Information Security Management Program CCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A CISO must present a budget request to the board. The company has a high risk appetite and is focused on rapid growth. The CISO wants to justify the security budget. Which justification is most likely to resonate with the board?

   • AEmphasize that security investments reduce the likelihood of regulatory fines and reputational damage.
   • BPresent a detailed technical roadmap of security tools and their features.
   • CRequest the same budget as the previous year with an adjustment for inflation.
   • DFrame security as an enabler of business growth by protecting customer trust and enabling secure innovation.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of a security awareness activity?

   • AInstalling antivirus software on all workstations
   • BSending monthly phishing simulation emails to employees
   • CConducting a penetration test on the network
   • DUpdating firewall rules
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A CISO at a university is developing a new information security strategy. The university has a strong culture of academic freedom and open access to information. Faculty members frequently need to collaborate with external researchers and share data. The university also has a significant research portfolio that includes sensitive data subject to government regulations. The CISO must balance the need for security with the university's mission. Which approach best aligns the security program with the university's objectives?

   • ADefer to the faculty's judgment on data sharing, since they are the experts in their fields and know what needs protection.
   • BImplement a strict data classification policy that restricts access to all research data, requiring approval for any external sharing.
   • CCreate a policy that requires all external collaborations to be reviewed by the legal department, adding a layer of bureaucracy to all research activities.
   • DDevelop a risk-based data classification framework that identifies which research data is truly sensitive and applies controls only to that data, while allowing open sharing for non-sensitive data.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a typical component of an information security management program?

   • ANetwork cabling, server racks, and cooling systems
   • BSecurity policies, risk management, incident response, and security awareness training
   • CHardware procurement, office layout, and employee performance reviews
   • DMarketing campaigns, sales quotas, and customer satisfaction surveys
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A software development company is adopting a DevOps model and wants to integrate security into its CI/CD pipeline. The CISO has a limited security team and cannot assign a security engineer to every development team. The company's risk appetite is moderate, and it accepts that some vulnerabilities will reach production but wants to avoid critical vulnerabilities. Which approach best aligns the security program with this business model?

   • AProvide security awareness training to all developers and rely on them to write secure code, with no additional technical controls.
   • BRequire a manual security review by the central security team before every production release.
   • CDeploy automated security scanning tools (SAST, DAST, dependency scanning) into the CI/CD pipeline and configure them to fail the build on critical vulnerabilities only.
   • DEstablish a security champion program where one developer from each team is trained to perform security reviews, and require their sign-off before release.
   Reveal Solution Discussion Select an answer first