Information Security Strategy Development CISM Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A government agency has identified three major gaps: weak network segmentation, lack of a data loss prevention (DLP) program, and insufficient security awareness. The CISO must develop a phased roadmap. Which roadmap approach is most effective?

   • APhase 1: Network segmentation. Phase 2: DLP program. Phase 3: Security awareness. With milestones and owners for each phase.
   • BDefer all initiatives until a new security framework is adopted.
   • CPhase 1: Security awareness. Phase 2: DLP program. Phase 3: Network segmentation.
   • DImplement all three initiatives simultaneously in the first quarter.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A regional bank is developing its three-year information security strategy. The board has set a strategic goal to increase digital customer engagement by 40% through a new mobile banking platform, while maintaining regulatory compliance. The CISO's draft strategy focuses almost exclusively on strengthening perimeter defenses and endpoint protection. Which action best aligns the security strategy with the organization's stated business objective?

   • ADefer the mobile platform initiative until the security strategy is fully approved and funded.
   • BAdd a strategic initiative to secure the mobile banking platform and its APIs, with supporting KPIs tied to customer adoption and incident metrics.
   • CMaintain the perimeter-focused strategy and present it as a standalone security plan to the board for approval.
   • DReplace the perimeter defense initiative with a single cloud migration project to modernize infrastructure.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of a KPI for monitoring security strategy implementation?

   • APercentage of security initiatives completed on schedule
   • BNumber of security policies written
   • CColor of the security team's logo
   • DNumber of security vendors used
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A CISO has implemented a new security strategy focused on reducing data breaches. To monitor the effectiveness of the strategy, the CISO must define KPIs. Which KPI best measures the effectiveness of the strategy's implementation?

   • ANumber of security vendors used across the organization.
   • BTotal IT budget as a percentage of revenue.
   • CPercentage of critical systems covered by the new endpoint detection and response (EDR) solution.
   • DNumber of security policies published on the intranet.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary goal of a current state assessment in information security strategy development?

   • ATo determine the future security architecture for the organization
   • BTo justify the need for additional security funding
   • CTo identify all security incidents that have occurred in the past
   • DTo establish a baseline of the organization's security capabilities and risks
   Reveal Solution Discussion Select an answer first