Strategic Planning (Budgets, Resources, Business Case) CISM Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a valid criterion for prioritizing security projects?

   • AThe number of security incidents in the past year
   • BThe ease of implementation of the project
   • CRegulatory requirements that mandate specific security controls
   • DThe popularity of a security technology among peers
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security manager must prioritize two projects: one that addresses a high-risk vulnerability in a critical system and another that improves the user experience of the security portal. The organization has limited resources. Which project should be prioritized?

   • ABoth projects simultaneously, splitting resources equally.
   • BThe user experience project, because it will increase employee satisfaction and adoption of security tools.
   • CThe high-risk vulnerability project, because it directly reduces the likelihood of a significant security incident.
   • DThe user experience project first, because it is cheaper and quicker to implement.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In the context of information security governance, what is the primary purpose of strategic planning?

   • ATo define the detailed technical configuration of security controls
   • BTo align security initiatives with the organization's overall goals and risk appetite
   • CTo allocate the annual budget for security operations
   • DTo ensure compliance with all applicable laws and regulations
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security manager is developing a strategic plan for the next three years. The organization is planning to expand into new international markets, which will introduce new data privacy regulations. The security manager must ensure the security strategy supports this business expansion. Which action is most important?

   • ADevelop a separate security strategy for the new markets, independent of the overall strategy.
   • BPrioritize the security strategy based on the current risk landscape and ignore the expansion for now.
   • CFocus the security strategy on the current market's regulations and defer any changes until the expansion is complete.
   • DIncorporate the new regulatory requirements into the security strategy and allocate resources to ensure compliance in the new markets.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security manager is planning a major security initiative and must determine the resources required. Which resource type is most often underestimated in security projects?

   • AFacilities resources, such as office space and utilities.
   • BHuman resources, such as security analysts and engineers.
   • CTechnical resources, such as hardware and software.
   • DFinancial resources, such as the budget for the project.
   Reveal Solution Discussion Select an answer first