Information Security Strategy Development CISM Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A CISO is developing a resource plan for a new security strategy. The strategy includes three major initiatives: (1) deploying a zero-trust architecture, (2) establishing a security operations center (SOC), and (3) implementing a data classification program. The organization has a limited budget and a shortage of skilled security staff. The CISO must present a realistic resource plan to the board. Which approach is most appropriate?

   • AAllocating the entire budget to the zero-trust architecture and deferring the SOC and data classification indefinitely.
   • BProposing to implement all initiatives using existing staff without additional budget.
   • CProposing a phased resource plan that prioritizes the SOC, uses managed security services to address staffing shortages, and aligns costs with the multi-year budget.
   • DRequesting an immediate budget increase to hire all necessary staff and implement all initiatives in the first year.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization's security strategy was approved two years ago. Since then, the company has acquired a new subsidiary and the threat landscape has shifted significantly. The CISO must ensure the strategy remains relevant. Which action is most appropriate?

   • AReplacing the entire strategy with a new one based solely on the subsidiary's existing security policies.
   • BConducting a scheduled review of the strategy, incorporating the acquisition and updated threat intelligence into a revised roadmap.
   • CContinuing to execute the original strategy unchanged until the next scheduled review in two years.
   • DDeferring any changes until a major security incident occurs.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of communicating the security strategy to stakeholders?

   • ATo gain buy-in and support for the strategy
   • BTo assign blame for past security failures
   • CTo confuse competitors about security capabilities
   • DTo fulfill regulatory requirements for disclosure
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of aligning the information security strategy with organizational goals and business requirements?

   • ATo satisfy external auditors by documenting security policies and procedures
   • BTo ensure the security strategy is identical to the organization's IT strategy
   • CTo guarantee that all security controls are implemented with the highest possible strength
   • DTo ensure security investments directly support the achievement of business objectives
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A logistics company has completed a gap analysis and identified the need to enhance its security operations center (SOC) capabilities. The CISO must formulate strategic objectives and initiatives. Which formulation best defines a strategic objective with associated initiatives?

   • AObjective: Reduce security incidents. Initiative: Increase the security awareness training budget.
   • BObjective: Become a best-in-class security organization. Initiative: Adopt all industry best practices.
   • CObjective: Improve threat detection and response. Initiative: Deploy a SIEM platform and hire two additional security analysts within 12 months.
   • DObjective: Purchase a new SIEM tool. Initiative: Install the software on existing servers.
   Reveal Solution Discussion Select an answer first