Strategic Planning (Budgets, Resources, Business Case) CISM Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security manager is building a business case for a new security information and event management (SIEM) system. The organization has a mature security team and existing logging infrastructure. The SIEM is expected to reduce incident response time. Which approach would most effectively justify the investment?

   • ACalculate the cost of the SIEM against the expected reduction in incident response time and the associated cost savings from faster containment.
   • BRecommend the SIEM because it is the latest technology and will modernize the security operations center.
   • CArgue that the SIEM is essential for compliance with industry regulations, even if the organization already meets them.
   • DState that the SIEM will improve the security team's visibility and provide better reporting to management.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When prioritizing security initiatives, which factor should be given the most weight?

   • AThe personal preference of the security manager
   • BThe number of staff required for the initiative
   • CThe cost of the initiative alone
   • DThe level of risk to the organization and its business impact
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security manager is preparing the budget for the next fiscal year. The organization has a new regulatory requirement that will require significant investment in compliance technology. The security manager must also address a growing number of ransomware threats. Which budgeting approach best balances these competing needs?

   • AAllocate the budget to ransomware defenses first, because they address an immediate and growing threat.
   • BSplit the budget evenly between the two needs to ensure both are addressed.
   • CAllocate the budget to meet the regulatory requirement first, then use any remaining funds for ransomware defenses.
   • DDevelop a business case for both needs, quantifying the cost of non-compliance and the potential impact of a ransomware attack, and present it to the board for a decision.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of key performance indicators (KPIs) in information security governance?

   • ATo replace the need for regular security audits
   • BTo define the technical configuration of security tools
   • CTo monitor the effectiveness of the security strategy and report progress
   • DTo provide a detailed list of all security incidents
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the first step in developing an information security budget?

   • APurchase the most advanced security tools available
   • BIdentify the security requirements and initiatives needed to address risks
   • CHire additional security staff
   • DDetermine the total amount of money available for security
   Reveal Solution Discussion Select an answer first