Security Strategic Planning CCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A university is developing a security strategy with a limited budget. The risk assessment shows that the highest risks are phishing attacks targeting students and faculty, and unpatched vulnerabilities in research systems. The CISO must allocate resources. Which allocation best addresses the identified risks?

   • AAllocate most of the budget to a new next-generation firewall at the network perimeter.
   • BInvest in email filtering and security awareness training, and allocate remaining funds to patch management for research systems.
   • CPurchase an advanced endpoint detection and response (EDR) platform for all devices.
   • DHire additional security analysts to monitor alerts around the clock.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A new CISO at a university is tasked with developing a security strategy. The university values academic freedom and open access to research data, but also must protect student records and research intellectual property. The CISO needs to define the vision and mission of the security strategy. Which statement best reflects a balanced vision?

   • ATo ensure that all research data is publicly available to anyone.
   • BTo focus solely on compliance with student data protection laws.
   • CTo create a locked-down environment that prioritizes security over all other considerations.
   • DTo enable the university's academic mission by protecting information assets while fostering an open and collaborative research environment.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A manufacturing company has implemented a new security strategy focused on reducing operational technology (OT) downtime from cyber incidents. The CISO needs to report progress to the board quarterly. Which KPI would most directly measure the success of this strategy?

   • APercentage of OT devices with antivirus software installed.
   • BTotal IT security budget spent as a percentage of revenue.
   • CMean time to recover (MTTR) from OT-related security incidents.
   • DNumber of security awareness training sessions completed per quarter.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A hospital system is developing a security strategy. The risk assessment shows that ransomware attacks on medical devices could cause patient harm and operational disruption. The board has approved a budget that is insufficient to fully mitigate all risks. The CISO must decide how to allocate the budget. Which approach best balances risk reduction and resource constraints?

   • AInvest in a state-of-the-art security operations center (SOC) to improve detection and response.
   • BSpend the budget on comprehensive cyber insurance to transfer all financial risk.
   • CPrioritize controls that reduce the likelihood of ransomware on medical devices, such as network segmentation and endpoint protection, and defer non-critical projects.
   • DAllocate the budget evenly across all identified risks to ensure fair coverage.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A multinational corporation is revising its security strategy. The company operates in regions with varying data protection laws, and a recent geopolitical event has increased the risk of state-sponsored cyber attacks. The CISO must decide how to incorporate these factors. Which approach is most comprehensive?

   • ARely on the legal department's compliance matrix to define the security strategy's requirements.
   • BUse PESTLE to analyze political, legal, and technological factors, then integrate the findings into a risk assessment that informs the strategy.
   • CConduct a SWOT analysis focusing on the company's strengths in security and the threat of state-sponsored attacks.
   • DDefer strategy changes until the geopolitical situation stabilizes.
   Reveal Solution Discussion Select an answer first