Security Strategic Planning CCISO Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A CISO needs to present the annual security strategy update to the board. The board is composed of members with varying technical expertise. What is the most effective way to communicate the strategy?

   • AFocus only on recent security incidents and how they were handled.
   • BPresent a detailed technical report of all security controls and configurations.
   • CDistribute a lengthy document and ask the board to read it before the next meeting.
   • DUse business-oriented language, focusing on risk reduction, compliance, and how security enables business objectives, with a few high-level metrics.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company has a security strategy that requires implementing a new SIEM system, hiring two additional analysts, and conducting a security awareness campaign. The budget is sufficient for only two of the three initiatives. The risk assessment shows that the company has a high rate of successful phishing attacks but no current visibility into security events. Which two initiatives should the CISO prioritize?

   • AHire the analysts and run the awareness campaign, because the phishing rate is high and analysts can manually monitor logs.
   • BImplement the SIEM system and hire the analysts, because without visibility, the company cannot detect or respond to incidents effectively.
   • CRun the awareness campaign and defer the other two, because phishing is the highest risk.
   • DImplement the SIEM and run the awareness campaign, because the SIEM can automate detection and training reduces phishing.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An e-commerce company's security strategy includes a goal to reduce the number of account takeover incidents. The CISO needs to measure the effectiveness of the strategy. Which KPI is most directly aligned with this goal?

   • APercentage of users enrolled in multi-factor authentication (MFA).
   • BNumber of account takeover incidents detected per quarter.
   • CNumber of security alerts generated by the SIEM system.
   • DTime spent by security team on incident response.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A CISO is presenting a new security strategy to the board. The strategy includes a major investment in zero-trust architecture, which will require significant changes to how employees access systems. The board is concerned about user productivity and the cost. How should the CISO frame the strategy to gain approval?

   • APromise that zero-trust will eliminate all security risks, justifying the cost.
   • BPresent the strategy as mandatory due to regulatory requirements, even if the board has concerns.
   • CEmphasize the long-term risk reduction and how zero-trust will enable secure remote work, while presenting a phased implementation to manage costs and minimize productivity impact.
   • DFocus on the technical details of zero-trust and why it is superior to the current architecture.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A telecommunications company is planning its security strategy. The company faces intense competition and rapid technological changes, such as 5G and IoT. The CISO wants to understand the external factors that could affect the strategy. Which analysis tool is most appropriate?

   • APESTLE analysis to examine political, economic, social, technological, legal, and environmental factors.
   • BSWOT analysis focusing on the company's internal strengths and weaknesses.
   • CGap analysis comparing current security capabilities to desired future state.
   • DRisk assessment to identify threats and vulnerabilities.
   Reveal Solution Discussion Select an answer first