Information Security Management Program CCISO Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A CISO is evaluating the effectiveness of the information security program. The organization has a low risk appetite and is subject to strict regulations. Which combination of metrics would provide the most comprehensive view of program effectiveness?

   • APercentage of critical risks mitigated, compliance audit pass rate, and mean time to detect and respond to incidents.
   • BNumber of security incidents and average time to resolve them.
   • CPercentage of employees who completed training and results of phishing simulations.
   • DPercentage of systems with up-to-date patches and number of vulnerabilities identified.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A CISO is reviewing the incident response plan after a near-miss incident. During the incident, the IT team detected the breach, but the communication to the executive team was delayed by 6 hours because the incident commander was unsure who had the authority to declare a crisis. The plan is detailed but does not clearly define the decision-making authority for declaring a major incident. The CISO wants to prevent this from happening again. What is the MOST important improvement to make?

   • AAdd a section to the incident response plan that defines the incident commander role and their authority to declare a major incident and activate the crisis management team.
   • BConduct more frequent tabletop exercises to practice the incident response plan.
   • CPurchase an automated incident notification tool that can send alerts to the executive team immediately upon detection.
   • DRequire the IT director to be the sole authority for declaring a major incident, regardless of the situation.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A healthcare organization is merging with another hospital network. The combined entity will have two different security operations centers (SOCs) with different incident response playbooks, tooling, and escalation paths. The CISO has been asked to unify the incident management capability within 90 days. The organization must maintain compliance with HIPAA breach notification rules throughout the transition. The two SOCs currently have no shared ticketing system and use different severity rating scales. What is the MOST critical first step for the CISO to take?

   • ASelect a single commercial SIEM platform and migrate both SOCs to it immediately to ensure all events are visible in one place.
   • BEstablish a joint incident response governance board with representatives from both SOCs to define a unified severity scale and escalation matrix.
   • CImmediately integrate the two ticketing systems using a middleware tool so that incidents are automatically synchronized between the SOCs.
   • DMandate that the larger SOC's playbooks and procedures be adopted by the smaller SOC to minimize the number of changes needed.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   After a security incident, a CISO conducts a post-incident review. The review reveals that the incident response team did not have access to the latest threat intelligence. What should the CISO do to improve future response?

   • AIntegrate threat intelligence feeds into the incident response process and ensure the team is trained to use them.
   • BPurchase additional security tools to automate threat detection.
   • CDocument the incident and move on to other priorities.
   • DIncrease the frequency of incident response training.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   In the governance structure of an information security management program, which role typically has ultimate accountability for the program's success?

   • AInternal Audit Team
   • BBoard of Directors or Executive Management
   • CIT Security Analysts
   • DChief Information Security Officer (CISO)
   Reveal Solution Discussion Select an answer first