Information Security Management Program CCISO Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A multinational corporation is updating its information security policies to align with new data protection regulations in several countries. The CISO wants to ensure the policies are effective and enforceable. What is the best approach?

   • ADelegate policy development entirely to each regional office to ensure local compliance.
   • BCreate a single global policy that applies uniformly to all regions to ensure consistency.
   • CAdopt the strictest regional regulation as the global standard to ensure compliance everywhere.
   • DDevelop a global policy framework with regional addenda that address specific legal and regulatory requirements.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A CISO is reporting to the board of directors on the state of the information security program. The board is concerned about a recent high-profile data breach in the industry and wants assurance that the company is protected. The CISO has limited time in the meeting. Which type of information would be MOST valuable to present to the board?

   • AA demonstration of the latest security awareness training module, showing the board what employees are learning.
   • BA summary of the organization's top risks, the current risk posture, and the trend over time, expressed in business terms.
   • CA comparison of the company's security spending to industry benchmarks, showing that the company spends more than its peers.
   • DA detailed list of all security controls implemented in the past year, including firewall rules and patch levels.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A CISO wants to demonstrate the value of the information security program to the board. Which metric would be most meaningful to present?

   • AThe total number of security incidents reported in the last quarter.
   • BThe number of employees who completed security awareness training.
   • CThe percentage of critical vulnerabilities remediated within the defined SLA.
   • DThe number of security policies that have been updated this year.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A hospital is updating its incident response plan to comply with HIPAA. The plan must ensure timely reporting of breaches and effective coordination between IT, legal, and public relations. What is the most critical element to include?

   • AA clear escalation path that defines roles, responsibilities, and notification timelines for each stakeholder.
   • BA list of approved security vendors to contact during an incident.
   • CA policy that all incidents must be reported to the board within 24 hours.
   • DA detailed technical playbook for containing ransomware attacks.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A newly appointed CISO at a mid-sized retail company is reviewing the existing information security program. The CISO finds that the company has a comprehensive set of security policies, but they are not consistently enforced across different departments. Some departments have their own local procedures that contradict the corporate policy. The CISO wants to establish a more effective program. What is the MOST important initial action?

   • AConduct a gap analysis to identify discrepancies between the corporate policies and local procedures.
   • BTerminate any employee who does not follow the corporate policy, to send a strong message.
   • CRewrite all corporate policies to be more flexible and accommodate the different departmental procedures.
   • DEstablish a security governance committee with representatives from each department to oversee policy enforcement and resolve conflicts.
   Reveal Solution Discussion Select an answer first