Security Strategic Planning CCISO Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a key factor in determining the allocation of human resources to support a security strategy?

   • AThe number of security tools in use
   • BThe size of the IT department
   • CThe skills and expertise required to address the prioritized security risks
   • DThe location of the organization's headquarters
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational corporation is developing a security strategy. The CISO must consider that the company operates in countries with conflicting data privacy laws: one requires data to stay within its borders, while another mandates that data be accessible to local authorities. The company also has a strong internal culture of data sharing. Which approach best reconciles these competing constraints?

   • ARely on the legal department to resolve all conflicts before the security strategy is developed.
   • BPrioritize the data residency requirement of the stricter country and ignore the other country's access mandate.
   • CConduct a detailed PESTLE analysis to map legal and political factors, then design a federated data architecture that complies with local laws while enabling controlled sharing.
   • DAdopt a single global data policy that applies uniformly to all countries to simplify compliance.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A mid-sized company has a security budget that is 20% lower than the CISO requested. The risk assessment shows that the highest risk is a data breach from unpatched internet-facing systems, while the lowest risk is physical theft of laptops. The CISO must allocate the reduced budget. Which allocation best aligns with the risk assessment?

   • AInvest in laptop tracking software because it is cheaper and easier to implement.
   • BCut the budget for security awareness training because it is not directly linked to the risk assessment.
   • CFund a vulnerability management program and patch automation for internet-facing systems, and reduce spending on laptop tracking software.
   • DSpend the budget equally on all security initiatives to maintain balance.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security strategy has been in place for three years. The threat landscape has changed significantly, and the company has acquired a new subsidiary. The CISO must update the strategy. What is the most effective approach?

   • AKeep the existing strategy and create a separate strategy for the subsidiary.
   • BUpdate the strategy by adding the new subsidiary's systems to the existing documentation without other changes.
   • CWait for the next annual review cycle to update the strategy.
   • DConduct a comprehensive review that includes a new environmental analysis, risk assessment, and stakeholder input, then revise the strategy accordingly.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does risk assessment inform strategic security planning?

   • AIt focuses only on compliance requirements
   • BIt identifies and prioritizes risks that the security strategy must address
   • CIt replaces the need for a security strategy
   • DIt is used only after a security incident occurs
   Reveal Solution Discussion Select an answer first