The Role of the CISO CCISO Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A CISO at a retail company is asked to support the launch of a new e-commerce platform. The platform will collect customer payment data and must be launched within three months. The CISO must ensure that security is integrated without delaying the launch. The development team wants to use agile methods and deploy frequently. What is the CISO's best approach?

   • ARequire a full security review and penetration test before any code is deployed, even if it delays the launch.
   • BEmbed security into the agile development process by conducting threat modeling, security reviews, and automated security testing in each sprint.
   • COutsource the security testing to a third-party vendor to save time.
   • DLaunch the platform first and address security issues after the initial release to meet the deadline.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A CISO is preparing the annual security budget. The organization's revenue is declining, and the CFO has asked all departments to reduce costs. The CISO must maintain an effective security program with a reduced budget. What is the most appropriate approach?

   • ADelay all non-essential security projects until the next fiscal year.
   • BPrioritize security investments based on a risk assessment and focus on the most critical controls.
   • CCut the security awareness training program because it is not directly tied to revenue.
   • DReduce the security team's headcount to meet the budget target.
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   Which activity is part of the CISO's role in vendor risk management?

   • AProviding the vendor with unrestricted access to the network
   • BInstalling the vendor's software on company servers
   • CNegotiating the price of the vendor contract
   • DReviewing the security practices of a new cloud service provider
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A CISO at a financial institution is reviewing the organization's compliance with a new data protection regulation. The regulation requires that personal data be processed securely and that breaches be reported within 72 hours. The organization currently has no formal breach notification procedure. What should the CISO do to ensure compliance?

   • ADevelop and implement a breach notification procedure that includes roles, responsibilities, and escalation paths to meet the 72-hour requirement.
   • BOutsource breach notification to a third-party service provider.
   • CRely on the existing incident response plan to handle breach notifications.
   • DWait for the regulatory authority to provide guidance on breach notification.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A CISO is developing the organization's incident response plan. The plan must ensure that the organization can respond effectively to a variety of incidents, including data breaches, ransomware, and insider threats. What is the most important element for the CISO to include in the plan?

   • AA clear chain of command and defined roles for all stakeholders, including legal, PR, and executive leadership.
   • BA list of all potential threats and vulnerabilities.
   • CDetailed technical procedures for each type of incident.
   • DA communication template for notifying customers and regulators.
   Reveal Solution Discussion Select an answer first