The Role of the CISO CCISO Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A CISO needs to present a business case for additional security funding to the CFO. The CFO is focused on cost reduction and ROI. Which approach is most likely to gain approval?

   • ARequest the funding without providing detailed justification.
   • BEmphasize the technical sophistication of the proposed security tools.
   • CQuantify the potential financial impact of a security breach and compare it to the cost of the proposed investment.
   • DState that the funding is necessary to maintain industry certifications.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A software company's CISO is informed that a new data protection regulation will take effect in six months. The regulation affects how customer data is stored and processed. The CISO must ensure the company complies. What should the CISO do first?

   • AWait until the regulation takes effect and then address any gaps.
   • BPurchase a compliance automation tool and assume it will ensure compliance.
   • CInstruct the legal team to handle all compliance activities independently.
   • DConvene a cross-functional team including legal, IT, and business units to assess the regulation's impact and develop a compliance roadmap.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   During a major ransomware incident, the CISO is receiving conflicting information from the SOC manager, the legal counsel, and the public relations team. The SOC manager wants to immediately isolate all systems to stop the spread, but legal counsel is concerned about preserving evidence for potential litigation, and PR wants to issue a public statement as soon as possible. What should the CISO do to lead the incident response effectively?

   • AActivate the incident response plan, establish a unified command structure, and make decisions based on a balanced assessment of containment, evidence preservation, and communication needs.
   • BInstruct PR to issue a statement immediately to maintain public trust, while continuing to investigate.
   • CDelegate the decision to the legal counsel to ensure evidence preservation.
   • DFollow the SOC manager's recommendation to isolate systems immediately, as containment is the top priority.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A hospital's CISO is evaluating a new cloud-based patient portal vendor. The vendor offers a lower price than competitors but has limited security certifications and is located in a country with different data protection laws. The hospital needs to launch the portal quickly. What should the CISO do?

   • AReject the vendor solely because it lacks certifications.
   • BAsk the vendor to sign a liability waiver and proceed.
   • CApprove the vendor because the price is significantly lower and the hospital can accept some risk.
   • DConduct a detailed third-party risk assessment, including security certifications, data residency, and contractual protections, before making a decision.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How does the CISO drive continuous improvement of the security program?

   • ABy keeping the same security measures to avoid change
   • BBy focusing only on new technologies without evaluation
   • CBy relying solely on external audits without internal review
   • DBy using metrics and audits to identify areas for enhancement
   Reveal Solution Discussion Select an answer first