2.04 Explain the Justification for a Proposed Solution 401 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security architect must present a justification for a new security solution to two different audiences: the executive team and the IT operations team. The executive team is concerned about cost and compliance, while the IT operations team is concerned about complexity and operational impact. How should the architect tailor the presentation?

   • APresent the same information to both audiences, focusing on the technical details.
   • BPresent the technical details to the executive team and the business case to the IT operations team.
   • CPresent a high-level business case to the executive team and a detailed technical plan to the IT operations team.
   • DPresent only the benefits of the solution to both audiences, avoiding any discussion of costs or complexity.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial services company must justify a new web application firewall (WAF) deployment to its board. The company processes credit card transactions and must comply with PCI DSS. The CISO wants to present a justification that resonates with the board. Which justification component should be the primary focus?

   • AThe WAF is the industry standard for web application security and is recommended by leading security analysts.
   • BThe WAF will reduce the risk of a data breach and help maintain PCI DSS compliance, protecting the company from fines and reputational damage.
   • CThe WAF will provide detailed logging and reporting features that enhance the security team's visibility into web traffic.
   • DThe WAF will automatically block all malicious traffic, eliminating the need for manual security monitoring.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a risk assessment, what does the 'impact' of a risk refer to?

   • AThe cost of mitigating the risk
   • BThe likelihood that the risk will occur
   • CThe number of vulnerabilities in the system
   • DThe potential damage or loss if the risk occurs
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is evaluating two security solutions: Solution A has a lower upfront cost but higher ongoing maintenance expenses, while Solution B has a higher upfront cost but lower ongoing expenses. The company expects to use the solution for at least five years. Which factor should be the primary consideration in the cost-benefit analysis?

   • AThe initial purchase price only, as it is the most immediate cost.
   • BThe ease of deployment, as a faster deployment will save time and money.
   • CThe total cost of ownership (TCO) over the expected five-year lifespan.
   • DThe vendor's reputation and market share.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company must choose between two security solutions. Solution A has a lower upfront cost but requires hiring two additional security analysts to manage it. Solution B has a higher upfront cost but can be managed by the existing team. The company has a limited budget for new hires. Which solution should the company choose, and why?

   • ASolution B, because it is always better to have a more expensive solution that requires less staff.
   • BSolution A, because the lower upfront cost is more important than the ongoing staffing cost.
   • CSolution A, because it is easier to justify a lower upfront cost to management.
   • DSolution B, because the higher upfront cost is justified by avoiding the need for additional staff.
   Reveal Solution Discussion Select an answer first