Information Security Management Program CCISO Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of continuous monitoring in an information security program?

   • ATo ensure that all employees are working during business hours
   • BTo identify security issues and measure the effectiveness of controls in real time
   • CTo generate reports only for external auditors
   • DTo replace the need for periodic risk assessments
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a key resource that must be managed to sustain an information security program?

   • AOffice furniture
   • BSkilled security personnel
   • CCompany logo
   • DMarketing brochures
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is undergoing a SOC 2 Type II audit. The CISO wants to ensure that the security program can demonstrate effective controls over a period of time. What is the best preparation?

   • ACollect and retain evidence of control operation, such as logs and review records, for the entire audit period.
   • BImplement new security controls immediately before the audit to improve the security posture.
   • CPrepare a policy document that describes all security controls and procedures.
   • DConduct a single penetration test just before the audit to identify vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary objective of a security awareness and training program?

   • ATo replace technical security controls
   • BTo satisfy regulatory requirements only
   • CTo change employee behavior and reduce human-related security risks
   • DTo ensure all employees become security experts
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A CISO at a mid-sized financial services firm has been tracking the number of security incidents per quarter for the past two years. The metric shows a steady decline. The CISO is preparing the annual budget request and wants to demonstrate the value of the security program to the CFO. However, the CISO is concerned that the incident count metric alone is misleading. Which additional metric would provide the MOST balanced view of program effectiveness for the budget discussion?

   • AThe mean time to detect (MTTD) and mean time to respond (MTTR) for security incidents.
   • BThe percentage of critical vulnerabilities remediated within the organization's defined SLA.
   • CA composite risk score that aggregates the organization's top risks and shows the trend of residual risk over time.
   • DThe total number of security awareness training sessions completed by employees.
   Reveal Solution Discussion Select an answer first