Information Security Management Program CCISO Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A mid-sized e-commerce company has a limited security budget. The CISO must decide how to allocate funds for the next fiscal year. The company is expanding into a new market with stricter data protection regulations. The current security program lacks a formal risk assessment process. Which allocation best balances regulatory compliance and risk management?

   • AInvest in a new SIEM tool to improve threat detection and response capabilities.
   • BHire a compliance officer to manage regulatory requirements and conduct audits.
   • CFund a comprehensive risk assessment and develop a roadmap to address identified gaps, including compliance requirements.
   • DIncrease the security awareness training budget to reduce human error.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial services firm is preparing for an external audit against ISO 27001. The CISO wants to ensure the information security management program demonstrates compliance and supports the audit. What should the CISO prioritize?

   • AIncrease the security awareness training frequency to satisfy the auditor's expectations.
   • BEnsure that all security policies and procedures are documented and that evidence of their implementation is readily available.
   • CPurchase cyber insurance to cover potential audit findings.
   • DConduct a penetration test to identify vulnerabilities and fix them before the audit.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary reason for aligning the information security program with business objectives?

   • ATo ensure security investments directly support the organization's mission and risk appetite
   • BTo satisfy the requirements of external auditors before considering business needs
   • CTo eliminate all risks that could affect business processes
   • DTo make the security team the primary decision-maker for all business operations
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which governance structure is commonly used to provide cross-functional oversight and guidance for an information security program?

   • ASecurity Steering Committee
   • BHuman Resources Department
   • CNetwork Operations Center (NOC)
   • DIncident Response Team
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A regional bank is launching a new mobile payment product that will process transactions in three new countries. The CISO must update the information security program to support this expansion. The bank's risk appetite statement explicitly states that it will accept moderate residual risk for revenue-generating initiatives but will not accept regulatory sanctions in any jurisdiction. The security team has identified that one of the three countries has no data breach notification law, while the other two have strict 72-hour notification requirements. The CISO has a fixed budget for the fiscal year. What should the CISO do FIRST?

   • ADefer the product launch in the country with no breach notification law until a local legal opinion confirms the regulatory environment.
   • BConduct a formal risk assessment for the new product in each country, mapping regulatory requirements to the bank's risk appetite, then prioritize controls based on the assessed risk.
   • CImplement a single global security standard that meets the strictest notification requirement across all three countries.
   • DAllocate the entire remaining security budget to build a 24/7 incident response team capable of meeting the 72-hour notification requirement in all jurisdictions.
   Reveal Solution Discussion Select an answer first