Cybersecurity Governance CCOA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is restructuring its IT department. The CISO wants to ensure that the security team has clear roles and responsibilities, but the CIO wants to merge the security team into the IT operations team to reduce costs. What is the best way to handle this conflict?

   • AMerge the security team into IT operations to reduce costs and improve efficiency.
   • BHave the CIO take over the security team and report to the CISO.
   • CKeep the security team separate from IT operations but establish clear communication and collaboration processes.
   • DOutsource the security team to a managed security service provider.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A manufacturing company's executive team wants to ensure that cybersecurity investments are prioritized based on business risk and that security decisions are made with board-level visibility. Which approach best aligns cybersecurity with organizational objectives?

   • ADelegate all cybersecurity decisions to the IT department to ensure technical expertise is applied.
   • BPurchase a comprehensive cybersecurity insurance policy to transfer all risk.
   • CEstablish a cybersecurity governance framework that includes a steering committee, risk-based decision-making, and regular reporting to the board.
   • DImplement a state-of-the-art firewall and endpoint protection to reduce risk.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How do regulatory requirements typically influence an organization's cybersecurity governance?

   • AThey replace the need for internal security policies and risk management processes.
   • BThey only apply to government agencies and do not affect private sector organizations.
   • CThey mandate specific security controls and practices that the organization must implement to avoid legal penalties.
   • DThey provide voluntary guidelines that organizations may choose to adopt at their discretion.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which compliance framework is specifically designed to provide a comprehensive set of controls for information security and is widely used as a basis for certification and as a reference for establishing an information security management system?

   • AISO/IEC 27001
   • BPCI DSS
   • CNIST SP 800-53
   • DGDPR
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A retail company is creating a policy that defines acceptable use of company devices and the consequences for violations. The policy is approved by the board and communicated to all employees. What is the primary role of this governance policy?

   • ATo replace the need for technical security controls such as firewalls and antivirus software.
   • BTo establish clear expectations for employee behavior and provide a basis for consistent enforcement and accountability.
   • CTo document the company's security architecture and network diagrams.
   • DTo serve as a legal contract between the company and its customers.
   Reveal Solution Discussion Select an answer first