1.3 - Evaluate and Apply Security Governance Principles CISSP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company's board of directors is reviewing the security program after a minor incident. The CISO presents a report showing that all identified risks were accepted by management. The board is concerned about the lack of risk reduction. What is the best response?

   • AExplain that risk acceptance is a valid governance decision and document the rationale.
   • BDefend the risk acceptance decisions as final and not subject to review.
   • CAcknowledge the concern and propose a risk treatment plan to reduce the most critical risks.
   • DBlame the management team for accepting the risks.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In security governance, which role is ultimately accountable for the overall success of the organization's security program?

   • AThe Chief Financial Officer (CFO)
   • BThe Chief Information Security Officer (CISO)
   • CThe Chief Information Officer (CIO)
   • DThe Chief Executive Officer (CEO)
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A healthcare organization is implementing a new electronic health record system. The board of directors has approved the budget and wants to ensure accountability for security decisions. Which role is ultimately accountable for the security of the organization's information assets?

   • ASecurity Architect
   • BBoard of Directors
   • CChief Information Officer (CIO)
   • DChief Information Security Officer (CISO)
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturing company's strategic goal is to expand into new international markets. The security team proposes a new data classification policy. How can the security team best demonstrate business alignment?

   • AFocus the policy only on protecting intellectual property, ignoring other data types.
   • BImplement the policy and train all employees on its requirements.
   • CDesign the policy to comply with data protection regulations in the target markets.
   • DDelay the policy until after the expansion is complete to avoid disruption.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is implementing a new security program. The CEO wants to delegate all security responsibilities to the CISO to avoid board involvement. The CISO is concerned about governance. What is the best course of action?

   • AAccept the delegation and assume full responsibility.
   • BClarify that the board retains ultimate accountability and establish regular reporting to the board.
   • CRefuse to take any responsibility without board approval.
   • DDelegate the responsibility to the security team.
   Reveal Solution Discussion Select an answer first