Information Security Strategy Development CISM Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A CISO has developed a roadmap for a security strategy with three phases. Phase 1 includes implementing multi-factor authentication (MFA) and patching critical vulnerabilities. Phase 2 includes deploying a data loss prevention (DLP) program. Phase 3 includes establishing a formal security awareness program. The CISO must present this roadmap to the board, which is concerned about the time to value. Which adjustment to the roadmap would best address the board's concern?

   • AKeeping the roadmap unchanged and explaining that security initiatives take time.
   • BCombining all phases into a single year to accelerate implementation.
   • CMoving the security awareness program to Phase 1 because it is a quick win that demonstrates progress.
   • DRemoving the DLP program from the roadmap to reduce scope.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A CISO has developed a new security strategy that requires significant changes to business processes and additional investment. To gain buy-in, the CISO must communicate the strategy to key stakeholders. Which communication approach is most effective for obtaining support from the board of directors?

   • ASending a summary email to all employees before informing the board.
   • BPresenting the strategy in terms of business risk reduction, regulatory compliance, and alignment with strategic business goals.
   • CAnnouncing the strategy at a company-wide town hall without prior board consultation.
   • DProviding a detailed technical briefing on the specific security tools and configurations to be deployed.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of a gap analysis in information security strategy development?

   • ATo document all security incidents that have occurred
   • BTo calculate the return on investment for each security control
   • CTo identify differences between the current and target security states to prioritize initiatives
   • DTo select specific security products and vendors
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why is it important to establish a process for periodic review and update of the security strategy?

   • ATo adapt to changes in the business and threat landscape
   • BTo ensure the strategy remains unchanged
   • CTo reduce the frequency of security awareness training
   • DTo avoid the need for annual security audits
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A CISO has finalized a three-year security strategy and needs to integrate it into the organization's governance processes. Which action best ensures the strategy is formally approved and embedded in governance?

   • APresenting the strategy to the board for formal approval and then linking its initiatives to the annual risk management and audit cycles.
   • BPublishing the strategy on the internal website and asking employees to follow it.
   • CDeferring board approval until the first annual review of the strategy.
   • DStoring the strategy document in the CISO's office and sharing it only with the security team.
   Reveal Solution Discussion Select an answer first