Strategic Planning (Budgets, Resources, Business Case) CISM Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of a security KPI?

   • AThe color scheme of the security dashboard
   • BThe number of security vendors in the market
   • CPercentage of systems with up-to-date patches
   • DThe brand of firewall used in the network
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security manager has implemented a new security awareness program and needs to report its effectiveness to the executive committee. Which metric would best demonstrate the program's impact on reducing risk?

   • ANumber of security incidents caused by human error before and after the training.
   • BPercentage of employees who completed the training module.
   • CAverage score on the post-training quiz.
   • DTotal hours of training delivered across the organization.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security manager is implementing a new security strategy and needs to establish KPIs to measure its effectiveness. The strategy includes improving incident response and reducing the time to patch critical vulnerabilities. Which set of KPIs would best measure the success of this strategy?

   • APercentage of employees who completed security awareness training and the number of phishing simulations conducted.
   • BNumber of security tools deployed and the total budget spent on security.
   • CNumber of security alerts generated and the number of false positives.
   • DMean time to respond (MTTR) to incidents and average time to patch critical vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security manager needs to justify the purchase of a new data loss prevention (DLP) solution. The organization has experienced several small data leaks. Which element is most important to include in the business case?

   • AA recommendation from the security team that the solution is needed.
   • BA statement that the DLP solution is the market leader.
   • CA detailed cost-benefit analysis showing the potential cost of data breaches versus the cost of the DLP solution.
   • DA list of all the features of the DLP solution and how they work.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security manager is developing the annual security plan and must allocate a limited budget across several initiatives. The organization has just experienced a minor data breach and faces a new regulatory deadline in six months. Which allocation strategy best aligns with the strategic plan?

   • ADivide the budget equally among all initiatives to ensure every area gets some funding.
   • BAllocate the budget based on the cost of each initiative, from lowest to highest, to maximize the number of projects funded.
   • CFocus all funds on the breach response to prevent another incident, and defer the regulatory project.
   • DPrioritize the regulatory deadline first, then allocate remaining funds to address the breach's root cause and other high-risk gaps.
   Reveal Solution Discussion Select an answer first