The Role of the CISO CCISO Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A CISO is establishing a security governance structure for a company that is about to undergo a regulatory audit. The company has many security policies, but they are outdated and not consistently enforced. What should the CISO do to prepare for the audit and improve governance?

   • AFocus on technical controls and ignore policy updates because the audit will focus on technical security.
   • BUpdate the security policies to align with current regulations and ensure they are communicated and enforced across the organization.
   • CHire a compliance consultant to handle the audit and policy updates.
   • DWait until the audit findings are released and then address the issues.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A multinational retailer's CISO is reviewing a risk assessment for a new customer loyalty program that will store personal data in a region with less mature privacy regulations. The business wants to launch quickly, but legal counsel warns of potential regulatory exposure. The CISO must decide how to present the risk to the executive committee. What is the most appropriate action?

   • AReject the program outright because the data residency risk is unacceptable.
   • BImplement the program without changes and document the risk in the annual report.
   • CApprove the program but require additional security controls and present the residual risk to the executive committee for formal acceptance.
   • DDefer the decision until legal counsel can guarantee no regulatory action will occur.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   In the context of risk management, what does 'risk acceptance' mean?

   • AThe organization eliminates the risk entirely
   • BThe organization acknowledges the risk and decides to tolerate it without additional mitigation
   • CThe organization transfers the risk to a third party
   • DThe organization ignores the risk and hopes it does not occur
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   How should the CISO communicate security risks to the board of directors?

   • AOnly when a major breach occurs
   • BIn business language focusing on potential impact to the organization
   • CThrough informal channels without documentation
   • DIn technical terms with detailed exploit code
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A large e-commerce company's CISO is reviewing the incident response plan after a recent ransomware attack that encrypted critical databases. The attack was contained, but the recovery took longer than expected because backup restoration procedures were unclear. The CISO wants to improve the plan for future incidents. Which improvement should the CISO prioritize?

   • AConduct a tabletop exercise focused on backup restoration and decision-making during an incident.
   • BIncrease the frequency of vulnerability scans on all internet-facing systems.
   • CReplace the backup vendor with a more expensive solution.
   • DAdd more security analysts to the incident response team.
   Reveal Solution Discussion Select an answer first