Information Security Projects CCISO Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is an example of a stakeholder in an information security project?

   • AThe organization's legal counsel
   • BThe security operations center's monitoring dashboard
   • CThe project management software
   • DThe firewall configuration file
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of change management in an information security project?

   • ATo handle changes to scope, schedule, and resources in a controlled manner
   • BTo prevent any changes from occurring during the project
   • CTo document changes only after the project is completed
   • DTo automatically approve all change requests
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a vulnerability management project, a critical zero-day vulnerability is discovered in a third-party application that is part of the project's scope. The vendor has not yet released a patch. The project manager must decide how to proceed. What is the BEST risk mitigation approach?

   • AReplace the third-party application with a different product immediately, regardless of cost.
   • BStop the project entirely until the vendor releases a patch, to avoid any risk.
   • CImplement compensating controls, such as network segmentation or enhanced monitoring, while tracking the vendor's patch release.
   • DIgnore the vulnerability because it is the vendor's responsibility to fix it.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security project to implement a new SIEM system has a goal to reduce the mean time to detect (MTTD) security incidents. The project manager needs to define KPIs to measure the project's success. Which KPI is MOST appropriate for this project?

   • APercentage reduction in MTTD compared to the baseline measured before the SIEM implementation.
   • BNumber of SIEM alerts generated per day.
   • CNumber of training sessions completed by the security team on the new SIEM.
   • DTotal cost of the SIEM implementation compared to the budget.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A manufacturing company's CISO is proposing a project to implement network segmentation to protect intellectual property. The board of directors is concerned about the cost and potential disruption to production. How should the CISO align this project with organizational governance to gain board approval?

   • APropose the project as a compliance requirement, even if no specific regulation mandates network segmentation.
   • BPresent a business case that links the project to the strategic objective of protecting intellectual property and reducing the risk of data breaches.
   • CRequest approval without detailing the implementation plan, to avoid raising concerns about production disruption.
   • DEmphasize that the project is a technical requirement and the board should approve it without questioning the cost.
   Reveal Solution Discussion Select an answer first