Security Strategic Planning CCISO Practice Questions (Page 11)

Questions 51–53

1. 51application · medium

   A healthcare organization has implemented a new security strategy focused on reducing data breaches. The CISO needs to report progress to the board quarterly. Which KPI would best demonstrate the effectiveness of the strategy in reducing breach risk?

   • ATotal IT budget spent on security tools.
   • BNumber of security awareness training sessions completed.
   • CPercentage of critical systems patched within the defined SLA.
   • DNumber of security policies updated this quarter.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A healthcare organization is developing a three-year security strategy. A recent enterprise risk assessment identified that a ransomware attack on the electronic health record (EHR) system would have a high likelihood and a very high financial impact, while a breach of the employee self-service portal was assessed as low likelihood and low impact. The CISO must allocate a limited budget across multiple initiatives. Which approach aligns resource allocation with the risk assessment?

   • AAllocate the budget equally across all systems to ensure no area is neglected.
   • BFund the self-service portal first because it is easier to secure and will show quick wins to the board.
   • CPrioritize funding for enhanced endpoint detection and offline backups for the EHR system, while deferring major investments in the self-service portal.
   • DDelay all investments until a new risk assessment is completed next year.
   Reveal Solution Discussion Select an answer first
3. 53foundation · easy

   Which component of a security strategy translates the high-level vision into actionable, measurable outcomes?

   • AIncident response plan
   • BObjectives
   • CMission statement
   • DBudget allocation
   Reveal Solution Discussion Select an answer first