Information Security Management Program CCISO Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A newly appointed CISO discovers that the information security program lacks clear governance and that incident response decisions are made ad hoc. What should the CISO do to establish effective governance?

   • ADevelop a detailed incident response plan and train the team on it.
   • BImplement a new incident response tool to automate decision-making.
   • CDelegate all security decisions to the IT department to streamline operations.
   • DCreate a security steering committee with representatives from business units to oversee the program and approve major decisions.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a common risk response option in an information security program?

   • ADeferral to the next fiscal year
   • BMitigation
   • CElimination of all risks
   • DIgnoring
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A global company is subject to GDPR and CCPA. The CISO is updating the information security program to ensure compliance with both regulations. The company operates in multiple jurisdictions with different requirements. What is the most effective approach?

   • ADevelop separate compliance programs for each regulation to ensure precise adherence.
   • BImplement a single set of privacy controls that satisfies the strictest requirements of both regulations.
   • CFocus on GDPR compliance because it is more comprehensive than CCPA.
   • DOutsource compliance to a third-party vendor to handle all regulatory requirements.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A multinational corporation is preparing for a combined audit against ISO 27001 and SOC 2 Type II. The internal audit team has identified a gap: the organization's access review process is documented in a procedure, but there is no formal policy that mandates the frequency and scope of access reviews. The CISO must address this gap before the external audit. The organization has a decentralized IT structure where business units manage their own access. What is the MOST appropriate action?

   • ADevelop a high-level access control policy that defines the requirements for periodic access reviews, and then map the existing procedure to that policy, identifying any gaps.
   • BUpdate the existing procedure to include a reference to the ISO 27001 and SOC 2 requirements and note that access reviews are performed quarterly.
   • CDelegate the responsibility for access review policies to each business unit, since they are best positioned to understand their own access requirements.
   • DCreate a new policy that mandates quarterly access reviews for all systems and requires business units to report compliance to the CISO.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A healthcare organization has a mature incident response plan, but during a recent ransomware incident, the IT team discovered that the plan did not address the use of shadow IT applications. The CISO must update the program to better handle such incidents. The organization has a low risk appetite and strict regulatory requirements. What is the most effective improvement?

   • AIntegrate shadow IT discovery into the risk management process and update the incident response plan to include playbooks for unauthorized applications.
   • BProvide additional training to the incident response team on the dangers of shadow IT.
   • CAdd a requirement for the incident response team to inventory all shadow IT applications during the containment phase.
   • DDisable all shadow IT applications immediately and require employees to use only approved software.
   Reveal Solution Discussion Select an answer first