Security Strategic Planning CCISO Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A logistics company is planning to expand into a new international market. The CISO is asked to ensure that security initiatives support this business goal. Which action best aligns security strategy with the organizational goal of market expansion?

   • AAsk the legal department to handle all security compliance for the new market without involving the security team.
   • BFocus security resources on protecting the existing market and treat the new market as a separate low-priority project.
   • CIncorporate the expansion into the security strategy by assessing the new market's regulatory requirements and including them in the risk assessment.
   • DKeep the security strategy unchanged because it is already comprehensive and applies globally.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's business strategy is to become the lowest-cost provider in its industry. The CISO is asked to develop a security strategy that supports this business goal. Which approach best aligns security with the cost-leadership strategy?

   • AAlign security with the industry average spending to avoid standing out.
   • BFocus security investments on preventing high-impact incidents that could cause financial losses, while using cost-effective controls like automation and shared services.
   • CImplement the most comprehensive security controls available, regardless of cost, to ensure maximum protection.
   • DMinimize security spending to the lowest possible level to reduce costs.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In strategic security planning, what is the primary purpose of integrating risk management?

   • ATo ensure that security investments are aligned with the organization's risk appetite
   • BTo eliminate all risks to the organization
   • CTo transfer all risks to insurance providers
   • DTo document risks for regulatory compliance only
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A CISO has developed a new security strategy that requires significant changes to network architecture and additional staffing. The CEO is supportive but the CFO is concerned about the budget impact, and the head of engineering worries about project delays. What is the most effective way to gain buy-in from these stakeholders?

   • APresent the strategy in terms of business risk reduction, with a phased budget plan and a clear timeline that minimizes disruption to engineering projects.
   • BImplement the strategy immediately and report results after the first year.
   • CSend a detailed technical document to each stakeholder explaining the security architecture changes.
   • DAnnounce the strategy at a company-wide meeting and ask for feedback via email.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A manufacturing company is updating its security strategy. A recent risk assessment identified that a legacy industrial control system (ICS) has a high likelihood of being compromised, with a potential impact of $5 million per incident. The cost to replace the ICS is $8 million. The CISO must decide how to reflect this in the strategic plan. What is the most appropriate strategic action?

   • APrioritize compensating controls and monitoring for the ICS while planning a multi-year replacement roadmap.
   • BTransfer the risk by purchasing cyber insurance to cover the full $5 million impact.
   • CAccept the risk because the replacement cost is higher than the potential impact.
   • DImmediately allocate the $8 million to replace the ICS in the next fiscal year.
   Reveal Solution Discussion Select an answer first