Security Strategic Planning CCISO Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A hospital system is developing a security strategy. The risk assessment shows that a ransomware attack on the patient portal would have a high impact but low likelihood, while a data breach of the research database would have a moderate impact but high likelihood. The budget is limited. The CISO must decide where to invest. Which decision best reflects a risk-based approach?

   • AInvest only in the research database because its likelihood is higher.
   • BInvest in both, but allocate more to the research database because its higher likelihood increases overall risk exposure.
   • CInvest only in the patient portal because its impact is higher.
   • DSplit the budget equally because both are important.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A mid-sized financial services firm is implementing a new security strategy. The CISO has secured budget and executive sponsorship. Which governance structure would best ensure the strategy is implemented effectively and remains aligned with business objectives?

   • ADelegate all implementation decisions to the IT security team to maintain speed and technical consistency.
   • BCreate a project management office (PMO) solely focused on tracking milestones and reporting to the CISO.
   • CRely on the existing IT change advisory board (CAB) to oversee all security changes.
   • DEstablish a security steering committee with representatives from IT, legal, compliance, and business units, meeting quarterly.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which of the following is a common method for reviewing and updating a security strategy?

   • AKeeping the strategy static to ensure stability
   • BWaiting for a major security breach before making any changes
   • COnly updating the strategy when new technology is released
   • DConducting periodic strategy reviews and incorporating lessons learned from incidents and audits
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A financial institution's security strategy is reviewed annually. This year, the review reveals that the company's KPIs are being met, but a major breach occurred at a competitor using a similar attack vector. The CISO suspects the strategy may have a blind spot. What is the most appropriate action?

   • AIncrease the frequency of KPI reporting to monthly to catch issues sooner.
   • BImmediately implement all controls used by the competitor to prevent the same attack.
   • CConduct a focused environmental analysis to identify emerging threats and update the strategy accordingly.
   • DAssume the competitor's breach was due to their own weaknesses and take no action.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A company's security strategy includes a goal to reduce the number of successful phishing attacks. After a year, the KPI shows that the phishing success rate has dropped from 15% to 10%, but the target was 5%. What should the CISO do next?

   • AAccept the 10% rate because it is an improvement from the previous year.
   • BStop measuring phishing success because the rate is already below the industry average.
   • CChange the KPI target to 10% to make the result look successful.
   • DAnalyze the reasons for the shortfall, adjust the training and technical controls, and update the strategy if needed.
   Reveal Solution Discussion Select an answer first