Security Strategic Planning CCISO Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary consideration when allocating financial resources to support strategic security objectives?

   • ASpending equally across all security domains
   • BMinimizing the security budget to reduce costs
   • CAligning the budget with the prioritized risks and business goals
   • DAllocating the largest portion to the most visible technology
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A technology company's security strategy was developed two years ago. The threat landscape has shifted significantly with new ransomware tactics, and the company has acquired a smaller firm. The CISO wants to update the strategy. What is the first step in the review process?

   • AReview the existing KPIs to see if targets were met, and adjust them if necessary.
   • BReassess the external environment using PESTLE and update the SWOT analysis to reflect new threats and the acquisition.
   • CImmediately implement new ransomware protections across the acquired company's systems.
   • DConduct a gap analysis between the current strategy and the new acquisition's security posture.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following best describes the role of strategic planning in an organization's security program?

   • AIt is primarily concerned with hiring and training security staff
   • BIt is a one-time exercise to satisfy regulatory compliance
   • CIt provides a framework for making consistent decisions about security investments and priorities over time
   • DIt focuses solely on the selection of security software and hardware
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A bank's risk assessment reveals that the highest risk is insider threats, with a moderate likelihood and high impact. The CISO must decide how to integrate this into the security strategy. What is the most appropriate strategic response?

   • AIncrease the security awareness training budget to reduce accidental insider threats.
   • BAccept the risk because insider threats are difficult to prevent.
   • CPurchase additional cyber insurance to cover potential losses from insider threats.
   • DDevelop a strategic initiative focused on user behavior analytics and enhanced access controls.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A large enterprise is implementing a new security strategy. The CISO has established a steering committee, but the committee is struggling to prioritize initiatives because each business unit has different risk tolerances. What is the best way to resolve this governance challenge?

   • AHave the CISO make all prioritization decisions to ensure consistency.
   • BDevelop a risk appetite statement approved by the board and use it as the basis for prioritization decisions.
   • CPrioritize initiatives based on the highest potential financial impact.
   • DLet each business unit prioritize its own security initiatives based on its local risk assessment.
   Reveal Solution Discussion Select an answer first