Strategic Planning (Budgets, Resources, Business Case) CISM Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   What is the primary goal of effective resource allocation for security initiatives?

   • ATo minimize the total cost of the security program
   • BTo distribute resources equally across all security projects
   • CTo allocate the most resources to the largest department
   • DTo allocate resources based on the risk and priority of each initiative
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following are the three main categories of resources required for information security initiatives?

   • AHuman, technical, and financial
   • BHardware, software, and data
   • CTime, money, and materials
   • DPeople, processes, and technology
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security manager must allocate a fixed budget across three initiatives: patching critical vulnerabilities, implementing multi-factor authentication (MFA) for remote access, and upgrading the firewall. The organization has a high rate of successful phishing attacks and a recent audit found that MFA is not enforced for remote users. Which allocation strategy best addresses the most pressing risks?

   • AAllocate the majority to the firewall upgrade, because it is the first line of defense.
   • BAllocate the budget equally among all three initiatives to ensure all areas are addressed.
   • CAllocate the majority to patching, because unpatched vulnerabilities are a leading cause of breaches.
   • DAllocate the majority of the budget to MFA, because the audit finding indicates a compliance gap and remote access is a high-risk entry point.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manufacturing company's security manager must justify a significant investment in a new OT/ICS monitoring platform. The board is cost-sensitive and has asked for a business case that clearly demonstrates value. Which approach would most effectively build the business case?

   • AEmphasize that the platform is an industry best practice and that competitors are already using similar solutions.
   • BList all the technical features of the platform and explain how each one works in detail.
   • CQuantify the potential financial impact of a production downtime incident and compare it to the cost of the platform over its lifecycle.
   • DState that the platform is necessary to comply with a new industry standard, without detailing the cost of non-compliance.
   Reveal Solution Discussion Select an answer first