most competitors have one.
   • CQuantify the potential financial impact of a security breach and compare it to the cost of the SOC, showing the expected return on investment.
   • DRequest a small pilot SOC first, to demonstrate its value before committing to a full implementation.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A CISO is reviewing the results of a recent risk assessment. The assessment identified a high-risk vulnerability in a legacy system that is critical to operations. The cost to remediate is high, and the system cannot be taken offline easily. What is the most appropriate risk treatment option?

   • ATransfer the risk by purchasing cyber insurance.
   • BImplement compensating controls to reduce the likelihood of exploitation while the system is in operation.
   • CAccept the risk and document the decision with a rationale from senior management.
   • DImmediately shut down the system to eliminate the risk.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following best describes how regulatory requirements should be incorporated into an information security program?

   • AThey should be ignored unless the organization is audited
   • BThey should be applied only to customer data, not internal data
   • CThey should be considered alongside business objectives and risk appetite to define security requirements
   • DThey should be treated as the sole driver of all security decisions
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A regional bank is launching a new mobile payment service that will process cardholder data. The CISO must ensure the security program supports this business initiative while meeting PCI DSS requirements. The bank's risk appetite is moderate, and the board has approved a budget for the initiative. What should the CISO do FIRST?

   • AImmediately implement network segmentation to isolate the payment processing environment from the rest of the bank's network.
   • BConduct a business impact analysis to identify critical assets and recovery priorities for the new service.
   • CPerform a risk assessment of the new service and map the identified risks to existing security policies and PCI DSS controls.
   • DDraft a new information security policy specifically for mobile payment services and obtain board approval.
   Reveal Solution Discussion Select an answer first