The Role of the CISO CCISO Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key stakeholder communication responsibility of the CISO?

   • ACommunicating only with the IT department
   • BProviding regular security posture reports to executive leadership
   • CKeeping security vulnerabilities secret from the board to avoid concern
   • DAvoiding communication with external auditors
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the CISO's primary role in enterprise risk management?

   • ATo accept all risks without review to speed up operations
   • BTo eliminate all risks to the organization
   • CTo transfer all risks to insurance without further analysis
   • DTo lead the risk assessment process and recommend mitigation strategies
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a significant security incident, the CISO wants to ensure that the organization learns from the experience and improves its security posture. What should the CISO do to drive continuous improvement?

   • AReplace the entire security team to prevent future incidents.
   • BIssue a public statement apologizing for the incident and promise that it will not happen again.
   • CIncrease the security budget to purchase more advanced tools.
   • DConduct a post-incident review to identify lessons learned and update the incident response plan and security controls accordingly.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A CISO is managing third-party risk for a company that uses multiple SaaS applications. The company's data is stored in various cloud environments, and the CISO is concerned about the security of data shared with vendors. What is the most appropriate action to manage this risk?

   • AConduct regular security assessments of all third-party vendors and require them to comply with the organization's security standards.
   • BStop using SaaS applications and move all data to an on-premises data center.
   • CRely on the vendors' security certifications as proof of adequate security.
   • DPurchase cyber insurance to cover any losses from third-party breaches.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail chain's CISO notices that employees frequently fall for phishing simulations, and the company is about to launch a new online payment feature. The CISO wants to reduce human-related risk. Which initiative would be most effective in fostering a security-aware culture?

   • AIncrease the spam filter strength to block more phishing emails.
   • BPublish a monthly newsletter with security tips.
   • CMandate a one-time annual security training video for all employees.
   • DImplement a continuous awareness program with regular phishing simulations, feedback, and short training modules.
   Reveal Solution Discussion Select an answer first