The Role of the CISO CCISO Practice Questions (Page 13)

Questions 61–62

1. 61expert · hard

   A CISO is evaluating a new vendor that will process sensitive customer data. The vendor is a startup with innovative technology but has not yet achieved a widely recognized security certification. The business team is eager to work with the vendor due to its unique capabilities. The CISO must balance innovation with risk. What is the most appropriate action?

   • AReject the vendor outright because it lacks a recognized security certification.
   • BAsk the vendor to obtain a certification before any work begins.
   • CConduct a third-party risk assessment, including review of the vendor's security controls, and require contractual security commitments and a remediation plan before approval.
   • DApprove the vendor because the business team has vetted its technical capabilities.
   Reveal Solution Discussion Select an answer first
2. 62application · medium

   A CISO wants to foster a security-aware culture in an organization where employees view security as an obstacle to productivity. The CISO has limited budget and needs to increase employee engagement. What should the CISO do FIRST?

   • AMandate annual security training for all employees and enforce penalties for non-compliance.
   • BFocus on technical controls to reduce the impact of human error.
   • CPurchase a new security awareness training platform with advanced phishing simulations.
   • DLaunch a security awareness campaign that includes regular communication, gamified training, and leadership endorsement.
   Reveal Solution Discussion Select an answer first