Cybersecurity Governance CCOA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does a formal reporting structure contribute to accountability in cybersecurity?

   • AIt defines who is responsible for reporting security status and incidents, making it clear who is answerable for communication and outcomes.
   • BIt allows security teams to keep information confidential to avoid scrutiny.
   • CIt removes the need for individual accountability by distributing responsibility across the team.
   • DIt ensures that all security incidents are reported to the public immediately.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of regulatory requirements in the context of cybersecurity operations?

   • ATo replace the need for technical security controls with administrative policies.
   • BTo provide a competitive advantage to organizations that adopt them voluntarily.
   • CTo establish minimum security and privacy standards that organizations must meet to protect sensitive data.
   • DTo eliminate all cybersecurity risks for organizations that comply.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a policy that requires all security incidents to be reported to the CISO within 24 hours. However, a recent incident was not reported until 48 hours later because the employee who discovered it did not know who to report it to. What is the most likely root cause of this failure?

   • AThe CISO was on vacation and could not be reached.
   • BThe employee was afraid of being punished for reporting the incident.
   • CThe responsibility for incident reporting was not clearly assigned and documented.
   • DThe incident was not severe enough to warrant immediate reporting.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization is implementing a new security policy that requires all employees to complete annual security training. The policy states that managers are responsible for ensuring their teams complete the training. How should the organization document this responsibility?

   • ASend an email to all employees stating that managers are responsible.
   • BInclude the responsibility in the policy document and reference it in each manager's job description.
   • CAssume that managers will understand their responsibility from the policy title.
   • DVerbally communicate the responsibility to managers during a team meeting.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a key element of cybersecurity governance?

   • AKeeping security policies confidential from employees to prevent circumvention.
   • BEstablishing a clear decision-making structure and accountability for security outcomes.
   • CPurchasing the most expensive security products on the market.
   • DEliminating all security risks to achieve zero risk.
   Reveal Solution Discussion Select an answer first