Information Security Management Program CCISO Practice Questions (Page 12)

Questions 56–58

1. 56application · medium

   A retail company is developing its first information security management program. The CISO wants to ensure the program is comprehensive and aligned with the business. What should be the first step?

   • ADefine the program's scope, objectives, and components based on business goals and risk appetite.
   • BConduct a security awareness campaign to establish a security culture.
   • CPurchase and deploy a suite of security tools to protect the environment.
   • DHire additional security staff to manage the program.
   Reveal Solution Discussion Select an answer first
2. 57expert · hard

   A CISO is preparing the annual budget for the information security program. The organization has experienced a 40% increase in ransomware attempts in the past year, but no successful infections. The board has asked the CISO to justify the current budget and propose changes. The CISO has identified two potential investments: (1) an upgraded endpoint detection and response (EDR) solution and (2) an expanded 24/7 security operations center (SOC) staffing. The budget is limited, and the CISO can only fund one of these initiatives fully. Which factor should MOST heavily influence the decision?

   • AThe organization's current mean time to detect (MTTD) and mean time to respond (MTTR) for security incidents.
   • BThe cost of the two solutions, with the cheaper option being selected to stay within budget.
   • CThe preference of the SOC manager, who believes the current EDR is adequate.
   • DThe number of security alerts generated per day, with the goal of reducing alert fatigue.
   Reveal Solution Discussion Select an answer first
3. 58application · medium

   A CISO is defining the scope of the information security management program for a newly acquired subsidiary. The subsidiary has its own IT infrastructure and a small security team. The parent company has a mature security program with established policies and standards. The subsidiary handles data that is subject to different regulations than the parent company. What is the MOST important consideration when defining the program's scope?

   • AThe subsidiary's security program should be managed entirely by the parent company's security team, since they have more experience.
   • BThe scope should be defined based on the subsidiary's regulatory requirements, business processes, and the data it handles, while aligning with the parent company's overall framework where possible.
   • CThe scope should include all of the subsidiary's systems and data, regardless of the regulatory differences.
   • DThe subsidiary should adopt the parent company's policies and standards without modification to ensure consistency.
   Reveal Solution Discussion Select an answer first