The Role of the CISO CCISO Practice Questions (Page 12)

Questions 56–60

1. 56application · medium

   A CISO is preparing a quarterly report for the board. The board wants to understand the organization's top security risks and the effectiveness of the security program. What is the most appropriate content for the report?

   • AA copy of the latest penetration test report.
   • BA summary of key risk indicators, trends in security metrics, and progress on strategic security initiatives.
   • CA list of all security incidents that occurred during the quarter, including technical details.
   • DA detailed budget report showing all security expenditures.
   Reveal Solution Discussion Select an answer first
2. 57expert · hard

   A CISO is reviewing the security operations center (SOC) capabilities. The SOC is understaffed and relies on manual processes, leading to delayed detection and response. The CISO must improve the SOC's effectiveness without significantly increasing the budget. What is the most appropriate action?

   • AHire more SOC analysts to handle the workload.
   • BReduce the scope of monitoring to focus only on critical assets.
   • CImplement a security orchestration, automation, and response (SOAR) platform to automate repetitive tasks and improve response times.
   • DOutsource the SOC to a managed security service provider (MSSP).
   Reveal Solution Discussion Select an answer first
4. 58expert · hard

   A CISO at a healthcare organization must decide whether to accept the risk of a legacy patient portal that cannot be patched due to vendor end-of-life. The portal is required for regulatory compliance and is heavily used by patients. The CISO has presented the risk to the executive committee, which is divided: the CFO wants to keep the portal running to avoid revenue loss, while the Chief Medical Officer wants it shut down due to patient data exposure. What is the CISO's most appropriate action?

   • ARecommend compensating controls, such as network segmentation and enhanced monitoring, and present a formal risk acceptance request to the board with residual risk clearly stated.
   • BOutsource the portal management to a third-party vendor to transfer the risk.
   • CImmediately shut down the portal to eliminate the risk, regardless of business impact.
   • DAccept the risk on behalf of the organization and document the decision in the risk register.
   Reveal Solution Discussion Select an answer first
5. 59foundation · easy

   What is the CISO's responsibility regarding the security budget?

   • ATo minimize the budget to reduce costs regardless of risk
   • BTo spend the entire budget on the latest technology
   • CTo allocate resources based on risk priorities and business needs
   • DTo delegate budget decisions entirely to the finance department
   Reveal Solution Discussion Select an answer first
6. 60application · medium

   A CISO needs to present the annual security posture to the board of directors. The board is composed of non-technical members who are primarily concerned with business risk and financial impact. What is the most effective way for the CISO to communicate the security posture?

   • AProvide a detailed technical report of all vulnerabilities and threat intelligence feeds.
   • BPresent a high-level dashboard showing key risk indicators, trends, and alignment with business objectives, using business language.
   • CShare the full incident response playbook to demonstrate preparedness.
   • DFocus only on compliance status to reassure the board that the company is meeting regulatory requirements.
   Reveal Solution Discussion Select an answer first