Information Security Management Program CCISO Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A manufacturing company has experienced multiple phishing incidents despite annual security awareness training. The CISO wants to improve the program's effectiveness. Which approach best addresses the root cause and aligns with continuous improvement?

   • AImplement a monthly micro-learning campaign with targeted phishing simulations and track metrics to adjust content based on results.
   • BUpdate the security awareness policy to require employees to complete the annual training within 30 days of hire.
   • CReplace the training program with a technical control that blocks all phishing emails at the gateway.
   • DIncrease the frequency of phishing simulations and terminate employees who fail more than once.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   What is the primary goal of integrating risk management into an information security program?

   • ATo transfer all risks to insurance providers
   • BTo eliminate all risks to the organization
   • CTo identify, assess, and prioritize risks so that security efforts focus on the most significant threats
   • DTo document risks for auditors without taking action
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A government contractor is required to comply with CMMC Level 2. The CISO must integrate risk management into the security program to meet these requirements. The organization has a moderate risk appetite and limited resources. What is the most effective approach?

   • AFocus on achieving CMMC certification by documenting compliance without changing existing processes.
   • BAdopt a risk appetite that accepts all risks to avoid the cost of controls.
   • COutsource risk management to a third-party vendor to reduce internal resource burden.
   • DImplement a risk management framework that aligns with CMMC practices and conduct regular risk assessments.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A CISO is updating the organization's acceptable use policy (AUP). The current policy is a 20-page document that is written in dense legal language. A recent internal survey found that only 30% of employees have read the policy, and many do not understand what is allowed. The CISO wants to improve compliance. What is the MOST effective approach to updating the policy?

   • ARewrite the policy in plain language, use a summary format with clear examples of acceptable and unacceptable behavior, and require employees to acknowledge they have read it.
   • BKeep the policy as is, but add a mandatory training course that explains the policy in detail.
   • CShorten the policy to one page, listing only the most critical rules, and remove all other details.
   • DDistribute the policy as a poster in common areas, highlighting the top five rules.
   Reveal Solution Discussion Select an answer first
6. 55foundation · easy

   Which of the following is an example of a security metric used to evaluate program effectiveness?

   • ATotal revenue for the fiscal year
   • BNumber of employees in the company
   • CMean time to detect (MTTD) security incidents
   • DSquare footage of office space
   Reveal Solution Discussion Select an answer first