Strategic Planning (Budgets, Resources, Business Case) CISM Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security manager is preparing the annual security budget and must include all necessary components. Which item is a critical component of an information security budget that is often overlooked?

   • ASalaries for security staff.
   • BCost of security software licenses.
   • CFunding for security awareness training.
   • DHardware costs for security appliances.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a typical component of an information security budget?

   • AOnly the costs of security audits
   • BOnly the costs of security awareness training
   • COnly the costs of security incident response
   • DCosts for hardware, software, and personnel dedicated to security
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of a business case for an information security investment?

   • ATo provide detailed technical specifications for the security solution
   • BTo document the security incident response plan
   • CTo justify the investment by demonstrating its benefits and risk reduction
   • DTo list all potential security threats to the organization
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security manager has a limited budget and must choose between two projects: Project A addresses a vulnerability in a system that is not business-critical but has a high likelihood of exploitation. Project B addresses a vulnerability in a business-critical system that has a low likelihood of exploitation. Which project should be prioritized?

   • AProject B, because the business-critical nature of the system means the impact of a breach would be severe, even if the likelihood is low.
   • BPrioritize based on a risk assessment that combines likelihood and impact for both projects.
   • CPrioritize the project that is cheaper to implement, regardless of risk.
   • DProject A, because the high likelihood of exploitation means it is more likely to occur and cause disruption.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a key element of a compelling business case for security investment?

   • AA cost-benefit analysis that shows the expected return on investment
   • BA detailed network diagram of the current infrastructure
   • CA list of all security vendors in the market
   • DA copy of the organization's security policy
   Reveal Solution Discussion Select an answer first