Information Security Strategy Development CISM Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A retail company's gap analysis reveals that the organization lacks multi-factor authentication (MFA) for remote access, has no formal incident response plan, and has outdated data classification policies. The CISO must prioritize strategic initiatives to close these gaps. Which initiative should be prioritized first?

   • ADeveloping a comprehensive incident response plan over the next year.
   • BImplementing MFA for all remote access within the next quarter.
   • CUpdating the data classification policy before any other initiative.
   • DDeferring all initiatives until the next annual budget cycle.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of defining key performance indicators (KPIs) for the security strategy?

   • ATo monitor the implementation and effectiveness of the strategy
   • BTo assign blame for security failures
   • CTo guarantee the success of the strategy
   • DTo replace the need for security audits
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a key component of assessing the current information security posture?

   • ASelecting security metrics for future monitoring
   • BDefining the organization's risk appetite
   • CDeveloping new security policies and procedures
   • DEvaluating the effectiveness of existing security controls
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A CISO has developed a security strategy that requires significant investment and changes to business processes. The board is divided: some members support the investment, while others are concerned about the cost and impact on operations. The CISO must communicate the strategy to gain approval. Which communication approach is most effective?

   • APresenting a cost-benefit analysis that quantifies the potential financial impact of security incidents and the expected return on investment.
   • BEmphasizing the technical sophistication of the proposed security controls.
   • CFocusing only on the compliance requirements to justify the investment.
   • DRequesting that the board approve the strategy without discussion to avoid delays.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of obtaining approval from senior management for the security strategy?

   • ATo avoid the need for further stakeholder communication
   • BTo satisfy the requirements of external auditors
   • CTo ensure the strategy has the authority and resources needed for implementation
   • DTo transfer responsibility for security to senior management
   Reveal Solution Discussion Select an answer first