Security Strategic Planning CCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company has approved a security strategy that includes migrating all on-premises systems to a cloud provider. The CISO must implement the strategy while ensuring that the migration does not disrupt business operations. Which implementation approach best balances speed and risk?

   • AOutsource the migration to a third-party vendor and rely entirely on their expertise.
   • BMigrate only the most critical systems first, leaving less critical systems on-premises indefinitely.
   • CUse a phased migration approach, starting with low-risk systems, and establish a rollback plan for each phase.
   • DMigrate all systems at once to complete the strategy quickly.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A CISO has implemented a security strategy with several KPIs. The board wants to see a single metric that summarizes the overall effectiveness of the security program. Which KPI would be most appropriate for this purpose?

   • AThe number of security incidents reported in the last quarter.
   • BThe percentage of employees who completed security awareness training.
   • CThe total cost of security incidents as a percentage of revenue.
   • DA composite risk score that aggregates the likelihood and impact of top risks across the organization.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A government agency's CISO has developed a security strategy that requires a cultural shift toward security awareness. The agency's leadership is risk-averse and resistant to change. What is the most effective communication strategy to gain buy-in?

   • AFrame the strategy as a way to protect the agency's mission and public trust, using real-world scenarios relevant to the agency's work.
   • BRequest a small pilot in one department and report results to leadership.
   • CPresent a detailed technical roadmap with specific security controls and architectures.
   • DEmphasize the legal consequences of non-compliance with federal security mandates.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why is continuous improvement important for a security strategy?

   • ABecause it eliminates the need for risk assessments
   • BBecause threats and business needs change over time, requiring the strategy to adapt
   • CBecause regulatory requirements never change
   • DBecause a security strategy is only valid for one year
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A regional bank is developing its three-year security strategy. The board has expressed concern about new data protection regulations in several countries where the bank operates, while the marketing department is pushing for a customer-facing mobile app that will collect personal data. The CISO wants to ensure the strategy accounts for both external pressures and internal opportunities. Which approach best aligns the strategy with these considerations?

   • AFocus exclusively on the regulatory requirements and design the strategy to achieve full compliance in all operating countries.
   • BPerform a SWOT analysis that lists the regulations as threats and the mobile app as a strength, then proceed to implementation.
   • CConduct a PESTLE analysis to identify regulatory and technological factors, then incorporate the mobile app as a strategic opportunity in the SWOT.
   • DAsk the board to approve a risk assessment first, and defer strategic planning until the risk register is complete.
   Reveal Solution Discussion Select an answer first