Information Security Strategy Development CISM Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A university is planning its security strategy implementation. The strategy includes deploying a new identity management system, enhancing security awareness training, and establishing a 24/7 security operations center. The CISO must develop a resource plan. Which resource planning approach is most appropriate?

   • AAllocating the entire security budget to the identity management system because it is the most critical initiative.
   • BHiring all new security staff before finalizing the technology requirements.
   • CDeferring the security operations center until the identity management system is fully operational.
   • DEstimating the financial, staffing, and technology requirements for each initiative and aligning them with the multi-year budget cycle.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of developing a phased roadmap for strategy implementation?

   • ATo avoid the need for monitoring progress
   • BTo implement initiatives in a logical sequence with milestones
   • CTo implement all initiatives simultaneously
   • DTo eliminate the need for stakeholder communication
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of resource planning in information security strategy implementation?

   • ATo ensure adequate financial, human, and technological resources are available
   • BTo reduce the security team's workload
   • CTo assign blame for security incidents
   • DTo select the cheapest security products available
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A manufacturing company is starting its annual security strategy review. The CISO has gathered data on current security incidents, control effectiveness, and compliance audit results. The next step in the strategy development process is to compare this current state against the desired future state defined by the board's risk appetite. Which activity best represents this next step?

   • ADeveloping a detailed budget for all proposed security technology purchases.
   • BDrafting a communication plan to inform employees about new security policies.
   • CConducting a gap analysis to identify deficiencies between existing controls and the target security capabilities.
   • DSelecting a new security information and event management (SIEM) vendor.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a key trigger for reviewing and updating the information security strategy?

   • AThe hiring of a new security analyst
   • BA significant change in the organization's business direction
   • CThe purchase of new security software
   • DThe completion of a single security project
   Reveal Solution Discussion Select an answer first